Edit tour

Windows Analysis Report
ElitechLogWin V6.4.6.exe

Overview

General Information

Sample name:	ElitechLogWin V6.4.6.exe
Analysis ID:	1529178
MD5:	652fe95cae571a325a6280df4447331c
SHA1:	50881a81da3d08a290765d540642faa3399c06e0
SHA256:	fb04a9a86ca842cc76ea7a75a2ef18e85821370893f854f432e8965d1a919433
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Found stalling execution ending in API Sleep call

Yara detected Generic Downloader

Contains functionality to dynamically determine API calls

Contains functionality to read device registry values (via SetupAPI)

Creates files inside the driver directory

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables driver privileges

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

Queries device information via Setup API

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ElitechLogWin V6.4.6.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe" MD5: 652FE95CAE571A325A6280DF4447331C)

ElitechLogWin V6.4.6.tmp (PID: 7268 cmdline: "C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp" /SL5="$20444,64977810,121344,C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe" MD5: 90FC739C83CD19766ACB562C66A7D0E2)

SETUP.EXE (PID: 7560 cmdline: "C:\ElitechLogWin\Drivers\CH341\SETUP.exe" /S MD5: 3A5073FC9D6E4A7102A97E8A971AE6DE)

DRVSETUP64.exe (PID: 7588 cmdline: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.EXE \s MD5: 39F706639A8E235BFDFE9735E178E6A0)

CP210xVCPInstaller_x64.exe (PID: 7776 cmdline: "C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe" /S MD5: BE3C79033FA8302002D9D3A6752F2263)

drvinst.exe (PID: 7728 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341SER.INF" "9" "4a0278e77" "000000000000015C" "WinSta0\Default" "0000000000000164" "208" "C:\ElitechLogWin\Drivers\CH341\WIN 1X" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 7836 cmdline: DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\slabvcp.inf" "9" "43ef4524b" "0000000000000168" "WinSta0\Default" "0000000000000118" "208" "c:\elitechlogwin\drivers\cp210x" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ElitechLogWin\is-3KLJS.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ElitechLogWin\is-64LH2.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: ElitechLogWin V6.4.6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\B97004A400E30DCF940971EFA7A0C13C6B0A4B66

Jump to behavior

Source: ElitechLogWin V6.4.6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: f:\project\wang\ch34xser\ch34xpt\ch343pt_v140\ch341pt\objfre_w2K_x86\i386\CH341PT.pdb3 source: drvinst.exe, 00000008.00000003.1927322790.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp, OLDDDF2.tmp.4.dr
Source:	Binary string: e:\j\workspace\cp210x_vcp_driver-windows-build_sandbox\src\sandbox\fixedfunction\host\windows\driver\silabser\objfre_wnet_amd64\amd64\silabser.pdb source: CP210xVCPInstaller_x64.exe, 00000009.00000003.1957349330.0000000000C84000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.1973908241.000001C02884A000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.1970931813.000001C0287DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: is-69FOL.tmp.1.dr
Source:	Binary string: {code:getAppFileDir}\DL.pdb source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.00000000022FD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch341ser\ch341ser_v37\objfre_wnet_AMD64\amd64\CH341S64.pdb source: DRVSETUP64.exe, 00000004.00000003.1913621464.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1932688011.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1928286134.000001C92D260000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch341ser\ch341ser_v37\objfre_w2K_x86\i386\CH341SER.pdb source: DRVSETUP64.exe, 00000004.00000003.1942142456.0000000000653000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfxcab.pdb source: is-R21KT.tmp.1.dr, is-V65L8.tmp.1.dr
Source:	Binary string: C:\ElitechLogWin\DL.pdb source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.000000000230C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\j\workspace\cp210x_vcp_driver-windows-build_sandbox\src\sandbox\fixedfunction\host\windows\driver\silabenm\objfre_wnet_amd64\amd64\silabenm.pdb source: drvinst.exe, 0000000A.00000003.1971221732.000001C0287AB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: boxstub.pdb source: is-77COG.tmp.1.dr
Source:	Binary string: _std_v172\objfre_wnet_AMD64\amd64\DRVSETUP64.pdb source: DRVSETUP64.exe, DRVSETUP64.exe, 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, DRVSETUP64.exe, 00000004.00000000.1885279785.0000000001001000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: _std_v172\objfre_wnet_AMD64\amd64\DRVSETUP64.pdbL source: DRVSETUP64.exe, 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, DRVSETUP64.exe, 00000004.00000000.1885279785.0000000001001000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: sfxcab.pdbU source: is-R21KT.tmp.1.dr, is-V65L8.tmp.1.dr
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: is-69FOL.tmp.1.dr
Source:	Binary string: f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_wnet_AMD64\amd64\CH341PORTSA64.pdb source: drvinst.exe, 00000008.00000003.1932743043.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1929076727.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xpt\ch343pt_v140\ch341pt\objfre_wnet_AMD64\amd64\CH341PTA64.pdb source: DRVSETUP64.exe, 00000004.00000003.1913001707.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1932535299.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1926138994.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xpt\ch343pt_v140\ch341pt\objfre_w2K_x86\i386\CH341PT.pdb source: drvinst.exe, 00000008.00000003.1927322790.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp, OLDDDF2.tmp.4.dr
Source:	Binary string: 6{code:getAppFileDir}\DL.pdb source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.1674913728.00000000031A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ElitechLogWin\DL.pdbq02 source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.000000000231A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdbH source: CP210xVCPInstaller_x64.exe, 00000009.00000000.1942248903.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp, CP210xVCPInstaller_x64.exe, 00000009.00000002.1999488611.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_w2K_x86\i386\CH341PORTS.pdb source: DRVSETUP64.exe, 00000004.00000003.1963986822.0000000000647000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1965732385.000000000065C000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1962380309.0000000000647000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1943093884.0000000000652000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1948228673.000000000065C000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1957944621.0000000000647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_wnet_AMD64\amd64\CH341PORTSA64.pdbL source: drvinst.exe, 00000008.00000003.1932743043.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1929076727.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdb source: CP210xVCPInstaller_x64.exe, CP210xVCPInstaller_x64.exe, 00000009.00000000.1942248903.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp, CP210xVCPInstaller_x64.exe, 00000009.00000002.1999488611.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_004056B0 FindFirstFileA,GetLastError,

3_2_004056B0

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4x nop then lea rax, qword ptr [rsp+40h]	4_2_01004E10
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4x nop then movzx edx, byte ptr [r11+r8]	4_2_01003230
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4x nop then movzx eax, byte ptr [rdx+rcx]	4_2_01003540
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4x nop then movzx eax, byte ptr [rcx+rdx]	4_2_01004830
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4x nop then lea rdx, qword ptr [00000000010016F0h]	4_2_01003C60

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\ElitechLogWin\is-3KLJS.tmp, type: DROPPED
Source: Yara match	File source: C:\ElitechLogWin\is-64LH2.tmp, type: DROPPED

Source: unknown

DNS traffic detected: query: 171.39.242.20.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: DRVSETUP64.exe, 00000004.00000000.1885279785.0000000001001000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://wch.cn
Source: SETUP.EXE, DRVSETUP64.exe	String found in binary or memory: http://wch.cnEmail:
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.2029892490.000000000230D000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.00000000022FD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elitechlog.com/
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.2029892490.000000000230D000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.00000000022FD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elitechlog.com/)
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.1672316556.0000000002480000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000003.1674913728.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elitechlog.com/4http://www.elitechlog.com/Hhttp://www.elitechlog.com/softwares/
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.2029892490.000000000231C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elitechlog.com/softwares/
Source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.000000000230C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elitechlog.com/softwares/A
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.1673270140.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.exe, 00000000.00000003.1673006158.0000000002480000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000000.1673971578.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: ElitechLogWin V6.4.6.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-07HJ6.tmp.1.dr	String found in binary or memory: http://www.nlog-project.org/schemas/NLog.xsd
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.1673270140.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.exe, 00000000.00000003.1673006158.0000000002480000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000000.1673971578.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps

Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\slabvcp.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\slabvcp.cat (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD13C.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\SETE36F.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\SETE7D4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.CAT (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341SER.CAT (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-FE8JT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\is-4T4TN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-VV0UG.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341SER.CAT (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD5FF.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341SER.CAT (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\slabvcp.cat (copy)	Jump to dropped file

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

File created: C:\Windows\System32\Drivers\SETDCC5.tmp

Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDCC5.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDCC5.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDCE5.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDCE5.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDD06.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDD06.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDD64.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDD64.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDD85.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDD85.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDD95.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDD95.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDDE4.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDDE4.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDE05.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDE05.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDE25.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDE25.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDEB2.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETDEB2.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDED3.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDED3.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDF03.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETDF03.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE2AD.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE2AD.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE2BE.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE2BE.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE2DE.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE2DE.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE35C.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE35C.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE37C.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE37C.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE38D.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE38D.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE3CC.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE3CC.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE40C.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE40C.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE44B.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\SETE44B.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE49A.tmp	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\SETE49A.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_75252babad7f5d99	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Windows\DPINST.LOG	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\slabvcp.inf_amd64_ab8310f5de07b344	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\slabvcp.inf_amd64_ab8310f5de07b344\x64	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem5.inf	Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

File deleted: C:\Windows\System32\drivers\SETDCC5.tmp

Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: 3_2_00401970	3_2_00401970
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: 3_2_0040A6DD	3_2_0040A6DD
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: 3_2_0040AEF7	3_2_0040AEF7
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: 3_2_00404930	3_2_00404930
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: 3_2_00403980	3_2_00403980
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01007400	4_2_01007400
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01005A30	4_2_01005A30
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01003540	4_2_01003540
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01002DE0	4_2_01002DE0
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01006400	4_2_01006400
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01005520	4_2_01005520
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01004830	4_2_01004830
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01003C60	4_2_01003C60

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: String function: 004051CF appears 35 times
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: String function: 01001328 appears 35 times
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: String function: 01001260 appears 33 times

Source: ElitechLogWin V6.4.6.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: ElitechLogWin V6.4.6.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-7A1RE.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-7A1RE.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.1673006158.0000000002596000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs ElitechLogWin V6.4.6.exe
Source: ElitechLogWin V6.4.6.exe, 00000000.00000003.1673270140.000000007FE32000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs ElitechLogWin V6.4.6.exe

Source: ElitechLogWin V6.4.6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-ACGED.tmp.1.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: is-ACGED.tmp.1.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: is-ACGED.tmp.1.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'
Source: is-4QHAT.tmp.1.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: is-4QHAT.tmp.1.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: classification engine

Classification label: sus24.troj.evad.winEXE@11/534@1/0

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DPINST_LOG_SCROLLER_MUTEX
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Mutant created: NULL
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DIFX_PROGRAM_FILES_MUTEX

Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe

File created: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: SETUP.EXE	String found in binary or memory: The drive is successfully Pre-installed in advance!
Source: SETUP.EXE	String found in binary or memory: 1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins
Source: SETUP.EXE	String found in binary or memory: Driver Pre-install failure!
Source: SETUP.EXE	String found in binary or memory: 1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins
Source: DRVSETUP64.exe	String found in binary or memory: 1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins
Source: DRVSETUP64.exe	String found in binary or memory: mand line implicit installation [ SETUP /S ], command line implicit pre-installation [ SETUP /P ], uninstall [ SETUP /U ].
Source: DRVSETUP64.exe	String found in binary or memory: The drive is successfully Pre-installed in advance!
Source: DRVSETUP64.exe	String found in binary or memory: Driver Pre-install failure!
Source: DRVSETUP64.exe	String found in binary or memory: 1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins
Source: CP210xVCPInstaller_x64.exe	String found in binary or memory: Some post-install cleanup tasks failed. Error code is 0x%X
Source: CP210xVCPInstaller_x64.exe	String found in binary or memory: Successfully re-added '%s' to reference list of driver store entry '%s'
Source: CP210xVCPInstaller_x64.exe	String found in binary or memory: Could not re-add '%s' to reference list of driver store entry '%s'
Source: CP210xVCPInstaller_x64.exe	String found in binary or memory: Install option set: Suppress pre-install of Plug and Play drivers if no matching devices are present.
Source: CP210xVCPInstaller_x64.exe	String found in binary or memory: Error 0x%X - Could not delete service info key for '%ws', even though there are no more DIFx-installed driver stores using this se
Source: CP210xVCPInstaller_x64.exe	String found in binary or memory: During undo of install, we failed to re-install the driver. Error code 0x%X
Source: ElitechLogWin V6.4.6.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe

File read: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe "C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe"
Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp "C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp" /SL5="$20444,64977810,121344,C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process created: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE "C:\ElitechLogWin\Drivers\CH341\SETUP.exe" /S
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Process created: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.EXE \s
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341SER.INF" "9" "4a0278e77" "000000000000015C" "WinSta0\Default" "0000000000000164" "208" "C:\ElitechLogWin\Drivers\CH341\WIN 1X"
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process created: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe "C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe" /S
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\slabvcp.inf" "9" "43ef4524b" "0000000000000168" "WinSta0\Default" "0000000000000118" "208" "c:\elitechlogwin\drivers\cp210x"
Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp "C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp" /SL5="$20444,64977810,121344,C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process created: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE "C:\ElitechLogWin\Drivers\CH341\SETUP.exe" /S	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process created: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe "C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe" /S	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Process created: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.EXE \s	Jump to behavior

Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: winmm.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: samcli.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: mpr.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Section loaded: netutils.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: spfileq.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\B97004A400E30DCF940971EFA7A0C13C6B0A4B66

Jump to behavior

Source: ElitechLogWin V6.4.6.exe

Static file information: File size 65387183 > 1048576

Source: ElitechLogWin V6.4.6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: f:\project\wang\ch34xser\ch34xpt\ch343pt_v140\ch341pt\objfre_w2K_x86\i386\CH341PT.pdb3 source: drvinst.exe, 00000008.00000003.1927322790.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp, OLDDDF2.tmp.4.dr
Source:	Binary string: e:\j\workspace\cp210x_vcp_driver-windows-build_sandbox\src\sandbox\fixedfunction\host\windows\driver\silabser\objfre_wnet_amd64\amd64\silabser.pdb source: CP210xVCPInstaller_x64.exe, 00000009.00000003.1957349330.0000000000C84000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.1973908241.000001C02884A000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.1970931813.000001C0287DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: is-69FOL.tmp.1.dr
Source:	Binary string: {code:getAppFileDir}\DL.pdb source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.00000000022FD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch341ser\ch341ser_v37\objfre_wnet_AMD64\amd64\CH341S64.pdb source: DRVSETUP64.exe, 00000004.00000003.1913621464.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1932688011.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1928286134.000001C92D260000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch341ser\ch341ser_v37\objfre_w2K_x86\i386\CH341SER.pdb source: DRVSETUP64.exe, 00000004.00000003.1942142456.0000000000653000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfxcab.pdb source: is-R21KT.tmp.1.dr, is-V65L8.tmp.1.dr
Source:	Binary string: C:\ElitechLogWin\DL.pdb source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.000000000230C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\j\workspace\cp210x_vcp_driver-windows-build_sandbox\src\sandbox\fixedfunction\host\windows\driver\silabenm\objfre_wnet_amd64\amd64\silabenm.pdb source: drvinst.exe, 0000000A.00000003.1971221732.000001C0287AB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: boxstub.pdb source: is-77COG.tmp.1.dr
Source:	Binary string: _std_v172\objfre_wnet_AMD64\amd64\DRVSETUP64.pdb source: DRVSETUP64.exe, DRVSETUP64.exe, 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, DRVSETUP64.exe, 00000004.00000000.1885279785.0000000001001000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: _std_v172\objfre_wnet_AMD64\amd64\DRVSETUP64.pdbL source: DRVSETUP64.exe, 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, DRVSETUP64.exe, 00000004.00000000.1885279785.0000000001001000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: sfxcab.pdbU source: is-R21KT.tmp.1.dr, is-V65L8.tmp.1.dr
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: is-69FOL.tmp.1.dr
Source:	Binary string: f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_wnet_AMD64\amd64\CH341PORTSA64.pdb source: drvinst.exe, 00000008.00000003.1932743043.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1929076727.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xpt\ch343pt_v140\ch341pt\objfre_wnet_AMD64\amd64\CH341PTA64.pdb source: DRVSETUP64.exe, 00000004.00000003.1913001707.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1932535299.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1926138994.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xpt\ch343pt_v140\ch341pt\objfre_w2K_x86\i386\CH341PT.pdb source: drvinst.exe, 00000008.00000003.1927322790.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp, OLDDDF2.tmp.4.dr
Source:	Binary string: 6{code:getAppFileDir}\DL.pdb source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.1674913728.00000000031A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ElitechLogWin\DL.pdbq02 source: ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.000000000231A000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdbH source: CP210xVCPInstaller_x64.exe, 00000009.00000000.1942248903.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp, CP210xVCPInstaller_x64.exe, 00000009.00000002.1999488611.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_w2K_x86\i386\CH341PORTS.pdb source: DRVSETUP64.exe, 00000004.00000003.1963986822.0000000000647000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1965732385.000000000065C000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1962380309.0000000000647000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1943093884.0000000000652000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1948228673.000000000065C000.00000004.00000020.00020000.00000000.sdmp, DRVSETUP64.exe, 00000004.00000003.1957944621.0000000000647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\project\wang\ch34xser\ch34xports\ch34xports_v120\ch341ports\objfre_wnet_AMD64\amd64\CH341PORTSA64.pdbL source: drvinst.exe, 00000008.00000003.1932743043.000001C92D2BE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.1929076727.000001C92D20A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdb source: CP210xVCPInstaller_x64.exe, CP210xVCPInstaller_x64.exe, 00000009.00000000.1942248903.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp, CP210xVCPInstaller_x64.exe, 00000009.00000002.1999488611.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_004030D0 Sleep,GetDlgItem,EnableWindow,UpdateWindow,MessageBoxA,MessageBoxA,lstrlenA,lstrlenA,MessageBoxA,Sleep,MessageBoxA,Sleep,Sleep,lstrlenA,LoadLibraryA,GetProcAddress,GetLastError,lstrlenA,lstrlenA,lstrlenA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,SetupCopyOEMInfA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,MessageBoxA,

3_2_004030D0

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_00405150 push eax; ret

3_2_0040517E

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\ICSharpCode.SharpZipLib.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDDF2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-7O4QT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\x86\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDD64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-LJB4O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\NPOI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-GDL1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\NLog.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\is-C2G31.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\is-69FOL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341SER.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE37C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\dotNetFx40_Client_x86_x64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-K0HRO.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE3CC.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE36A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-3KLJS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD6FC.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE2CB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD15D.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDD92.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE2A2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x86.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDE12.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\DL.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD75A.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\CH341SER.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x64\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD17D.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD66E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-64LH2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-4V221.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE437.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDDD2.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE755.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD7AA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\is-R21KT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-7UN9L.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDED3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\is-DA5P5.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDD06.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-UM7HD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x86\is-L43UA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-9M3SJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-RJR4R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-DH4PP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-J5RC5.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE2AB.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDEC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-QFG43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\MarkControl.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDE05.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE38D.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-ACGED.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE2AD.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x64\is-TFEFO.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDF03.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE49A.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE224.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE349.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE2F1.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDD72.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDCC5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-2GNAT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-VJMDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\is-J0HG7.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE29A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TN1V0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	File created: C:\Program Files\DIFX\4A7292F75FEBBD3C\CP210xVCPInstaller_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x86\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x86\is-FOH79.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDEF0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\is-77COG.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE40C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	File created: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-19MS8.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDD52.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-3KCTN.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDE90.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-7A1RE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-4QHAT.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-TKQEB.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDD95.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-3H8ON.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\wic_x86_chs.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\unins000.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD1CE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x64\is-0J93G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-6HU8U.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDEB2.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE2DE.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDD85.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDDE4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\itextsharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Ionic.Zip.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341M64.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\wic_x86_enu.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-22UOT.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE35C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-I08DP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-VI31J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Async_MessageBox.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\x86\is-4IMP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-EN453.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-NM5RC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\NGettext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341M64.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-7B027.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE44B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\is-JET2T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x86\is-B02VC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Crc32.NET.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\x64\is-P7DP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-U8CBL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\is-V65L8.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDCE5.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE775.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-23GIR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x86\silabenm.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x86\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE2BE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\is-RB961.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-J4G7J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Components\WindowsInstaller-KB893803-v2-x86.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\LumiSoft.Net.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\System.Data.SQLite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\x64\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD19E.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE476.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE745.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE37A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CP210x\x64\is-7BD1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDE25.tmp	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDDF2.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDD64.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE37C.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDEF0.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE40C.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDD52.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE3CC.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE36A.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDE90.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD6FC.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE2CB.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDD95.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDD92.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDE12.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDEB2.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE2DE.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD75A.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDD85.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\CH341SER.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\system32\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD66E.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE437.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDDD2.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE755.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD7AA.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDED3.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDDE4.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDD06.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE35C.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE2AB.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDEC0.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDE05.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE38D.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE2AD.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDF03.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE44B.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETE49A.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDCE5.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE349.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE775.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\Drivers\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETE2BE.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDDD72.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\drivers\SETDCC5.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE476.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE745.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE37A.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\Temp\OLDE29A.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	File created: C:\Windows\System32\SETDE25.tmp	Jump to dropped file

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE	Code function: 3_2_00403980 GetWindowsDirectoryA,GetPrivateProfileSectionA,GetPrivateProfileSectionA,MessageBoxA,MessageBoxA,GetPrivateProfileSectionA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,	3_2_00403980
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01003230 memset,memset,memset,memset,GetPrivateProfileSectionA,strchr,strchr,GetPrivateProfileSectionA,lstrlenA,strchr,strchr,memcpy,lstrlenA,lstrlenA,lstrlenA,	4_2_01003230
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01003540 memset,memset,memset,memset,memset,GetPrivateProfileSectionA,MessageBoxA,MessageBoxA,strchr,memcpy,strchr,GetPrivateProfileSectionA,strchr,strchr,memset,memcpy,memset,GetPrivateProfileStringA,memset,GetPrivateProfileStringA,memset,GetPrivateProfileStringA,	4_2_01003540
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Code function: 4_2_01003C60 memset,memset,memset,memset,memset,memset,SetupOpenInfFileA,memset,memset,SetupDiGetActualSectionToInstallA,GetPrivateProfileSectionA,strstr,strstr,strchr,lstrlenA,strchr,lstrlenA,memcpy,lstrlenA,memset,GetPrivateProfileSectionA,lstrlenA,lstrlenA,strchr,memset,memcpy,memset,GetPrivateProfileStringA,GetWindowsDirectoryA,strchr,lstrlenA,GetSystemDirectoryA,strchr,lstrlenA,DeleteFileA,lstrlenA,lstrlenA,lstrlenA,SetupCloseInfFile,lstrlenA,	4_2_01003C60

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElitechLogWin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElitechLogWin\ElitechLogWin.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElitechLogWin\Uninstall ElitechLogWin.lnk	Jump to behavior

Source: C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

Stalling execution: Execution stalls by calling Sleep

graph_4-1349

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_004044C0 SetupDiGetDeviceRegistryPropertyA,

3_2_004044C0

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_4-1096

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\ICSharpCode.SharpZipLib.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDDF2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\x86\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-7O4QT.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETDD64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-LJB4O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\NPOI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-GDL1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\NLog.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\is-69FOL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341SER.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\is-C2G31.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETE37C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\dotNetFx40_Client_x86_x64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETE3CC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-K0HRO.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE36A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-3KLJS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD6FC.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE2CB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD15D.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE2A2.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDD92.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x86.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDE12.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD75A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\DL.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\Drivers\CH341SER.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\system32\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD17D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x64\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD66E.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE437.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-4V221.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-64LH2.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE755.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDDD2.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD7AA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\is-R21KT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-7UN9L.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDED3.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDD06.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-UM7HD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x86\is-L43UA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-9M3SJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-RJR4R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-DH4PP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-J5RC5.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE2AB.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDEC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-QFG43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\MarkControl.dll (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDE05.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETE38D.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-ACGED.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETE2AD.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x64\is-TFEFO.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETE49A.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDF03.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE224.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE349.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE2F1.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\Drivers\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDD72.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETDCC5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-VJMDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-2GNAT.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE29A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TN1V0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x86\WdfCoInstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x86\is-FOH79.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\WdfCoinstaller01009.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabenm.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDEF0.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETE40C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\is-77COG.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDD52.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341S98.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-3KCTN.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\system32\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDDE90.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-7A1RE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-4QHAT.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\system32\CH341PORTS.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-TKQEB.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDD95.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-3H8ON.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\wic_x86_chs.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\unins000.exe (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD1CE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x64\is-0J93G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-6HU8U.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETDEB2.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETE2DE.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDD85.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETDDE4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\itextsharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341M64.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Ionic.Zip.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\wic_x86_enu.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-22UOT.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETE35C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-I08DP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Async_MessageBox.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-VI31J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\x86\is-4IMP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-EN453.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-NM5RC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341S64.SYS (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\NGettext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341M64.sys (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PORTSA64.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-7B027.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETE44B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\is-JET2T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Crc32.NET.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x86\is-B02VC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-U8CBL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\x64\is-P7DP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\is-V65L8.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE775.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDCE5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-23GIR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x86\silabenm.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.VXD (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x86\silabser.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341PTA64.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETE2BE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\is-RB961.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-J4G7J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Components\WindowsInstaller-KB893803-v2-x86.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\LumiSoft.Net.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\x64\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\System.Data.SQLite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\CH341PT.DLL (copy)	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE476.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD19E.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE745.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\Temp\OLDE37A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Dropped PE file which has not been started: C:\ElitechLogWin\Drivers\CP210x\x64\is-7BD1E.tmp	Jump to dropped file
Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe	Dropped PE file which has not been started: C:\Windows\System32\SETDE25.tmp	Jump to dropped file

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

API coverage: 4.3 %

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_004056B0 FindFirstFileA,GetLastError,

3_2_004056B0

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_00401100 GetFileAttributesA,GetVersionExA,GetWindowsDirectoryA,GetFileAttributesA,GetFileAttributesA,GetFileAttributesA,GetVersionExA,GetSystemInfo,GetVersionExA,GetVersionExA,GetVersionExA,GetVersionExA,GetVersionExA,

3_2_00401100

Source: ElitechLogWin V6.4.6.tmp, 00000001.00000002.2028198843.000000000079A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ElitechLogWin V6.4.6.tmp, 00000001.00000002.2028198843.000000000079A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ElitechLogWin V6.4.6.exe	Binary or memory string: HgfSIK
Source: is-R21KT.tmp.1.dr	Binary or memory string: jqeMU%

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

API call chain: ExitProcess graph end node

graph_3-5652

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

3_2_004030D0

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

Code function: 4_2_01007E10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_01007E10

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_004044C0 SetupDiGetDeviceRegistryPropertyA,

3_2_004044C0

Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341SER.CAT VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\slabvcp.cat VolumeInformation	Jump to behavior

Source: C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe

Code function: 4_2_01007D40 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_01007D40

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_00409018 GetTimeZoneInformation,WideCharToMultiByte,GetWindowsDirectoryA,WideCharToMultiByte,GetWindowsDirectoryA,WideCharToMultiByte,

3_2_00409018

Source: C:\ElitechLogWin\Drivers\CH341\SETUP.EXE

Code function: 3_2_004048C0 GetVersion,GetWindowsDirectoryA,MessageBoxA,EndDialog,

3_2_004048C0

Source: C:\Windows\System32\drvinst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	31 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 LSASS Driver	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 LSASS Driver	11 Deobfuscate/Decode Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	3 Obfuscated Files or Information	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	35 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ElitechLogWin V6.4.6.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\ElitechLogWin\Async_MessageBox.dll (copy)	0%	ReversingLabs
C:\ElitechLogWin\CH341PT.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Components\WindowsInstaller-KB893803-v2-x86.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Components\dotNetFx40_Client_x86_x64.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Components\is-69FOL.tmp	0%	ReversingLabs
C:\ElitechLogWin\Components\is-77COG.tmp	0%	ReversingLabs
C:\ElitechLogWin\Components\is-R21KT.tmp	0%	ReversingLabs
C:\ElitechLogWin\Components\is-V65L8.tmp	4%	ReversingLabs
C:\ElitechLogWin\Components\wic_x86_chs.exe (copy)	4%	ReversingLabs
C:\ElitechLogWin\Components\wic_x86_enu.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Crc32.NET.dll (copy)	0%	ReversingLabs
C:\ElitechLogWin\DL.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341M64.SYS (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341PORTS.DLL (copy)	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341PORTSA64.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341PT.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341PTA64.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341S64.SYS (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341S98.SYS (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341SER.SYS (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\CH341SER.VXD (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\is-DA5P5.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\SETUP.EXE (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341M64.sys (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTS.DLL (copy)	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTSA64.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PT.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PTA64.DLL (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S64.sys (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S98.SYS (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.VXD (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.sys (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-3KCTN.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-4V221.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-6HU8U.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-7O4QT.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-I08DP.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-J4G7J.tmp	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-TKQEB.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-UM7HD.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-VI31J.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-19MS8.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-23GIR.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-2GNAT.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-3H8ON.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-J5RC5.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-NM5RC.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-QFG43.tmp	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-RB961.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-RJR4R.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CH341\is-U8CBL.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x86.exe (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\is-C2G31.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\is-J0HG7.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x64\WdfCoInstaller01009.dll (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x64\is-0J93G.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x64\is-7BD1E.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x64\is-TFEFO.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x64\silabenm.sys (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x64\silabser.sys (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x86\WdfCoInstaller01009.dll (copy)	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x86\is-B02VC.tmp	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x86\is-FOH79.tmp	0%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x86\is-L43UA.tmp	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x86\silabenm.sys (copy)	2%	ReversingLabs
C:\ElitechLogWin\Drivers\CP210x\x86\silabser.sys (copy)	2%	ReversingLabs
C:\ElitechLogWin\ICSharpCode.SharpZipLib.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	ElitechLogWin V6.4.6.exe, 00000000.00000003.1673270140.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.exe, 00000000.00000003.1673006158.0000000002480000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000000.1673971578.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://wch.cnEmail:	SETUP.EXE, DRVSETUP64.exe	false		unknown
http://wch.cn	DRVSETUP64.exe, 00000004.00000000.1885279785.0000000001001000.00000020.00000001.01000000.00000009.sdmp	false		unknown
http://www.elitechlog.com/	ElitechLogWin V6.4.6.exe, 00000000.00000003.2029892490.000000000230D000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.00000000022FD000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.elitechlog.com/softwares/	ElitechLogWin V6.4.6.exe, 00000000.00000003.2029892490.000000000231C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.elitechlog.com/)	ElitechLogWin V6.4.6.exe, 00000000.00000003.2029892490.000000000230D000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.00000000022FD000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.elitechlog.com/4http://www.elitechlog.com/Hhttp://www.elitechlog.com/softwares/	ElitechLogWin V6.4.6.exe, 00000000.00000003.1672316556.0000000002480000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000003.1674913728.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.nlog-project.org/schemas/NLog.xsd	is-07HJ6.tmp.1.dr	false		unknown
http://www.remobjects.com/ps	ElitechLogWin V6.4.6.exe, 00000000.00000003.1673270140.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.exe, 00000000.00000003.1673006158.0000000002480000.00000004.00001000.00020000.00000000.sdmp, ElitechLogWin V6.4.6.tmp, 00000001.00000000.1673971578.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://www.elitechlog.com/softwares/A	ElitechLogWin V6.4.6.tmp, 00000001.00000003.2025422757.000000000230C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	ElitechLogWin V6.4.6.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529178
Start date and time:	2024-10-08 17:43:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ElitechLogWin V6.4.6.exe
Detection:	SUS
Classification:	sus24.troj.evad.winEXE@11/534@1/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target CP210xVCPInstaller_x64.exe, PID 7776 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ElitechLogWin V6.4.6.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ElitechLogWin\Components\WindowsInstaller-KB893803-v2-x86.exe (copy)	https://update.microgate.it/optojump/optojumpnext.exe	Get hash	malicious	Unknown	Browse
	7Y18r(197).exe	Get hash	malicious	Unknown	Browse
	7Y18r(230).exe	Get hash	malicious	Unknown	Browse
	7Y18r(245).exe	Get hash	malicious	Unknown	Browse
	https://download.autodesk.com/us/support/files/designreview/2018/EXE/ptb/SetupDesignReview.exe	Get hash	malicious	Unknown	Browse
	R1Ec55NKDw.exe	Get hash	malicious	Unknown	Browse
	https://www.buhl-bonsoe.dk/resources/download/testo%20ComSoft%20Basic%20v5%20SP%206.3%20-%20Logger%20software.exe	Get hash	malicious	Unknown	Browse
	https://ftp.ext.hp.com/pub/softlib/software13/COL55811/Im-134375-3/HPHP_LJ_Pro_MFP_M225-M226_Full_Solution_22051.exe	Get hash	malicious	Unknown	Browse
	https://gscs-b2c.lge.com/downloadFile?fileId=JCmfbdhuo6i4ujSC2MbC6Q	Get hash	malicious	Unknown	Browse
C:\ElitechLogWin\CH341PT.DLL (copy)	MDE_File_Sample_d5b2b4b33f236c2b9269c28086ff1805fbe9e699.zip	Get hash	malicious	Unknown	Browse
	Logpro-setup-english-64bit.exe	Get hash	malicious	Unknown	Browse
	stc-isp-15xx-v6.85.exe	Get hash	malicious	Unknown	Browse
	stc-isp-15xx-v6.85.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ElitechLogWin\Async_MessageBox.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.0892429116254965
Encrypted:	false
SSDEEP:	384:uLlqpqiKCsiRZKaRfAUNqVI48DagJqtN61fDku8fqcy+LTHZMGLL4:4kU98KINZ5ktMGQ
MD5:	701953731FD51B8109D61939BA8BFAEE
SHA1:	21184C8A12D785B431D870EA2A2776720BCEE894
SHA-256:	4DDF72843EEE74B0E29BFFEDB9C40B721655C1328B82F79F5FDF21D95FC8DA92
SHA-512:	DE51C91E7FC8A92B69B9E3362822B55A4A577FE71902B63DA7CF35732B55971A266BADA81611AAE9781B35658352BDDF73C1DFA6206F02E51278E84267F0769F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......N...........!.....:..........nY... ...`....@.. ....................................@..................................Y..S....................................`............................................... ............... ..H............text...t9... ...:.................. ..`.sdata.......`.......>..............@....rsrc................@..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\CH341PT.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6712
Entropy (8bit):	3.943977525490966
Encrypted:	false
SSDEEP:	96:UeIX+tip7uemP4I3bYFE6H6IyYrL9Cu6d0CGeSG4qb6Yiigx9BGWsy:Uegda4Irx6HhGLbqig7Lsy
MD5:	69B6FEC924C30042D329AE56CA8925CC
SHA1:	54E8D7D9004C8C819FE2E8BF7A1306BCBDD5ECBF
SHA-256:	45494CE819C1B5C21ABB72DC47A0CA36807E0ED74CE55B631DA174C77A9B24DB
SHA-512:	A6BC866712C2B6D2EC115341DE6EC5B352505FFF159AF967B03D27AD767164271F147780639E836A4DA54F4B2B688591EDF1374802CB5F7340062AEE9B341ABC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MDE_File_Sample_d5b2b4b33f236c2b9269c28086ff1805fbe9e699.zip, Detection: malicious, Browse Filename: Logpro-setup-english-64bit.exe, Detection: malicious, Browse Filename: stc-isp-15xx-v6.85.exe, Detection: malicious, Browse Filename: stc-isp-15xx-v6.85.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................l.......^...............Rich............PE..L...c..B ..........!......................... ....@..........................P..................................................<....0..8....................@..D...@...T...............................................4............................text............................... ..`.data...`.... ......................@....rsrc...8....0......................@..@.reloc..p....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\WindowsInstaller-KB893803-v2-x86.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2585872
Entropy (8bit):	7.976224453143546
Encrypted:	false
SSDEEP:	49152:nKiC/rk62xWNol+5gOsLO66qJ6021cJjLtk4pWGNG5VGFPNqJyoTL:orZ23AbsK6Ro022JjL2WEiVqJZL
MD5:	342F79337765760AD4E392EB67D5ED2C
SHA1:	8318455B36BA0A748307459279D46F2F4CDB5A0E
SHA-256:	69B61B2C00323CEA3686315617D0F452E205DAE10C47E02CBE1EA96FEA38F582
SHA-512:	70F32D415C70A97EECF0280EE9E6B10DB8F367EECFEDD92FCA6155A7DB19A776D2A96D5FCDBDE847036F4D7CF2E69B1D6DF6C073025582097F28C71F607B7E12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: 7Y18r(197).exe, Detection: malicious, Browse Filename: 7Y18r(230).exe, Detection: malicious, Browse Filename: 7Y18r(245).exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: R1Ec55NKDw.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ................................(.......... .....................................0............Z'..............!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...0.........&.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\dotNetFx40_Client_x86_x64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	43000680
Entropy (8bit):	7.9998112497373
Encrypted:	true
SSDEEP:	786432:720rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR6Y:RrtP4TAHaTEbxmdApA8B
MD5:	1CF262F35322D6C9C7A27FCA513FC269
SHA1:	4CD67F609F89D617D2B206341B8C211E1B88B287
SHA-256:	DDB54D46135DC4DD36216EED713F3500B72FC89863A745C3382A0ED493E4B5DA
SHA-512:	663123CBC508C6BC483B7A2630A055C160C56A1C067F2A417A4E91C1BB55B8BE5B041A2A76216B594B1ADFA47345C8DA6F2C80E4A2B3FE0B32F380CF28EBB093
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}...,...}......}.......}...//..}.../...}.../...}.......}...}...}...,+..}...,/..}...,...}...,...}...,...}..Rich.}..........................PE..L......J.........."..........^...................@..........................@......^.....@...... ..................@.......D...........................p.......l....................................V..@............................................text.............................. ..`.data....7..........................@....boxld01............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\is-69FOL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2585872
Entropy (8bit):	7.976224453143546
Encrypted:	false
SSDEEP:	49152:nKiC/rk62xWNol+5gOsLO66qJ6021cJjLtk4pWGNG5VGFPNqJyoTL:orZ23AbsK6Ro022JjL2WEiVqJZL
MD5:	342F79337765760AD4E392EB67D5ED2C
SHA1:	8318455B36BA0A748307459279D46F2F4CDB5A0E
SHA-256:	69B61B2C00323CEA3686315617D0F452E205DAE10C47E02CBE1EA96FEA38F582
SHA-512:	70F32D415C70A97EECF0280EE9E6B10DB8F367EECFEDD92FCA6155A7DB19A776D2A96D5FCDBDE847036F4D7CF2E69B1D6DF6C073025582097F28C71F607B7E12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ................................(.......... .....................................0............Z'..............!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...0.........&.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\is-77COG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	43000680
Entropy (8bit):	7.9998112497373
Encrypted:	true
SSDEEP:	786432:720rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR6Y:RrtP4TAHaTEbxmdApA8B
MD5:	1CF262F35322D6C9C7A27FCA513FC269
SHA1:	4CD67F609F89D617D2B206341B8C211E1B88B287
SHA-256:	DDB54D46135DC4DD36216EED713F3500B72FC89863A745C3382A0ED493E4B5DA
SHA-512:	663123CBC508C6BC483B7A2630A055C160C56A1C067F2A417A4E91C1BB55B8BE5B041A2A76216B594B1ADFA47345C8DA6F2C80E4A2B3FE0B32F380CF28EBB093
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}...,...}......}.......}...//..}.../...}.../...}.......}...}...}...,+..}...,/..}...,...}...,...}...,...}..Rich.}..........................PE..L......J.........."..........^...................@..........................@......^.....@...... ..................@.......D...........................p.......l....................................V..@............................................text.............................. ..`.data....7..........................@....boxld01............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\is-R21KT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1227048
Entropy (8bit):	7.993254576962732
Encrypted:	true
SSDEEP:	24576:XQ+wJjp6usvOfswwEp1Uk7tGt2TpPjMOHdHWOy+8svvPJwx3:XQNJj8u8bwb1Uftq1AwcO2svmJ
MD5:	53F5CCBE5FE06C3B40CC9E34AC909DF7
SHA1:	53C18652AC2F8A51303DEB48A1B7ABBDB1DB427F
SHA-256:	196868B09D87AE04E4AB42B4A3E0ABBB160500E8FF13DEB38E2956EE854868B1
SHA-512:	E3F8A50CEC53E150FBE62DCAACE343336E2CC0D97CD52A2EAFE050BF5D02FD8EC6DAD2F913F84DC3D6CB3DBCB8074070E3C1FD29CCDB0A40F53158237E056AB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K...K...K......D...K.. ......_......J......J...RichK...........PE..L......B.................z..........rY... ........... ...............................*........... ..........................@...........................(............!............................................... ...............................text....x... ...z.................. ..`.data................~..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\is-V65L8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1226536
Entropy (8bit):	7.992175657124281
Encrypted:	true
SSDEEP:	24576:ZQjWh9d/1451XUyxsta4g7wPgcGegKFvNj2g6NlJlfj8PrUNtedt9sZ3lAO:ZQjWhCXj5edp2geTlfmQSmTd
MD5:	5E99312597336968D960C43DD4B5E4C0
SHA1:	FD2B4D2262C899365DEBB26F587CD8C3225C69A5
SHA-256:	5A9B611D7F376C784A831B0357CC702A75272B7C6356C920BCA6FB169A8281F9
SHA-512:	CE3A8193022372707DC8600E77F978550E488588FE99ED609C24D4392F051B3889E67ABB84792CE9A94A3B01443F9EB7895CACDE3F99F276593E571FE9387C83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K...K...K......D...K.. ......_......J......J...RichK...........PE..L......B.................z..........rY... ........... ........................................... ..........................@...........H...............(............!............................................... ...............................text....x... ...z.................. ..`.data................~..............@....rsrc...H...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\wic_x86_chs.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1226536
Entropy (8bit):	7.992175657124281
Encrypted:	true
SSDEEP:	24576:ZQjWh9d/1451XUyxsta4g7wPgcGegKFvNj2g6NlJlfj8PrUNtedt9sZ3lAO:ZQjWhCXj5edp2geTlfmQSmTd
MD5:	5E99312597336968D960C43DD4B5E4C0
SHA1:	FD2B4D2262C899365DEBB26F587CD8C3225C69A5
SHA-256:	5A9B611D7F376C784A831B0357CC702A75272B7C6356C920BCA6FB169A8281F9
SHA-512:	CE3A8193022372707DC8600E77F978550E488588FE99ED609C24D4392F051B3889E67ABB84792CE9A94A3B01443F9EB7895CACDE3F99F276593E571FE9387C83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K...K...K......D...K.. ......_......J......J...RichK...........PE..L......B.................z..........rY... ........... ........................................... ..........................@...........H...............(............!............................................... ...............................text....x... ...z.................. ..`.data................~..............@....rsrc...H...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Components\wic_x86_enu.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1227048
Entropy (8bit):	7.993254576962732
Encrypted:	true
SSDEEP:	24576:XQ+wJjp6usvOfswwEp1Uk7tGt2TpPjMOHdHWOy+8svvPJwx3:XQNJj8u8bwb1Uftq1AwcO2svmJ
MD5:	53F5CCBE5FE06C3B40CC9E34AC909DF7
SHA1:	53C18652AC2F8A51303DEB48A1B7ABBDB1DB427F
SHA-256:	196868B09D87AE04E4AB42B4A3E0ABBB160500E8FF13DEB38E2956EE854868B1
SHA-512:	E3F8A50CEC53E150FBE62DCAACE343336E2CC0D97CD52A2EAFE050BF5D02FD8EC6DAD2F913F84DC3D6CB3DBCB8074070E3C1FD29CCDB0A40F53158237E056AB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K...K...K......D...K.. ......_......J......J...RichK...........PE..L......B.................z..........rY... ........... ...............................*........... ..........................@...........................(............!............................................... ...............................text....x... ...z.................. ..`.data................~..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Crc32.NET.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.782247250134279
Encrypted:	false
SSDEEP:	96:5+tH6RbkMa27CvSVeGQGgKRLYm4vJDpLN/yZkO4rsaKRUAe3ipMnQSmXDT/2:5caRI27C8zRkth/DrXKRUAeIMQjzC
MD5:	CCE714483B5568F140C904C30A38BCE6
SHA1:	8C668F156D612B677BD4408F4578B8E6CB31104C
SHA-256:	9EAFBEC3431A3DDC072D870DD71F96D4FD421EFF27B3F855FB29DDE31463803A
SHA-512:	92A947245699D48F7AAEF4340519496CD18F4EA245E0D7D4913BF8E5294E026AA3D7CA47C84772917F9014BA94F086D1DD30078A808F08DE32866D32F6EC9FC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%Z...........!.................4... ...@....... ...............................s....@.................................X4..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........&..\|...................P ......................................x...,..9...p'..P...6A.....z...y......#.b......=.=.+>...i)....!.v..46.x.}..?....Ot5B..8...m.iO....b.}....L+].....H2NN.1......~Z..}.....(...... }....:.(......}......-.s....z..2...2...X..i1.r...ps....z....(....V.-.s....z.....i(........(...."..(......0..J.........X..i1.rq..pr...ps....z....(.......X........X..d....X...d....X...d.....i./.r...pr...ps....z....i.Y(....F....(.... .KgH.....i./.r...p

C:\ElitechLogWin\Crc32.NET.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13460
Entropy (8bit):	4.655725288707219
Encrypted:	false
SSDEEP:	96:GyicYjvhngezYjvhnr11JwPTmhU/ZQRIqVnYjvhngeYnYjvhnr1BKQp946+1Fh4y:GQ2vPz2v51LMJuRD2vPO2v51liYqp
MD5:	12C7B0C346B425AC37EB5C6D14389FAC
SHA1:	124E90890689CCD26AF25F0B3DE8C86DC96F421E
SHA-256:	F47DE51A346632D16DC9850FBC8FB1C2542A9C10A48E395C652395F7F058955F
SHA-512:	CADE6CDEB193531D2D7F4F119ABC2D6BCDC67661123FE455E4C0FAE6BB4DFEE88C80C62F2CF998441212971B1E9D51AD8E29B63F859BFAAB79053A0C90EB0529
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Crc32.NET</name>.. </assembly>.. <members>.. <member name="T:Force.Crc32.Crc32CAlgorithm">.. <summary>.. Implementation of CRC-32C (Castagnoli)... This class supports several convenient static methods returning the CRC as UInt32... </summary>.. </member>.. <member name="M:Force.Crc32.Crc32CAlgorithm.#ctor">.. <summary>.. Initializes a new instance of the <see cref="T:Force.Crc32.Crc32CAlgorithm"/> class. .. </summary>.. </member>.. <member name="M:Force.Crc32.Crc32CAlgorithm.#ctor(System.Boolean)">.. <summary>.. Initializes a new instance of the <see cref="T:Force.Crc32.Crc32CAlgorithm"/> class. .. </summary>.. <param name="isBigEndian">Should return bytes result as big endian or little endian</param>.. </member>.. <member name="M:Force.Crc32.Crc32CAlgor

C:\ElitechLogWin\DB\data.db3 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	7.975466747723019
Encrypted:	false
SSDEEP:	384:HK6dHBbSLdc/1n5XiwAXY3ijcI6YEZ1XlwGR3o+a2Y9GDFqUSFTlb:Hn25k4YyjI9nNDD/Ulb
MD5:	7AE1034C7C7E11AFBD7F2E61A0ACF043
SHA1:	3BBB17FE83D6E8A6D7BF9ECFABC0452099E73022
SHA-256:	367FCFB6BD0D084C88A3D5F4A7E2A34492FB097C744D1DA16E5D2D6B749F6D1F
SHA-512:	7A1AB7E8ADA6524D9B63D58A07354A1631E9C9BA420DE7CC3347AB8965EC7156E086DD70E83B857F811D030BAED7F7FC0B3C80B2C18B4583CA560048715304E5
Malicious:	false
Preview:	pc!.i..?O.\|..3....U...-...^G0/7..D..2...NC. .F.....]8Y.Us..N./..5....(.qJ..Q..!...Ob..U.wg....e.....c.....L.~{......Y....d..#;\........R.N...+.....S.pb...(o.T...x...C...v&..d{x..,..rT.e{.\|....%..w.b..U....i.\|~..g..fk&L..G..h.E..;.Qb{-.............&.....u...... t.....!)..2.4^..+F....w..i..=S.'..$o.+G.b......-{k.Fx.J..]..h.0.y^'hr......t?...@..j..=..F.v....\w.<.m.'.........Zk..&...!.oa.}r%h.....e.a.`u.....T3....[...CK..-&\|.....\.t........F.....j..27../q!H..!...c.]..P../...M.......~..n....@I.5Ji..sG/v.o.ORE...K9.g+8...........([.9 w.'G.x=.\`>-vv.fc..7C.+..y..:..^.=.\.I..}...`}....)s.k..5.t..R.m.P6H..r.0..a.8.'O....... .n.....f).[\|....[.#.C.4..[....R........e.[-.Rn....c.q/..E..(.a..b....0...k..F{T0...o&..`v..fU....\|...t...,O.M..".>.+..y.]....c2N....%..s...&<+.w.0.<.F....\|...^..sYG.......vQ..q....p6mF..~......z3...u0..,....w...Kv&k.9.Wo.g!...Q\.Sf....G...<......q!............bPL\|...,.9V.>)."pNqZ....^...A.A.~............~.A.xm..'l.....~1....

C:\ElitechLogWin\DB\is-8N0RS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	7.975466747723019
Encrypted:	false
SSDEEP:	384:HK6dHBbSLdc/1n5XiwAXY3ijcI6YEZ1XlwGR3o+a2Y9GDFqUSFTlb:Hn25k4YyjI9nNDD/Ulb
MD5:	7AE1034C7C7E11AFBD7F2E61A0ACF043
SHA1:	3BBB17FE83D6E8A6D7BF9ECFABC0452099E73022
SHA-256:	367FCFB6BD0D084C88A3D5F4A7E2A34492FB097C744D1DA16E5D2D6B749F6D1F
SHA-512:	7A1AB7E8ADA6524D9B63D58A07354A1631E9C9BA420DE7CC3347AB8965EC7156E086DD70E83B857F811D030BAED7F7FC0B3C80B2C18B4583CA560048715304E5
Malicious:	false
Preview:	pc!.i..?O.\|..3....U...-...^G0/7..D..2...NC. .F.....]8Y.Us..N./..5....(.qJ..Q..!...Ob..U.wg....e.....c.....L.~{......Y....d..#;\........R.N...+.....S.pb...(o.T...x...C...v&..d{x..,..rT.e{.\|....%..w.b..U....i.\|~..g..fk&L..G..h.E..;.Qb{-.............&.....u...... t.....!)..2.4^..+F....w..i..=S.'..$o.+G.b......-{k.Fx.J..]..h.0.y^'hr......t?...@..j..=..F.v....\w.<.m.'.........Zk..&...!.oa.}r%h.....e.a.`u.....T3....[...CK..-&\|.....\.t........F.....j..27../q!H..!...c.]..P../...M.......~..n....@I.5Ji..sG/v.o.ORE...K9.g+8...........([.9 w.'G.x=.\`>-vv.fc..7C.+..y..:..^.=.\.I..}...`}....)s.k..5.t..R.m.P6H..r.0..a.8.'O....... .n.....f).[\|....[.#.C.4..[....R........e.[-.Rn....c.q/..E..(.a..b....0...k..F{T0...o&..`v..fU....\|...t...,O.M..".>.+..y.]....c2N....%..s...&<+.w.0.<.F....\|...^..sYG.......vQ..q....p6mF..~......z3...u0..,....w...Kv&k.9.Wo.g!...Q\.Sf....G...<......q!............bPL\|...,.9V.>)."pNqZ....^...A.A.~............~.A.xm..'l.....~1....

C:\ElitechLogWin\DL.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2235904
Entropy (8bit):	6.630820579741516
Encrypted:	false
SSDEEP:	49152:Ifon77ZdDDCll2TQuKQ9nRLcOYxyUQxvs:0onzDDClITQuTnayUQx
MD5:	E5596A3451E809F94891BD0EFDD61535
SHA1:	5D03782915D63CC1EDFDE40DE6954DA84E162430
SHA-256:	1CA91FA639AA83E0198A581B5787147F8DCDA7053B726C3FC2640667BE855005
SHA-512:	E4AAAC1609B0BC322F7C831B5A9C329EE518998E42CEB0E35082FF2A9067A58CC121D6864F4A6EB0551E45FC1509A35E0DD5CB1BD0C7AD9F59A3C576587C1F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0e.........."...0...!..:........!.. ... "...@.. ........................"...........`.................................p.!.O.... "..6...................`".....8.!.............................................. ............... ..H............text...p.!.. ....!................. ..`.rsrc....6... "..8....!.............@..@.reloc.......`".......".............@..B..................!.....H....... ....................G...........................................0............ 4......(.....+...0.................o.....+..B.........o........0..1.........o....r...p $...........%...%....o ...t.....+.......o!....".(".......0...........r!..p"...A.~#...($...}.....r!..p"...A....s%...($...}.....~....r-..p.(&...}.....~8...rC..p('...-.~8...rI..p('...+..}.....((.......}......{...."...@s)...}......}......}.......}......{...."...As)...}......{...."...A... ....s%...s*...}

C:\ElitechLogWin\DL.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	5.010777093927904
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOodBQV7VKXRAmIRMNHjFHr0lUfEyhTRyAEDDQIMOov:TMVBd1InV7VQ7VJdfEyFRyAqDQIm
MD5:	DDC25AEFCAE9826CCE1754C2C89E959D
SHA1:	36899490B8B0CF36AE8A1477468F3884C0CC9664
SHA-256:	F8AD17C37D444521B3905CCBD75EA6CB6E3D2763B16EB56B2E1AA4274173E614
SHA-512:	4C52E02E4E6A17FD36714E3769D34BC14675D47BE0322B14F4BBB13268C34DFE647A37DB7DF0DE7D8C31494BF878B597EDF85913E7FB648CB0D993E89FB5D611
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/></startup></configuration>..

C:\ElitechLogWin\DL.pdb (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MSVC program database ver 7.00, 512*5383 bytes
Category:	dropped
Size (bytes):	2756096
Entropy (8bit):	4.373355261566474
Encrypted:	false
SSDEEP:	24576:Lnr28BKtz9BiVUqpC0CWcYIAGL1L3Q9BaHMC5Gqae3/Mqu:7r28E7+78JQBdCcUMq
MD5:	F7D5FD526094E5E057D08E04C4669E0F
SHA1:	4A75DBE341AD6E26FCA970C2785F0DE19C74266D
SHA-256:	FE92956CC26FB550A23B2E49F2F12B0583F05C436263475ED75BAE98135C19BD
SHA-512:	4D4F51B8767A0AFF5A305BC2E556857BFD10F9C1FF7C28E30A1CA9B18EE74961F428AADD865621F3D3CB37F31AB19DC149F26DBADE561010E8D0006C4A24786E
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS................_..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341M64.SYS (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	62576
Entropy (8bit):	6.482406506352419
Encrypted:	false
SSDEEP:	768:8u+RrJ1H8cYLrz0jrrL3OA30WalWfYfcZJp5MWQguZlzByA/aSntQt/nkn2Oz1:4RHH8eP3SNkMWQg4sSntuk2Oz1
MD5:	E5A1301CAAD71AEFCE286C84ACC8EB72
SHA1:	671CC9669198654A949832ACD117301AA65512DC
SHA-256:	78FC39F1BB32427C8C1EB2B7F5DA89FF62FBDCECCB337367AA3EE4D1A0AABA1B
SHA-512:	DD7A697131469422EA2209B1B1EC9C130E5381379CBDBC2D4185B10930721ED0D05C887A632844A8A0BAFA9D257979997FBC89F63A457D52BF5DCB7403E8A7F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E...E..E.......E.......E.......E..@0...E..@09..E..@0...E..Rich.E..........................PE..d......b..........".................`..........@............................. .......C....`A......... ..........................................d.......`...............p*......,.......8...............................................0............................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ..b.rsrc...`...........................@..B.reloc..,...........................@..B................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341PORTS.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51152
Entropy (8bit):	5.938588015283653
Encrypted:	false
SSDEEP:	768:MhDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uawn2NfblW:MhDzxPzSE2ROxOGLoCBmdM2pbg
MD5:	B5F30DC6CE60AF0A63E93776166BAD49
SHA1:	DD09AF7FA92B6BB98D8366A138346ADB2E3BF3F0
SHA-256:	01476A326F76B97E23281504976C62962DED144244F88DDD523F36E2B46BD2A4
SHA-512:	1CC527FA5AEB68F0EB94A308D0B54645F614E436C92E233021BC48F9F80321D88FEB66449D4862C74FCB35612C3C216D5C0C5151C3BC750F0FC138A820E18EF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................1...............................m.......b..........X/...............!......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341PORTSA64.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63456
Entropy (8bit):	5.902358514390422
Encrypted:	false
SSDEEP:	1536:EYmxglnEJPVW49IW5tYIEateb2KnNaz9Q:EhInEJVW49PthEateDNa+
MD5:	CC0EF8DCDF5059AF265C5EDE222AF9AD
SHA1:	E86B4ACC154F9589793CC63107739FEE5A809642
SHA-256:	198C1D2F62A7BB72809AB0782F1871A98FE1802A26FC4BFA2CC506C7EB7483D0
SHA-512:	A93DFD4400188A72DEE5215CDBEBA779A1A9B0FCF36D5F59EEEACB97359F64C2615C67591E81C7B7427C7E5E0B5B47BD0833D39F1795EFC3579ABCD7E732AF41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................wY..............................................0..................../...............%......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341PT.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38360
Entropy (8bit):	6.8000698483616215
Encrypted:	false
SSDEEP:	768:TMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvS3n2Fknos29zy6S:oE/UexFtnZ6328lCzw
MD5:	6B4516DE4DF2532745ED7F648894CBDD
SHA1:	9433FDAEA5D2D8A1369B1A00A86E658CD5DB72F8
SHA-256:	47841B0568E535600D4C32B5457A3F25C0576ED391E742C838F8518DD9FF825F
SHA-512:	7566F03ADF60A4BFBD92D042AB608ACF5F5A69F8E387F67D3E8D45AF8E5749B8C43BF2681E04DD94C8895B54AD08F058961DFE1DDC13FE3B045E4ADCB46E542A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@..................................................................h......@c..x....................p...%...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341PTA64.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55776
Entropy (8bit):	6.412176795250395
Encrypted:	false
SSDEEP:	768:GJb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jftn2R9sFxLVNe9zqU:cfOJbqbKdmv04Tft2knNazb
MD5:	8E0A20A00E86C2ADE0AC4A66E63478DF
SHA1:	5CE68ADCEBC234F2C13B07DB3FBF2894C06B918F
SHA-256:	7B3C3C4A12DD7FAF835DD942F3CFD7047BEED2A377E83C7AB184D43CADAA7FCF
SHA-512:	CEB2E7AA4D502FF6A06B56AD523A7CD095E256959ECC65AC1D5B130C86A55E92EDAA52EA0AD2A9FF51131ADAD5F52B35CBB8168B8C4910FBCE3A58394343B3B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T........%..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341S64.SYS (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73696
Entropy (8bit):	6.279854770362321
Encrypted:	false
SSDEEP:	1536:++D98L1mOgrk9w1qw6zZ8vjWxFzImYotS21nNazR:VR4mOyJ1tjat3JNaV
MD5:	9897EBE2BCB268DAF3F218830F08C00C
SHA1:	3FC75B7CCE086F2AAA1E1DB3328C84928E7813C5
SHA-256:	23EFEA63BF8AE8604B1ACF9CC7D3AE7A04B2E5C1B57D38F238DF6CEBF9B25A22
SHA-512:	E2190E9B69109CC556C5E923DCDA1DED15FE9F441DF854D5217EF46C49C7D937708539257FFBB674AB9A64721305F6211AFC8987ADEF1D15CA8F438CE6EB6A1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P......5.......................................................L#..P....0..`................%...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\CH341S98.SYS (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	48352
Entropy (8bit):	7.177989102533331
Encrypted:	false
SSDEEP:	768:XiesSVTZm2ULz4A27wRNv6n2wxLVNe9zmb35j05sN9zDP:XNDmYwRw2wnNazmbpQyvzDP
MD5:	320A69989BED2CF2A5BD1CE1D9691D17
SHA1:	B960C43F322081BE78A31202518D8F6789A12CFA
SHA-256:	D042A487BFF57145DFB4555137A87300BC05A8A2C4E3327FEEC88A215CF0B684
SHA-512:	8EAFE14AD4ECC410F9A13CCC55DC1293294639CEAC5E6D7B2F140C75BE5BCC3D2A4DA08E2F9AF54FAD4D5594299DC65F42A4053A154BA2C33CA3C7135FCA10F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I.......b...............................<..U...X>..<....C..`............L...p..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\ElitechLogWin\Drivers\CH341\CH341SER.CAT (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	15341
Entropy (8bit):	6.825737418235991
Encrypted:	false
SSDEEP:	192:p0I/noKl2wBOCABvJypwzE2yFIFIOcfvyyKwnsFWQFlLW8yDvWrkAmSGL16X01k2:GBJ6rnsFRfcLMB+6R9zQEAo8
MD5:	51ACA92EC1DEDEEE698219B3E40E2A13
SHA1:	B09B544860C6D54E5DBAD44699D439BF10B594F0
SHA-256:	BD28DA9261E0A625DDF41769156304FCC33305F381291CCECAD8A5FBB79112BA
SHA-512:	1096E5D7BD215FDADC38C8C4FF36B77B0E9B2A69820F477FBE4680E4EF69FD4CF95BE89B5A22FC01799486B52EE679A78AB7202CFB3A0F64A5ACFD7CB5A2865E
Malicious:	false
Preview:	0.;....H........;.0.;....1.0...`.H.e......0..y..+.....7.....j0..f0...+.....7......b.....G...\L..X..220302060135Z0...+.....7.....0...0....R2.6.2.A.9.9.6.5.E.1.1.B.C.5.8.9.7.6.0.6.C.1.7.E.E.2.0.1.F.2.F.0.A.2.8.5.0.A.6.F...1..c0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0M..+.....7...1?0=0...+.....7...0...........0!0...+........&.e...v..~.....o0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....R2.6.9.6.4.D.4.9.9.D.7.A.5.E.0.8.6.4.6.3.F.1.B.6.3.9.C.A.5.B.1.A.D.B.A.1.4.7.E.1...1..]0@..+.....7...1200...F.i.l.e........c.h.3.4.1.p.o.r.t.s...d.l.l...0M..+.....7...1?0=0...+.....7...0...........0!0...+........&.MI.z^.dc.9.[..G.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6

C:\ElitechLogWin\Drivers\CH341\CH341SER.INF (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\ElitechLogWin\Drivers\CH341\CH341SER.SYS (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53208
Entropy (8bit):	6.647737869130866
Encrypted:	false
SSDEEP:	1536:+XcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+On2Vz0:bMopaEcbehr9sPFTbTqHc+OaY
MD5:	45BE868B78773A1941B45D889EBDFAFE
SHA1:	0B36DD64B76D264DFAB15C3C2E014B5262B1E245
SHA-256:	2F8E8F74675C6149E92080118940F05833CC82784516D733A6491682D7E6D547
SHA-512:	AAEB0C9AFBAD98139358BBD0C3945C9058B6482FE64F759581CB05FDCD2601773E3FEB858741A366034172CE9C43D086560BC3B02DD31AF4A104FB424E564E46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8................%......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\ElitechLogWin\Drivers\CH341\CH341SER.VXD (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51328
Entropy (8bit):	6.347303165966868
Encrypted:	false
SSDEEP:	768:uJoRoOIs1/DWyaDtViqQ8z0qiJ1s79XZBP9/oYAhs:ooR9pB0JQFqij0ZBV/h
MD5:	39F706639A8E235BFDFE9735E178E6A0
SHA1:	31EF237FA08E53753CB0934BDD36537F78CD1EE6
SHA-256:	707620E8C5C0E31F83A705B9DAB5C30BD3F1DFD8F6E5698D6EFD643EA5DAFFF8
SHA-512:	6A54CD71E04B42CBF8D30E6353188DF7E301D1B479A2A3A3BA710ED2A870A2A2BF590904A0A1DFF86162AD205A77F433F7C5600FE415F5E6AF6C1EFACB0495AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)M..G...G...G...F...G..w<...G..w:...G..w*...G..w)...G.......G..w?...G.Rich..G.................PE..d....]ea..........#.................0........................................P....................... ...................................... ...d....0....... ..T........"..............................................................`............................text.............................. ..`.data...0r..........................@....pdata..T.... ......................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\is-DA5P5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51328
Entropy (8bit):	6.347303165966868
Encrypted:	false
SSDEEP:	768:uJoRoOIs1/DWyaDtViqQ8z0qiJ1s79XZBP9/oYAhs:ooR9pB0JQFqij0ZBV/h
MD5:	39F706639A8E235BFDFE9735E178E6A0
SHA1:	31EF237FA08E53753CB0934BDD36537F78CD1EE6
SHA-256:	707620E8C5C0E31F83A705B9DAB5C30BD3F1DFD8F6E5698D6EFD643EA5DAFFF8
SHA-512:	6A54CD71E04B42CBF8D30E6353188DF7E301D1B479A2A3A3BA710ED2A870A2A2BF590904A0A1DFF86162AD205A77F433F7C5600FE415F5E6AF6C1EFACB0495AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)M..G...G...G...F...G..w<...G..w:...G..w*...G..w)...G.......G..w?...G.Rich..G.................PE..d....]ea..........#.................0........................................P....................... ...................................... ...d....0....... ..T........"..............................................................`............................text.............................. ..`.data...0r..........................@....pdata..T.... ......................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\SETUP.EXE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90752
Entropy (8bit):	6.112219167540205
Encrypted:	false
SSDEEP:	1536:RVR+A17IPX4JkI+hA+WaTy2ayXGiK0BnDidvoGD3bZ:DwAaKGh3aDoBnG9oGDrZ
MD5:	3A5073FC9D6E4A7102A97E8A971AE6DE
SHA1:	1D0BC75A657AA4222687ED95309BFE9B69DBACF8
SHA-256:	2F6C540841884BE0F61C9A63A83D4CE68F2648E0EDD46AF78B0F49F88C45F7F2
SHA-512:	45BCE2080E6838ADCBD94D66FE9916E265458E68504CB388299720E315A1F0146BD2DD7140A21298DA8D2A686DABB2A5FC23E4F2C1C2FE7E5A0F103AE4328C41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............O..O..O).O..Or.O..O..O..O..O..O..O}.O..O..OI.O..ORich..O........................PE..L....]ea.....................p.......Z............@.................................(...........................................d.......p............@..."...........................................................................................text...(........................... ..`.rdata........... ..................@..@.data...l........0..................@....rsrc...p........ ... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341M64.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	63200
Entropy (8bit):	6.508165481254481
Encrypted:	false
SSDEEP:	768:iu+RrJ1H8cYLrz0jrrL3OA30WalWfYfcZJp5MWQguZlzByA/aSntkt/nAb33Tt:6RHH8eP3SNkMWQg4sSntiAbnTt
MD5:	C191BB945F8EBE1D9DE6903B8D563FF8
SHA1:	57331B54428B0FC9922799C5E6B24A7DC2AC7902
SHA-256:	E707FD72BD2E72AB8217FDACB97ED7F5160ED6A4454AB579D657E2DE6B907849
SHA-512:	66E459AFEAF1C14742D437EAA0B2FF16CC1D129383F6FFD9E4A97F998DBFB5B30EDBF9AA3F02D23F1B666E97775D5D98AA03805CC78ECB14298AB4BC9A64E6A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E...E..E.......E.......E.......E..@0...E..@09..E..@0...E..Rich.E..........................PE..d......b..........".................`..........@............................. ......?[....`A......... ..........................................d.......`................,......,.......8...............................................0............................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ..b.rsrc...`...........................@..B.reloc..,...........................@..B................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTS.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PORTSA64.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64104
Entropy (8bit):	5.932012342855659
Encrypted:	false
SSDEEP:	768:mUzmxxqC8o2bshUK5AiPZhVWu19IWMytrEIfB2pYoste87b3IdclQ9za0:mYmxglnEJPVW49IW5tYIEateobWzv
MD5:	296618273185A983BD5B9E469AF2D972
SHA1:	95989164BE63DFD95C829788400BC32CB84AD65A
SHA-256:	4DD21860B264A5C4B4040F19F6EE41B886704EF44DA88BCADC5EC7060EBF9126
SHA-512:	BF6BCA479BB5018D417CCAAB20D881DEFBB154ADDB9CE073623FD4E9048F380A73DB50967D871677023A74D2FFDED3C0B2686F7972C55E25297A987FB1820380
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................................................................0..................../..............h(......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PT.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341PTA64.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56424
Entropy (8bit):	6.439469401329907
Encrypted:	false
SSDEEP:	768:6Jb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jfnb3IMoDlQ9za5G:AfOJbqbKdmv04Tfnb77z7
MD5:	7C40C2737E1A567B4E1FC62952BC90CE
SHA1:	18BDDB57C4B2F818DBCA82E6BFD0E7547D6836F5
SHA-256:	1687B96846734B1E44F4581F90C0144962189847E78EF9151F025FE39DE1D53B
SHA-512:	E0C820F0F3EBEB4CD787DC68844A95E5BC187D6542C7DA9FCF6636B065443EEECA4C1C541D549EAC57500629B0D021596C555EFDA86AC586272F8316D7EA9FE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T.......h(..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S64.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.300532218398393
Encrypted:	false
SSDEEP:	1536:L+D98L1mOgrk9w1qw6zZ8vjWxFzImYotsb8lCzD:CR4mOyJ1tjat3smCf
MD5:	BB4221657D3170F409F058690FD8DA0B
SHA1:	FCFECF503BAB0801C7BFDD417A6AB4E0758D8177
SHA-256:	FA525D2F23BCD50F4DA42B6C38A0D87E93FEAFF672A44083473CE19EC633B483
SHA-512:	771D5591F87A62E2D0E2E126F863A4E537CE7E4D7B347E6B29B21446923AEBE7F15C41E5FA253600A3CBD50A3FFC44D21AB91D7D2F16F37B4E8258B5287DE527
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P.......V......................................................L#..P....0..`...............H(...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341S98.SYS (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	49000
Entropy (8bit):	7.195874710869751
Encrypted:	false
SSDEEP:	768:DiesSVTZm2ULz4A27wTDvJb35j05sN9zDkb38ZPZ9z/1e:DNDmYwTtbpQyvzDkbsz/A
MD5:	37F0CACF04978F4F3166ED1510A98DB7
SHA1:	B62B0BBA39ABFE493D462BD409F2D31B4A2A4A39
SHA-256:	05EA22E94C933A16B283467BDD7AF2C9F978E9C386BCA5FEC8EBE7255EA6B7FB
SHA-512:	41D5DF8A26856C02F6333D364819F32E7EB9529DE71FE1ADEE8A1FDFB44E1632C66403CD2ADF00B50A51A7C149A9D4B6E36794EB789F4E41033062B10C7CE655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I......}t...............................<..U...X>..<....C..`............L...r..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.CAT (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	16315
Entropy (8bit):	7.0158931388032935
Encrypted:	false
SSDEEP:	192:/yv54p+ddKXaNaA4Og/PBJllnEX8hyFIFIOcDF1agjEwOXP6hYCEJpq21eX01k9E:QrBwEsP6/k6h3Ypl8R9z/Cx
MD5:	09D2102BACD78C7C0A53F63E1CE3DB07
SHA1:	2F66B041A4FCA2ADFDF89F88A1DE156CD330B67F
SHA-256:	20D39AF89440A1C85016FB064CA49A40D92C874546CB4A0551023DCB64B85D51
SHA-512:	B0DD37814FB96378A8BF07B34A57D6501DA54FD2E6A52D19F86AE88C6014C9F8C18491BFA6140ED552D50B0DF54328B92E465FBC76738B48616C379DF6BDCB74
Malicious:	false
Preview:	0.?....H........?.0.?....1.0...`.H.e......0.....+.....7......0...0...+.....7.......&m@.T.i.....220302065955Z0...+.....7.....0...0.... .%p-T...v.iH...2R..d.?....U.k.G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .%p-T...v.iH...2R..d.?....U.k.G.0.... .." ...t^.h.iJ..k..............1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........c.h.3.4.1.s.9.8...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .." ...t^.h.iJ..k..............0....&.e...v..~.....o1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0....&.MI.z^.dc.9.[..G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........c.h.3.4.1

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.VXD (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-3KCTN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	49000
Entropy (8bit):	7.195874710869751
Encrypted:	false
SSDEEP:	768:DiesSVTZm2ULz4A27wTDvJb35j05sN9zDkb38ZPZ9z/1e:DNDmYwTtbpQyvzDkbsz/A
MD5:	37F0CACF04978F4F3166ED1510A98DB7
SHA1:	B62B0BBA39ABFE493D462BD409F2D31B4A2A4A39
SHA-256:	05EA22E94C933A16B283467BDD7AF2C9F978E9C386BCA5FEC8EBE7255EA6B7FB
SHA-512:	41D5DF8A26856C02F6333D364819F32E7EB9529DE71FE1ADEE8A1FDFB44E1632C66403CD2ADF00B50A51A7C149A9D4B6E36794EB789F4E41033062B10C7CE655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I......}t...............................<..U...X>..<....C..`............L...r..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-4V221.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	63200
Entropy (8bit):	6.508165481254481
Encrypted:	false
SSDEEP:	768:iu+RrJ1H8cYLrz0jrrL3OA30WalWfYfcZJp5MWQguZlzByA/aSntkt/nAb33Tt:6RHH8eP3SNkMWQg4sSntiAbnTt
MD5:	C191BB945F8EBE1D9DE6903B8D563FF8
SHA1:	57331B54428B0FC9922799C5E6B24A7DC2AC7902
SHA-256:	E707FD72BD2E72AB8217FDACB97ED7F5160ED6A4454AB579D657E2DE6B907849
SHA-512:	66E459AFEAF1C14742D437EAA0B2FF16CC1D129383F6FFD9E4A97F998DBFB5B30EDBF9AA3F02D23F1B666E97775D5D98AA03805CC78ECB14298AB4BC9A64E6A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E...E..E.......E.......E.......E..@0...E..@09..E..@0...E..Rich.E..........................PE..d......b..........".................`..........@............................. ......?[....`A......... ..........................................d.......`................,......,.......8...............................................0............................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ..b.rsrc...`...........................@..B.reloc..,...........................@..B................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-6HU8U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-7O4QT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-G2AIM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-I08DP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56424
Entropy (8bit):	6.439469401329907
Encrypted:	false
SSDEEP:	768:6Jb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jfnb3IMoDlQ9za5G:AfOJbqbKdmv04Tfnb77z7
MD5:	7C40C2737E1A567B4E1FC62952BC90CE
SHA1:	18BDDB57C4B2F818DBCA82E6BFD0E7547D6836F5
SHA-256:	1687B96846734B1E44F4581F90C0144962189847E78EF9151F025FE39DE1D53B
SHA-512:	E0C820F0F3EBEB4CD787DC68844A95E5BC187D6542C7DA9FCF6636B065443EEECA4C1C541D549EAC57500629B0D021596C555EFDA86AC586272F8316D7EA9FE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T.......h(..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-J4G7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-TKQEB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-UM7HD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.300532218398393
Encrypted:	false
SSDEEP:	1536:L+D98L1mOgrk9w1qw6zZ8vjWxFzImYotsb8lCzD:CR4mOyJ1tjat3smCf
MD5:	BB4221657D3170F409F058690FD8DA0B
SHA1:	FCFECF503BAB0801C7BFDD417A6AB4E0758D8177
SHA-256:	FA525D2F23BCD50F4DA42B6C38A0D87E93FEAFF672A44083473CE19EC633B483
SHA-512:	771D5591F87A62E2D0E2E126F863A4E537CE7E4D7B347E6B29B21446923AEBE7F15C41E5FA253600A3CBD50A3FFC44D21AB91D7D2F16F37B4E8258B5287DE527
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P.......V......................................................L#..P....0..`...............H(...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-VI31J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64104
Entropy (8bit):	5.932012342855659
Encrypted:	false
SSDEEP:	768:mUzmxxqC8o2bshUK5AiPZhVWu19IWMytrEIfB2pYoste87b3IdclQ9za0:mYmxglnEJPVW49IW5tYIEateobWzv
MD5:	296618273185A983BD5B9E469AF2D972
SHA1:	95989164BE63DFD95C829788400BC32CB84AD65A
SHA-256:	4DD21860B264A5C4B4040F19F6EE41B886704EF44DA88BCADC5EC7060EBF9126
SHA-512:	BF6BCA479BB5018D417CCAAB20D881DEFBB154ADDB9CE073623FD4E9048F380A73DB50967D871677023A74D2FFDED3C0B2686F7972C55E25297A987FB1820380
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................................................................0..................../..............h(......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\WIN 1X\is-VV0UG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	16315
Entropy (8bit):	7.0158931388032935
Encrypted:	false
SSDEEP:	192:/yv54p+ddKXaNaA4Og/PBJllnEX8hyFIFIOcDF1agjEwOXP6hYCEJpq21eX01k9E:QrBwEsP6/k6h3Ypl8R9z/Cx
MD5:	09D2102BACD78C7C0A53F63E1CE3DB07
SHA1:	2F66B041A4FCA2ADFDF89F88A1DE156CD330B67F
SHA-256:	20D39AF89440A1C85016FB064CA49A40D92C874546CB4A0551023DCB64B85D51
SHA-512:	B0DD37814FB96378A8BF07B34A57D6501DA54FD2E6A52D19F86AE88C6014C9F8C18491BFA6140ED552D50B0DF54328B92E465FBC76738B48616C379DF6BDCB74
Malicious:	false
Preview:	0.?....H........?.0.?....1.0...`.H.e......0.....+.....7......0...0...+.....7.......&m@.T.i.....220302065955Z0...+.....7.....0...0.... .%p-T...v.iH...2R..d.?....U.k.G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .%p-T...v.iH...2R..d.?....U.k.G.0.... .." ...t^.h.iJ..k..............1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........c.h.3.4.1.s.9.8...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .." ...t^.h.iJ..k..............0....&.e...v..~.....o1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0....&.MI.z^.dc.9.[..G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........c.h.3.4.1

C:\ElitechLogWin\Drivers\CH341\is-19MS8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90752
Entropy (8bit):	6.112219167540205
Encrypted:	false
SSDEEP:	1536:RVR+A17IPX4JkI+hA+WaTy2ayXGiK0BnDidvoGD3bZ:DwAaKGh3aDoBnG9oGDrZ
MD5:	3A5073FC9D6E4A7102A97E8A971AE6DE
SHA1:	1D0BC75A657AA4222687ED95309BFE9B69DBACF8
SHA-256:	2F6C540841884BE0F61C9A63A83D4CE68F2648E0EDD46AF78B0F49F88C45F7F2
SHA-512:	45BCE2080E6838ADCBD94D66FE9916E265458E68504CB388299720E315A1F0146BD2DD7140A21298DA8D2A686DABB2A5FC23E4F2C1C2FE7E5A0F103AE4328C41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............O..O..O).O..Or.O..O..O..O..O..O..O}.O..O..OI.O..ORich..O........................PE..L....]ea.....................p.......Z............@.................................(...........................................d.......p............@..."...........................................................................................text...(........................... ..`.rdata........... ..................@..@.data...l........0..................@....rsrc...p........ ... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-23GIR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38360
Entropy (8bit):	6.8000698483616215
Encrypted:	false
SSDEEP:	768:TMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvS3n2Fknos29zy6S:oE/UexFtnZ6328lCzw
MD5:	6B4516DE4DF2532745ED7F648894CBDD
SHA1:	9433FDAEA5D2D8A1369B1A00A86E658CD5DB72F8
SHA-256:	47841B0568E535600D4C32B5457A3F25C0576ED391E742C838F8518DD9FF825F
SHA-512:	7566F03ADF60A4BFBD92D042AB608ACF5F5A69F8E387F67D3E8D45AF8E5749B8C43BF2681E04DD94C8895B54AD08F058961DFE1DDC13FE3B045E4ADCB46E542A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@..................................................................h......@c..x....................p...%...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-2GNAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73696
Entropy (8bit):	6.279854770362321
Encrypted:	false
SSDEEP:	1536:++D98L1mOgrk9w1qw6zZ8vjWxFzImYotS21nNazR:VR4mOyJ1tjat3JNaV
MD5:	9897EBE2BCB268DAF3F218830F08C00C
SHA1:	3FC75B7CCE086F2AAA1E1DB3328C84928E7813C5
SHA-256:	23EFEA63BF8AE8604B1ACF9CC7D3AE7A04B2E5C1B57D38F238DF6CEBF9B25A22
SHA-512:	E2190E9B69109CC556C5E923DCDA1DED15FE9F441DF854D5217EF46C49C7D937708539257FFBB674AB9A64721305F6211AFC8987ADEF1D15CA8F438CE6EB6A1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P......5.......................................................L#..P....0..`................%...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-3H8ON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\ElitechLogWin\Drivers\CH341\is-FE8JT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	15341
Entropy (8bit):	6.825737418235991
Encrypted:	false
SSDEEP:	192:p0I/noKl2wBOCABvJypwzE2yFIFIOcfvyyKwnsFWQFlLW8yDvWrkAmSGL16X01k2:GBJ6rnsFRfcLMB+6R9zQEAo8
MD5:	51ACA92EC1DEDEEE698219B3E40E2A13
SHA1:	B09B544860C6D54E5DBAD44699D439BF10B594F0
SHA-256:	BD28DA9261E0A625DDF41769156304FCC33305F381291CCECAD8A5FBB79112BA
SHA-512:	1096E5D7BD215FDADC38C8C4FF36B77B0E9B2A69820F477FBE4680E4EF69FD4CF95BE89B5A22FC01799486B52EE679A78AB7202CFB3A0F64A5ACFD7CB5A2865E
Malicious:	false
Preview:	0.;....H........;.0.;....1.0...`.H.e......0..y..+.....7.....j0..f0...+.....7......b.....G...\L..X..220302060135Z0...+.....7.....0...0....R2.6.2.A.9.9.6.5.E.1.1.B.C.5.8.9.7.6.0.6.C.1.7.E.E.2.0.1.F.2.F.0.A.2.8.5.0.A.6.F...1..c0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0M..+.....7...1?0=0...+.....7...0...........0!0...+........&.e...v..~.....o0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....R2.6.9.6.4.D.4.9.9.D.7.A.5.E.0.8.6.4.6.3.F.1.B.6.3.9.C.A.5.B.1.A.D.B.A.1.4.7.E.1...1..]0@..+.....7...1200...F.i.l.e........c.h.3.4.1.p.o.r.t.s...d.l.l...0M..+.....7...1?0=0...+.....7...0...........0!0...+........&.MI.z^.dc.9.[..G.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6

C:\ElitechLogWin\Drivers\CH341\is-J5RC5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55776
Entropy (8bit):	6.412176795250395
Encrypted:	false
SSDEEP:	768:GJb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jftn2R9sFxLVNe9zqU:cfOJbqbKdmv04Tft2knNazb
MD5:	8E0A20A00E86C2ADE0AC4A66E63478DF
SHA1:	5CE68ADCEBC234F2C13B07DB3FBF2894C06B918F
SHA-256:	7B3C3C4A12DD7FAF835DD942F3CFD7047BEED2A377E83C7AB184D43CADAA7FCF
SHA-512:	CEB2E7AA4D502FF6A06B56AD523A7CD095E256959ECC65AC1D5B130C86A55E92EDAA52EA0AD2A9FF51131ADAD5F52B35CBB8168B8C4910FBCE3A58394343B3B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T........%..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-NM5RC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	62576
Entropy (8bit):	6.482406506352419
Encrypted:	false
SSDEEP:	768:8u+RrJ1H8cYLrz0jrrL3OA30WalWfYfcZJp5MWQguZlzByA/aSntQt/nkn2Oz1:4RHH8eP3SNkMWQg4sSntuk2Oz1
MD5:	E5A1301CAAD71AEFCE286C84ACC8EB72
SHA1:	671CC9669198654A949832ACD117301AA65512DC
SHA-256:	78FC39F1BB32427C8C1EB2B7F5DA89FF62FBDCECCB337367AA3EE4D1A0AABA1B
SHA-512:	DD7A697131469422EA2209B1B1EC9C130E5381379CBDBC2D4185B10930721ED0D05C887A632844A8A0BAFA9D257979997FBC89F63A457D52BF5DCB7403E8A7F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E...E..E.......E.......E.......E..@0...E..@09..E..@0...E..Rich.E..........................PE..d......b..........".................`..........@............................. .......C....`A......... ..........................................d.......`...............p*......,.......8...............................................0............................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ..b.rsrc...`...........................@..B.reloc..,...........................@..B................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-QFG43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51152
Entropy (8bit):	5.938588015283653
Encrypted:	false
SSDEEP:	768:MhDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uawn2NfblW:MhDzxPzSE2ROxOGLoCBmdM2pbg
MD5:	B5F30DC6CE60AF0A63E93776166BAD49
SHA1:	DD09AF7FA92B6BB98D8366A138346ADB2E3BF3F0
SHA-256:	01476A326F76B97E23281504976C62962DED144244F88DDD523F36E2B46BD2A4
SHA-512:	1CC527FA5AEB68F0EB94A308D0B54645F614E436C92E233021BC48F9F80321D88FEB66449D4862C74FCB35612C3C216D5C0C5151C3BC750F0FC138A820E18EF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................1...............................m.......b..........X/...............!......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-RB961.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	48352
Entropy (8bit):	7.177989102533331
Encrypted:	false
SSDEEP:	768:XiesSVTZm2ULz4A27wRNv6n2wxLVNe9zmb35j05sN9zDP:XNDmYwRw2wnNazmbpQyvzDP
MD5:	320A69989BED2CF2A5BD1CE1D9691D17
SHA1:	B960C43F322081BE78A31202518D8F6789A12CFA
SHA-256:	D042A487BFF57145DFB4555137A87300BC05A8A2C4E3327FEEC88A215CF0B684
SHA-512:	8EAFE14AD4ECC410F9A13CCC55DC1293294639CEAC5E6D7B2F140C75BE5BCC3D2A4DA08E2F9AF54FAD4D5594299DC65F42A4053A154BA2C33CA3C7135FCA10F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I.......b...............................<..U...X>..<....C..`............L...p..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\ElitechLogWin\Drivers\CH341\is-RJR4R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63456
Entropy (8bit):	5.902358514390422
Encrypted:	false
SSDEEP:	1536:EYmxglnEJPVW49IW5tYIEateb2KnNaz9Q:EhInEJVW49PthEateDNa+
MD5:	CC0EF8DCDF5059AF265C5EDE222AF9AD
SHA1:	E86B4ACC154F9589793CC63107739FEE5A809642
SHA-256:	198C1D2F62A7BB72809AB0782F1871A98FE1802A26FC4BFA2CC506C7EB7483D0
SHA-512:	A93DFD4400188A72DEE5215CDBEBA779A1A9B0FCF36D5F59EEEACB97359F64C2615C67591E81C7B7427C7E5E0B5B47BD0833D39F1795EFC3579ABCD7E732AF41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................wY..............................................0..................../...............%......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CH341\is-S2COG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\ElitechLogWin\Drivers\CH341\is-U8CBL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53208
Entropy (8bit):	6.647737869130866
Encrypted:	false
SSDEEP:	1536:+XcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+On2Vz0:bMopaEcbehr9sPFTbTqHc+OaY
MD5:	45BE868B78773A1941B45D889EBDFAFE
SHA1:	0B36DD64B76D264DFAB15C3C2E014B5262B1E245
SHA-256:	2F8E8F74675C6149E92080118940F05833CC82784516D733A6491682D7E6D547
SHA-512:	AAEB0C9AFBAD98139358BBD0C3945C9058B6482FE64F759581CB05FDCD2601773E3FEB858741A366034172CE9C43D086560BC3B02DD31AF4A104FB424E564E46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8................%......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1050104
Entropy (8bit):	5.617498652730841
Encrypted:	false
SSDEEP:	12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
MD5:	BE3C79033FA8302002D9D3A6752F2263
SHA1:	A01147731F2E500282ECA5ECE149BCC5423B59D6
SHA-256:	181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
SHA-512:	77097F220CC6D22112B314D3E42B6EEDB9CCD72BEB655B34656326C2C63FB9209977DDAC20E9C53C4EC7CCC8EA6910F400F050F4B0CB98C9F42F89617965AAEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m.......%...........................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x86.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921992
Entropy (8bit):	5.698587665358091
Encrypted:	false
SSDEEP:	6144:EZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6r+LyIU:EZxSpwmxvL/f3vCN1PMaLi6rAyIQjF
MD5:	30A0AFEE4AEA59772DB6434F1C0511AB
SHA1:	5D5C2D9B7736E018D2B36963E834D1AA0E32AF09
SHA-256:	D84149976BC94A21B21AA0BC99FCBDEE9D1AD4F3387D8B62B90F805AC300BA05
SHA-512:	5E8A85E2D028AD351BE255AE2C39BB518A10A4A467FD656E2472286FEE504EED87AFE7D4A728D7F8BC4261245C1DB8577DEEEE2388F39EB7EE48298E37949F53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..o4..<4..<4..<=.`<"..<=.v<...<=.f<)..<4..<@..<=.q<o..<=.a<5..<=.d<5..<Rich4..<................PE..L......J................. ..........j........0...............................0......p.....@...... ..............................,....p..lY......................XC...................................=..@...............L............................text............ .................. ..`.data...`>...0.......$..............@....rsrc....`...p...Z...<..............@..@.reloc..._.......`..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\ReleaseNotes.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10262
Entropy (8bit):	4.9717241203870275
Encrypted:	false
SSDEEP:	192:cN/+mm8x5xRCjLctv0rg7SJbRzQEIB4HZpEdy:cN//mCDUnctv0fQEo4Hoy
MD5:	9DB4D7D4FB3970342F2EEB40E73C5633
SHA1:	5779CFF0BE054B289AD6982E79B816C8A60E87E4
SHA-256:	028615EB99DEF9C2209F968106AAA90C9AAF0416E1F0EF83EEF000DB4B69697E
SHA-512:	175B052E0D8268E64A7CCF2DE919A69BA3E18BF1F59ED4D3A2714096289AB68720842E28845E6A28A96A5D2258EBEF115C0E8FD17D9C111E023C09617FFF24E6
Malicious:	false
Preview:	CP210x Windows XP/Vista(32/64)/7(32/64)/8,8.1(32/64) Driver v6.7 Release Notes..Copyright (C) 2014 Silicon Laboratories, Inc.....This release contains the following components:....* x64 directory...* silabser.sys...* silabenm.sys..* x86 directory...* silabser.sys...* silabenm.sys..* CP210xVCPInstaller_x86.exe (DPInst)..* CP210xVCPInstaller_x64.exe (DPInst)..* dpinst.xml (DPInst initialization file)..* silabser.cat..* slabvcp.inf..* ReleaseNotes.txt (this file)......Driver Installation..-------------------.....See Kit User's Guide for installation instructions.......Release Dates..-------------.....CP210x USB to UART Bridge Driver v6.7 - April 11, 2013......Supported Operating Systems..---------------------------.....Windows 8/8.1 (64/32), 7 (64/32), Vista (64/32), and XP......CP210x Windows Driver Revision History..--------------------------------------....version 6.7 (Apr 11, 2014).....Corrections...-----------...Added vendor-specific commands to the driver that do not affect normal o

C:\ElitechLogWin\Drivers\CP210x\SLAB_License_Agreement_VCP_Windows.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with very long lines (935), with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	5.016627198267874
Encrypted:	false
SSDEEP:	192:FmJS4r31h8JzcNRHLtKW4j/RHLka0pXKmdEWD+KScQME3vBb3g:FCj8JzjH0pVdEWlQMsBg
MD5:	6278966B61720342CFFF6AAAFC433928
SHA1:	A35F767628E87829AD380200995737D5B09AAD32
SHA-256:	53039C416FAC39940E6082E99C979C8F5639C5461ADCF9D2A7E41A809CF32C8F
SHA-512:	704448C2C6F3ED22727A37E4FDA583427F11ED4F6545DC22C2FCC7713C96F47A5FD69922209297FA6DB0AC7AD7FA1819C88B862A79A4FF6C5892AC5B57941E18
Malicious:	false
Preview:	LICENSE AGREEMENT..SILICON LABS VCP DRIVER..IMPORTANT: READ CAREFULLY BEFORE AGREEING TO TERMS....THIS PRODUCT CONTAINS THE SILICON LABS VCP DRIVER AND INSTALLER PROGRAMS AND OTHER THIRD PARTY SOFTWARE.TOGETHER THESE PRODUCTS ARE REFERRED TO AS THE "LICENSED SOFTWARE". USE OF THE LICENSED SOFTWARE IS SUBJECT TO THE TERMS OF THIS LICENSE AGREEMENT. DOWNLOADING THE LICENSED SOFTWARE AND INDICATING YOUR CONSENT TO THE TERMS OF THIS LICENSE CONSTITUTES A BINDING AGREMENT BETWEEN SILICON LABORATORIES, INC. ("SILICON LABS") AND YOU OR YOUR EMPLOYER (IF APPLICABLE). IF YOU ARE ACCEPTING THE TERMS OF THIS AGREEMENT ON BEHALF YOUR EMPLOYER, THE TERMS "YOU" AND "YOUR" REFER TO YOUR EMPLOYER. WRITTEN APPROVAL IS NOT A PREREQUISITE TO THE VALIDITY OR ENFORCEABILITY OF THIS AGREEMENT. IF THESE TERMS ARE CONSIDERED AN OFFER BY SILICON LABS, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS...IF YOU DO NOT AGREE WITH ALL OF THE TERMS OF THIS LICENSE AGREEMENT, YOU MUST NOT USE THE LICENSED SOFTWARE

C:\ElitechLogWin\Drivers\CP210x\dpinst.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11568
Entropy (8bit):	5.0910544166941785
Encrypted:	false
SSDEEP:	192:x5b19sb19Ab19Fb19Kb19Pb19Mb19hb19yb19Ob19jb19Qb19Vb19fb19ab19Vby:x5x9sx9Ax9Fx9Kx9Px9Mx9hx9yx9Ox9y
MD5:	869039EA5BD8AC4D25FFE350E9DC617F
SHA1:	81E319AC3DF62B8E145F80800E13E04D2B9558EE
SHA-256:	BAF20FDE8E8283F6F21098AEED53D1D8B86C13A99E1816B594F8CE9D6FC83092
SHA-512:	6E12EAFE54BEF288D500220642FB5B0774CDD88DA841DCE9DB674137F0AE8F1BF00589F031A4C235BA0F24B8A3CA04B051AD17A905D4E4B5093BB5EB909C2DD7
Malicious:	false
Preview:	<?xml version="1.0" ?>..<dpinst>..<enableNotListedLanguages/>..<language code="0x0401">..<dpinstTitle>CP210x USB to UART Bridge Driver Installer</dpinstTitle>..<welcomeTitle>Welcome to the CP210x USB to UART Bridge Driver Installer</welcomeTitle>..<welcomeIntro>This wizard will help you install the drivers for your CP210x USB to UART Bridge device.</welcomeIntro>..<eula type="txt" path="SLAB_License_Agreement_VCP_Windows.txt"/>..<finishTitle>Completing the Installation of the CP210x USB to UART Bridge Driver</finishTitle>..</language>..<language code="0x0804">..<dpinstTitle>CP210x USB to UART Bridge Driver Installer</dpinstTitle>..<welcomeTitle>Welcome to the CP210x USB to UART Bridge Driver Installer</welcomeTitle>..<welcomeIntro>This wizard will help you install the drivers for your CP210x USB to UART Bridge device.</welcomeIntro>..<eula type="txt" path="SLAB_License_Agreement_VCP_Windows.txt"/>..<finishTitle>Completing the Installation of the CP210x USB to UART Bridge Driver</finish

C:\ElitechLogWin\Drivers\CP210x\is-4T4TN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	11333
Entropy (8bit):	6.787341487288969
Encrypted:	false
SSDEEP:	192:8beQEeyM/W84ewtxO2hECwkY8TE0rrr8RVcdh+3Ef5KYpBjSA6L24Y:8Kl8ilwk4C+3Ef5dpBjhR4Y
MD5:	BEFE6327722742CD1424B739BC8F5CFA
SHA1:	C3F899399BF59E9890C654670B15E364628DB4A9
SHA-256:	C135F73366AAC8FE95FE3285D05A3EFA76C0054DF677BAC3E308E7DC82A58BC0
SHA-512:	0E0158FF5C583714BABD8EA0FCDA4AB203A4EF747F57AE6BAD2A4C5C866B8F183D592495B9281E85CCFF589520942607BB7F412D641A25F3CD252F4DF63067B7
Malicious:	false
Preview:	0.,A..*.H........,20.,....1.0...+......0.....+.....7......0...0...+.....7.....%...$.L..L5.Af...140411202803Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0....R1.4.F.E.2.4.4.3.3.3.8.2.1.6.4.D.5.3.B.5.B.9.3.0.8.4.4.B.7.8.4.7.C.7.B.0.7.2.6.5...1..o0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........$C3..MS..0.KxG.re0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:

C:\ElitechLogWin\Drivers\CP210x\is-8TFHD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11568
Entropy (8bit):	5.0910544166941785
Encrypted:	false
SSDEEP:	192:x5b19sb19Ab19Fb19Kb19Pb19Mb19hb19yb19Ob19jb19Qb19Vb19fb19ab19Vby:x5x9sx9Ax9Fx9Kx9Px9Mx9hx9yx9Ox9y
MD5:	869039EA5BD8AC4D25FFE350E9DC617F
SHA1:	81E319AC3DF62B8E145F80800E13E04D2B9558EE
SHA-256:	BAF20FDE8E8283F6F21098AEED53D1D8B86C13A99E1816B594F8CE9D6FC83092
SHA-512:	6E12EAFE54BEF288D500220642FB5B0774CDD88DA841DCE9DB674137F0AE8F1BF00589F031A4C235BA0F24B8A3CA04B051AD17A905D4E4B5093BB5EB909C2DD7
Malicious:	false
Preview:	<?xml version="1.0" ?>..<dpinst>..<enableNotListedLanguages/>..<language code="0x0401">..<dpinstTitle>CP210x USB to UART Bridge Driver Installer</dpinstTitle>..<welcomeTitle>Welcome to the CP210x USB to UART Bridge Driver Installer</welcomeTitle>..<welcomeIntro>This wizard will help you install the drivers for your CP210x USB to UART Bridge device.</welcomeIntro>..<eula type="txt" path="SLAB_License_Agreement_VCP_Windows.txt"/>..<finishTitle>Completing the Installation of the CP210x USB to UART Bridge Driver</finishTitle>..</language>..<language code="0x0804">..<dpinstTitle>CP210x USB to UART Bridge Driver Installer</dpinstTitle>..<welcomeTitle>Welcome to the CP210x USB to UART Bridge Driver Installer</welcomeTitle>..<welcomeIntro>This wizard will help you install the drivers for your CP210x USB to UART Bridge device.</welcomeIntro>..<eula type="txt" path="SLAB_License_Agreement_VCP_Windows.txt"/>..<finishTitle>Completing the Installation of the CP210x USB to UART Bridge Driver</finish

C:\ElitechLogWin\Drivers\CP210x\is-C2G31.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921992
Entropy (8bit):	5.698587665358091
Encrypted:	false
SSDEEP:	6144:EZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6r+LyIU:EZxSpwmxvL/f3vCN1PMaLi6rAyIQjF
MD5:	30A0AFEE4AEA59772DB6434F1C0511AB
SHA1:	5D5C2D9B7736E018D2B36963E834D1AA0E32AF09
SHA-256:	D84149976BC94A21B21AA0BC99FCBDEE9D1AD4F3387D8B62B90F805AC300BA05
SHA-512:	5E8A85E2D028AD351BE255AE2C39BB518A10A4A467FD656E2472286FEE504EED87AFE7D4A728D7F8BC4261245C1DB8577DEEEE2388F39EB7EE48298E37949F53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..o4..<4..<4..<=.`<"..<=.v<...<=.f<)..<4..<@..<=.q<o..<=.a<5..<=.d<5..<Rich4..<................PE..L......J................. ..........j........0...............................0......p.....@...... ..............................,....p..lY......................XC...................................=..@...............L............................text............ .................. ..`.data...`>...0.......$..............@....rsrc....`...p...Z...<..............@..@.reloc..._.......`..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\is-HILAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10262
Entropy (8bit):	4.9717241203870275
Encrypted:	false
SSDEEP:	192:cN/+mm8x5xRCjLctv0rg7SJbRzQEIB4HZpEdy:cN//mCDUnctv0fQEo4Hoy
MD5:	9DB4D7D4FB3970342F2EEB40E73C5633
SHA1:	5779CFF0BE054B289AD6982E79B816C8A60E87E4
SHA-256:	028615EB99DEF9C2209F968106AAA90C9AAF0416E1F0EF83EEF000DB4B69697E
SHA-512:	175B052E0D8268E64A7CCF2DE919A69BA3E18BF1F59ED4D3A2714096289AB68720842E28845E6A28A96A5D2258EBEF115C0E8FD17D9C111E023C09617FFF24E6
Malicious:	false
Preview:	CP210x Windows XP/Vista(32/64)/7(32/64)/8,8.1(32/64) Driver v6.7 Release Notes..Copyright (C) 2014 Silicon Laboratories, Inc.....This release contains the following components:....* x64 directory...* silabser.sys...* silabenm.sys..* x86 directory...* silabser.sys...* silabenm.sys..* CP210xVCPInstaller_x86.exe (DPInst)..* CP210xVCPInstaller_x64.exe (DPInst)..* dpinst.xml (DPInst initialization file)..* silabser.cat..* slabvcp.inf..* ReleaseNotes.txt (this file)......Driver Installation..-------------------.....See Kit User's Guide for installation instructions.......Release Dates..-------------.....CP210x USB to UART Bridge Driver v6.7 - April 11, 2013......Supported Operating Systems..---------------------------.....Windows 8/8.1 (64/32), 7 (64/32), Vista (64/32), and XP......CP210x Windows Driver Revision History..--------------------------------------....version 6.7 (Apr 11, 2014).....Corrections...-----------...Added vendor-specific commands to the driver that do not affect normal o

C:\ElitechLogWin\Drivers\CP210x\is-J0HG7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1050104
Entropy (8bit):	5.617498652730841
Encrypted:	false
SSDEEP:	12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
MD5:	BE3C79033FA8302002D9D3A6752F2263
SHA1:	A01147731F2E500282ECA5ECE149BCC5423B59D6
SHA-256:	181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
SHA-512:	77097F220CC6D22112B314D3E42B6EEDB9CCD72BEB655B34656326C2C63FB9209977DDAC20E9C53C4EC7CCC8EA6910F400F050F4B0CB98C9F42F89617965AAEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m.......%...........................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\is-ORT92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with very long lines (935), with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	5.016627198267874
Encrypted:	false
SSDEEP:	192:FmJS4r31h8JzcNRHLtKW4j/RHLka0pXKmdEWD+KScQME3vBb3g:FCj8JzjH0pVdEWlQMsBg
MD5:	6278966B61720342CFFF6AAAFC433928
SHA1:	A35F767628E87829AD380200995737D5B09AAD32
SHA-256:	53039C416FAC39940E6082E99C979C8F5639C5461ADCF9D2A7E41A809CF32C8F
SHA-512:	704448C2C6F3ED22727A37E4FDA583427F11ED4F6545DC22C2FCC7713C96F47A5FD69922209297FA6DB0AC7AD7FA1819C88B862A79A4FF6C5892AC5B57941E18
Malicious:	false
Preview:	LICENSE AGREEMENT..SILICON LABS VCP DRIVER..IMPORTANT: READ CAREFULLY BEFORE AGREEING TO TERMS....THIS PRODUCT CONTAINS THE SILICON LABS VCP DRIVER AND INSTALLER PROGRAMS AND OTHER THIRD PARTY SOFTWARE.TOGETHER THESE PRODUCTS ARE REFERRED TO AS THE "LICENSED SOFTWARE". USE OF THE LICENSED SOFTWARE IS SUBJECT TO THE TERMS OF THIS LICENSE AGREEMENT. DOWNLOADING THE LICENSED SOFTWARE AND INDICATING YOUR CONSENT TO THE TERMS OF THIS LICENSE CONSTITUTES A BINDING AGREMENT BETWEEN SILICON LABORATORIES, INC. ("SILICON LABS") AND YOU OR YOUR EMPLOYER (IF APPLICABLE). IF YOU ARE ACCEPTING THE TERMS OF THIS AGREEMENT ON BEHALF YOUR EMPLOYER, THE TERMS "YOU" AND "YOUR" REFER TO YOUR EMPLOYER. WRITTEN APPROVAL IS NOT A PREREQUISITE TO THE VALIDITY OR ENFORCEABILITY OF THIS AGREEMENT. IF THESE TERMS ARE CONSIDERED AN OFFER BY SILICON LABS, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS...IF YOU DO NOT AGREE WITH ALL OF THE TERMS OF THIS LICENSE AGREEMENT, YOU MUST NOT USE THE LICENSED SOFTWARE

C:\ElitechLogWin\Drivers\CP210x\is-QIODI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\ElitechLogWin\Drivers\CP210x\slabvcp.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	11333
Entropy (8bit):	6.787341487288969
Encrypted:	false
SSDEEP:	192:8beQEeyM/W84ewtxO2hECwkY8TE0rrr8RVcdh+3Ef5KYpBjSA6L24Y:8Kl8ilwk4C+3Ef5dpBjhR4Y
MD5:	BEFE6327722742CD1424B739BC8F5CFA
SHA1:	C3F899399BF59E9890C654670B15E364628DB4A9
SHA-256:	C135F73366AAC8FE95FE3285D05A3EFA76C0054DF677BAC3E308E7DC82A58BC0
SHA-512:	0E0158FF5C583714BABD8EA0FCDA4AB203A4EF747F57AE6BAD2A4C5C866B8F183D592495B9281E85CCFF589520942607BB7F412D641A25F3CD252F4DF63067B7
Malicious:	false
Preview:	0.,A..*.H........,20.,....1.0...+......0.....+.....7......0...0...+.....7.....%...$.L..L5.Af...140411202803Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0....R1.4.F.E.2.4.4.3.3.3.8.2.1.6.4.D.5.3.B.5.B.9.3.0.8.4.4.B.7.8.4.7.C.7.B.0.7.2.6.5...1..o0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........$C3..MS..0.KxG.re0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:

C:\ElitechLogWin\Drivers\CP210x\slabvcp.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\ElitechLogWin\Drivers\CP210x\x64\WdfCoInstaller01009.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\x64\is-0J93G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.088944190023996
Encrypted:	false
SSDEEP:	1536:oaTuFs5UbmggODbmZJxRXOibxoCGxe14TNYy/PfBY0SttXpXcnxv86f1Sx:fks5Ubmm+xnxoCGxe14TNYy/PfBUtHAs
MD5:	2641655FAD6C1EA0F3677978E2BF28C1
SHA1:	09627D2AAF886E132136AD10C19282F809E06CA1
SHA-256:	E703CE74D09E901BF531589E181DCF95B9C63E09FE1B99E38DEA9EE47EE458BA
SHA-512:	C024E241D8E9768D28B854D61DD41A8C61094C106C616742D81A7DFC4BA7C3FF27A2433456DA952D193D34449A2E11374FAC92AD008CE8C35B67A74DDC1192BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xnu.Xnu.Xnu.Q...[nu.Q...[nu.Q...[nu.Q...Znu.Xnt.Dnu.....]nu.....Ynu.Q...Unu.Q...Znu.....Ynu.Q...Knu.Q...Ynu.Q...Ynu.RichXnu.........................PE..d...;.ES.........."..........,......................................................L.......................................................$...P...............................8....................................................................................text...?........................... ..h.rdata..............................@..H.data...t...........................@....pdata..............................@..HPAGESRP0#<... ...>.................. ..`PAGE....~....`....... .............. ..`PAGESER......p.......".............. ..`INIT.................&.............. ....rsrc................0..............@..B.reloc...............4..............@..B........................................................

C:\ElitechLogWin\Drivers\CP210x\x64\is-7BD1E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\x64\is-TFEFO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.814741197269295
Encrypted:	false
SSDEEP:	384:i6oIhnyUR2OZRy0m1KcQGd/V3nL7fVRQlQeddvuVyxxTWBU/T:iIZygU31Kcl/V3L7f4esv2+/T
MD5:	8C61B219882C9C9ECA09BEDB82B0DDB1
SHA1:	52A5AF0ACA9124C2AB39029761A7662ADC8C5861
SHA-256:	711681040D9CD93D603F55AB8D62371F5D51917C14818F27859E23E2D60EB18F
SHA-512:	67CCDB25B31DCB5FA4FC900898B7078F3932FA74C7159F93E592E6DD3054526ED37328C8A8466F0987901D4D432AB9735439AFFDAD5FFC4E9E4CF97253A54E54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d...=.ES.........."......J..........................................................#...........................................................(............P.......................1...............................................0...............................text...f........................... ..h.rdata.......0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\x64\silabenm.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.814741197269295
Encrypted:	false
SSDEEP:	384:i6oIhnyUR2OZRy0m1KcQGd/V3nL7fVRQlQeddvuVyxxTWBU/T:iIZygU31Kcl/V3L7f4esv2+/T
MD5:	8C61B219882C9C9ECA09BEDB82B0DDB1
SHA1:	52A5AF0ACA9124C2AB39029761A7662ADC8C5861
SHA-256:	711681040D9CD93D603F55AB8D62371F5D51917C14818F27859E23E2D60EB18F
SHA-512:	67CCDB25B31DCB5FA4FC900898B7078F3932FA74C7159F93E592E6DD3054526ED37328C8A8466F0987901D4D432AB9735439AFFDAD5FFC4E9E4CF97253A54E54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d...=.ES.........."......J..........................................................#...........................................................(............P.......................1...............................................0...............................text...f........................... ..h.rdata.......0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\x64\silabser.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.088944190023996
Encrypted:	false
SSDEEP:	1536:oaTuFs5UbmggODbmZJxRXOibxoCGxe14TNYy/PfBY0SttXpXcnxv86f1Sx:fks5Ubmm+xnxoCGxe14TNYy/PfBUtHAs
MD5:	2641655FAD6C1EA0F3677978E2BF28C1
SHA1:	09627D2AAF886E132136AD10C19282F809E06CA1
SHA-256:	E703CE74D09E901BF531589E181DCF95B9C63E09FE1B99E38DEA9EE47EE458BA
SHA-512:	C024E241D8E9768D28B854D61DD41A8C61094C106C616742D81A7DFC4BA7C3FF27A2433456DA952D193D34449A2E11374FAC92AD008CE8C35B67A74DDC1192BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xnu.Xnu.Xnu.Q...[nu.Q...[nu.Q...[nu.Q...Znu.Xnt.Dnu.....]nu.....Ynu.Q...Unu.Q...Znu.....Ynu.Q...Knu.Q...Ynu.Q...Ynu.RichXnu.........................PE..d...;.ES.........."..........,......................................................L.......................................................$...P...............................8....................................................................................text...?........................... ..h.rdata..............................@..H.data...t...........................@....pdata..............................@..HPAGESRP0#<... ...>.................. ..`PAGE....~....`....... .............. ..`PAGESER......p.......".............. ..`INIT.................&.............. ....rsrc................0..............@..B.reloc...............4..............@..B........................................................

C:\ElitechLogWin\Drivers\CP210x\x86\WdfCoInstaller01009.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461992
Entropy (8bit):	7.976326629681077
Encrypted:	false
SSDEEP:	24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
MD5:	A9970042BE512C7981B36E689C5F3F9F
SHA1:	B0BA0DE22ADE0EE5324EAA82E179F41D2C67B63E
SHA-256:	7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
SHA-512:	8377049F0AAEF7FFCB86D40E22CE8AA16E24CAD78DA1FB9B24EDFBC7561E3D4FD220D19414FA06964692C54E5CBC47EC87B1F3E2E63440C6986CB985A65CE27D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.B...B...B...Kd1.E...B.......Kd7.Q...Kd .M...Kd6.C...Kd'.....e...C...Kd0.C...Kd5.C...RichB...........PE..L.....[J...........!.........N......C................................................S....@..........................................P...<...........6..................................................@............................................text............................... ..`.data....G..........................@....rsrc....<...P...>..................@..@.reloc...............*..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\x86\is-B02VC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16128
Entropy (8bit):	6.2340490253581
Encrypted:	false
SSDEEP:	384:xo1gdGPu4eSt1NAXUyHWzpP5G0zd6zAG5WPZfJ:4gdGPKfXU8upRG0hwKZJ
MD5:	B1C99E4DE2E07926C0FE4E41FDE0880D
SHA1:	14C477364E1FA25B2AFA1856B56807289247C218
SHA-256:	D224A3C26583A8C1E736FA772E2AEC28996E1D6A6DD56FBE4682828FE0976B98
SHA-512:	3BCC2A4AE6CE57727E9B63153B7D2157464022E20D43D92BE8B656C1A9EAFA8FDFA33DF6E2A689F6C06364009979E2CA818C7A6018569AB77E26F6B30C8678A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................cRs.'3..'3..'3..'3...3...<@."3...K..-3...K..&3...K..&3..Rich'3..........PE..L...(.ES.................2.........."3.......................................?.......m......................................43..<....9.......................<.......................................................................................text...n........................... ..h.rdata..............................@..H.data...............................@...PAGE....G........................... ..`PAGESENM

C:\ElitechLogWin\Drivers\CP210x\x86\is-FOH79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461992
Entropy (8bit):	7.976326629681077
Encrypted:	false
SSDEEP:	24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
MD5:	A9970042BE512C7981B36E689C5F3F9F
SHA1:	B0BA0DE22ADE0EE5324EAA82E179F41D2C67B63E
SHA-256:	7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
SHA-512:	8377049F0AAEF7FFCB86D40E22CE8AA16E24CAD78DA1FB9B24EDFBC7561E3D4FD220D19414FA06964692C54E5CBC47EC87B1F3E2E63440C6986CB985A65CE27D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.B...B...B...Kd1.E...B.......Kd7.Q...Kd .M...Kd6.C...Kd'.....e...C...Kd0.C...Kd5.C...RichB...........PE..L.....[J...........!.........N......C................................................S....@..........................................P...<...........6..................................................@............................................text............................... ..`.data....G..........................@....rsrc....<...P...>..................@..@.reloc...............*..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Drivers\CP210x\x86\is-L43UA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67968
Entropy (8bit):	6.3536872207161155
Encrypted:	false
SSDEEP:	1536:rNF//aA+/nrKCN77Z2cNexrzF1TRIYwbzPQfeahB03lSIMSY14:rN9+/nrKo7Z2cQF1TRIYwbzPQfeahB0N
MD5:	746A0D649E5C952A3E62EF98EA812090
SHA1:	28D959E49E92F32835E116F5DF4456DB2D5B83AF
SHA-256:	96B5A52D699DDE6BD436A3B3E510BC9BBDC78A346806EF9338261F644B10ABAA
SHA-512:	C4CABA2B60A97681592EC27ECD641B07BD0B50466AC27C1E30788AC4C03644C21763A6F40A7949984056C9F3A14A8CADBEB2F03B36C54372E179A117F525C1A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................kph./.../.../...&i..+...&i..)...&i..-.../.........[.*.....Y.....&i......&i......&i......Rich/...........................PE..L...'.ES.....................$.......q...............................................B..........................................P.......................................................................@............................................text.............................. ..h.rdata..............................@..H.data...............................@...

C:\ElitechLogWin\Drivers\CP210x\x86\silabenm.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16128
Entropy (8bit):	6.2340490253581
Encrypted:	false
SSDEEP:	384:xo1gdGPu4eSt1NAXUyHWzpP5G0zd6zAG5WPZfJ:4gdGPKfXU8upRG0hwKZJ
MD5:	B1C99E4DE2E07926C0FE4E41FDE0880D
SHA1:	14C477364E1FA25B2AFA1856B56807289247C218
SHA-256:	D224A3C26583A8C1E736FA772E2AEC28996E1D6A6DD56FBE4682828FE0976B98
SHA-512:	3BCC2A4AE6CE57727E9B63153B7D2157464022E20D43D92BE8B656C1A9EAFA8FDFA33DF6E2A689F6C06364009979E2CA818C7A6018569AB77E26F6B30C8678A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................cRs.'3..'3..'3..'3...3...<@."3...K..-3...K..&3...K..&3..Rich'3..........PE..L...(.ES.................2.........."3.......................................?.......m......................................43..<....9.......................<.......................................................................................text...n........................... ..h.rdata..............................@..H.data...............................@...PAGE....G........................... ..`PAGESENM

C:\ElitechLogWin\Drivers\CP210x\x86\silabser.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67968
Entropy (8bit):	6.3536872207161155
Encrypted:	false
SSDEEP:	1536:rNF//aA+/nrKCN77Z2cNexrzF1TRIYwbzPQfeahB03lSIMSY14:rN9+/nrKo7Z2cQF1TRIYwbzPQfeahB0N
MD5:	746A0D649E5C952A3E62EF98EA812090
SHA1:	28D959E49E92F32835E116F5DF4456DB2D5B83AF
SHA-256:	96B5A52D699DDE6BD436A3B3E510BC9BBDC78A346806EF9338261F644B10ABAA
SHA-512:	C4CABA2B60A97681592EC27ECD641B07BD0B50466AC27C1E30788AC4C03644C21763A6F40A7949984056C9F3A14A8CADBEB2F03B36C54372E179A117F525C1A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................kph./.../.../...&i..+...&i..)...&i..-.../.........[.*.....Y.....&i......&i......&i......Rich/...........................PE..L...'.ES.....................$.......q...............................................B..........................................P.......................................................................@............................................text.............................. ..h.rdata..............................@..H.data...............................@...

C:\ElitechLogWin\Firmware\Tlog100_V2.0.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	239312
Entropy (8bit):	6.78456449973292
Encrypted:	false
SSDEEP:	3072:R4bOOPUkJuBdX++17gf5mXt0t+ArkRLYhPN9mjuUnNgDckdIbgtbrPft3kQbBTNo:v+uL/gRitbArkR8PN0jcf37q
MD5:	80E2B9B39A823B1BF98C80785B882E2A
SHA1:	2BB7264955F11B5F4B8B81F4261F1B7431152009
SHA-256:	DBD02D9CA45489911ED6AC75C9636C7CF3A102528669F1198181F5A3284CA6DD
SHA-512:	B70146AD09B0BDED6605F1CECE333A23CF0D75974AF20D627FC33D3AAC9A4D13532E6209F9F4395C1B20B24BD82B22C9F71BCF3DB02D5FDC4BC93CCFEEBB4A9A
Malicious:	false
Preview:	.........W.+... ............................................................W...........)P......................Q...................................)..................................F.....FpG......F.....FpG..........x`.....p.#{c.#;c/#...".p.#...".p-#...".p{h.a.#{bsK;bsK.jJ.qK.b.#..... 0.(..inJ.!..,......i...a.i.aiK.".\.+..igJ....0.A....i...a..icJ....0.6....i...a\K.".\.".@..+..i[J....3......i...aSK.".\0".@..+..MK.}.+..KK.}.+..iOJ....0......i...a..iJJ....0......i...a.#Z.FK.!..:....#;cCK{c{k..:.....#...p:k=K...#...x{k..:....#...x:k..;c/#...".p6./#...x+I.#[......x(+../#...x&I.#[......x)+../#...x I.#[......x.+../#...x/#...2.p../#...x.I.#[......".p/#..e".p/#...xc+...J.#[..\.+...J.#[..!.T.K..:.V...-#...p/#...".pB..F... h.. ... ... ...T.......)..X,..... ...... :k.K../#...x.K..."..:.k.;k.3;c/#../"...x.2.p.K{c:k.K..yk."..:.W.;k.3;c-#..-"...x.:.p-#...x.+..:k.K../#...x.K..-#...x..:.:.-#...x:k..;c.K{c{k..:......#...p:k.K...#...x{k..:. ..#...x:k..;c.i.J....3......i...a.#...K.!..:....K{c

C:\ElitechLogWin\Firmware\is-U5M1B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	239312
Entropy (8bit):	6.78456449973292
Encrypted:	false
SSDEEP:	3072:R4bOOPUkJuBdX++17gf5mXt0t+ArkRLYhPN9mjuUnNgDckdIbgtbrPft3kQbBTNo:v+uL/gRitbArkR8PN0jcf37q
MD5:	80E2B9B39A823B1BF98C80785B882E2A
SHA1:	2BB7264955F11B5F4B8B81F4261F1B7431152009
SHA-256:	DBD02D9CA45489911ED6AC75C9636C7CF3A102528669F1198181F5A3284CA6DD
SHA-512:	B70146AD09B0BDED6605F1CECE333A23CF0D75974AF20D627FC33D3AAC9A4D13532E6209F9F4395C1B20B24BD82B22C9F71BCF3DB02D5FDC4BC93CCFEEBB4A9A
Malicious:	false
Preview:	.........W.+... ............................................................W...........)P......................Q...................................)..................................F.....FpG......F.....FpG..........x`.....p.#{c.#;c/#...".p.#...".p-#...".p{h.a.#{bsK;bsK.jJ.qK.b.#..... 0.(..inJ.!..,......i...a.i.aiK.".\.+..igJ....0.A....i...a..icJ....0.6....i...a\K.".\.".@..+..i[J....3......i...aSK.".\0".@..+..MK.}.+..KK.}.+..iOJ....0......i...a..iJJ....0......i...a.#Z.FK.!..:....#;cCK{c{k..:.....#...p:k=K...#...x{k..:....#...x:k..;c/#...".p6./#...x+I.#[......x(+../#...x&I.#[......x)+../#...x I.#[......x.+../#...x/#...2.p../#...x.I.#[......".p/#..e".p/#...xc+...J.#[..\.+...J.#[..!.T.K..:.V...-#...p/#...".pB..F... h.. ... ... ...T.......)..X,..... ...... :k.K../#...x.K..."..:.k.;k.3;c/#../"...x.2.p.K{c:k.K..yk."..:.W.;k.3;c-#..-"...x.:.p-#...x.+..:k.K../#...x.K..-#...x..:.:.-#...x:k..;c.K{c{k..:......#...p:k.K...#...x{k..:. ..#...x:k..;c.i.J....3......i...a.#...K.!..:....K{c

C:\ElitechLogWin\ICSharpCode.SharpZipLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	5.683688089372797
Encrypted:	false
SSDEEP:	3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
MD5:	C8164876B6F66616D68387443621510C
SHA1:	7A9DF9C25D49690B6A3C451607D311A866B131F4
SHA-256:	40B3D590F95191F3E33E5D00E534FA40F823D9B1BB2A9AFE05F139C4E0A3AF8D
SHA-512:	44A6ACCC70C312A16D0E533D3287E380997C5E5D610DBEAA14B2DBB5567F2C41253B895C9817ECD96C85D286795BBE6AB35FD2352FDDD9D191669A2FB0774BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.K...........!......... ......^.... ........@.. .......................@............@.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Images\Guide\zh\1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	67698
Entropy (8bit):	7.784388438826608
Encrypted:	false
SSDEEP:	1536:hbQaDu0SEGAI5+t1R/1ndQ36ex8cgqg0Unn1rIp2/:RQsu0SE25+tL9K36CJgqI1kp2/
MD5:	70F25918D569ADFF288C4B140FD3251F
SHA1:	40555E1C4BF632E02338AE242DBB96360166B97A
SHA-256:	9782CB5718452D814C2EA394ABD1EFD5A2FF57E027FE369E9A3FE42FCF83DF00
SHA-512:	C35FE231568665AA9A2C99A7C417F4AFF7914E72391C40D011C14F2907F6E971941F7BDDDD94EF1569CC0D52923E112CEBC84BE0119531791DAE60853564DD18
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:53+08:00" xmp:ModifyDate="2020-06-29T13:50:55+08:00" xmp:MetadataDate="2020-06-29T13:50:55+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\10.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	57274
Entropy (8bit):	7.676927171759635
Encrypted:	false
SSDEEP:	1536:Yzzl8ZIV6aB+fvHq15h3MxgJ7tSUvhmxpY7um:u3v+Krh3MxgJlmx+6m
MD5:	FB238F06EDC7E13BCA1EF4F1F20B2447
SHA1:	59FF88E5860EC5C139C86E0A8D416694F075435D
SHA-256:	261C52DD473570B35D94E51F01D9B347BE61BAFF85E0A3FD7885296911CCBD99
SHA-512:	DA5A936CE78E45707B600E7EC8DA049176C6841523E71687F94D40FA350E5A123648EFD8C50E704739455122482769B2FDD97F0DEFE86B4EF4E923CA35C82860
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs................JiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:48+08:00" xmp:ModifyDate="2020-06-27T18:09:05+08:00" xmp:MetadataDate="2020-06-27T18:09:05+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T17:07:54+08:00 .. ...png ...&#

C:\ElitechLogWin\Images\Guide\zh\2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	62648
Entropy (8bit):	7.743145675387049
Encrypted:	false
SSDEEP:	1536:io7849xeHLXho7gaiMiegRrr6wl0D9WwCKNPeLaWXO+:f7849x6Xho7XiMXEnloUgi/Xr
MD5:	E47B4098A3EC150AA76338366EA60C1C
SHA1:	68B24FC30D94E8FD648ED71ADA1ADBEDE2EA94EF
SHA-256:	97FCA2C971EAC51730FF4FC9EFF19BA6837BB7770043BE4C22C24E32BD4DB523
SHA-512:	3D06152A9F1D3616FB3E0FA30F5E86B60E3F3431D3181F9067BA0F407CE26EEE817F8FB2B41E504D3D81371C2D18AED8634D5DA6E1684201A15211C14571681C
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:53+08:00" xmp:ModifyDate="2020-06-27T16:35:25+08:00" xmp:MetadataDate="2020-06-27T16:35:25+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	62624
Entropy (8bit):	7.753393613028599
Encrypted:	false
SSDEEP:	1536:6FGBtPWVz4Sgep4cDxg/Y4qgNGV6RuFy/eidtcBJ:VNWZp4JNGVeuFmeMtcBJ
MD5:	AC8FDD80319E013A3134BD2D61B9A934
SHA1:	109CA1E666F0B5E1B326168DFE20082A7320D4E4
SHA-256:	4729F4FA79E350BA6D2374822134361BFAA6897C36F2793CFDF9965E117BBD87
SHA-512:	23409BC00AB298868CDD3B7A3DCCC8988E1DD0A9B210D016E792B5056F4CF03AFC9D803E101586FEC9807DCD417029E913DCA48FCB7CB4AEED15171AEFEC2F81
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs................]iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:35:59+08:00" xmp:MetadataDate="2020-06-27T16:35:59+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\4.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	59624
Entropy (8bit):	7.737544339564268
Encrypted:	false
SSDEEP:	1536:qFkm+jlTtg8KDt9DZKII5nWm8MoE8JblqzfSQS6Y18888888888c08888888888d:AODst9DC98Mgiu
MD5:	246012C5BA50E6AF4D52A7E601ECE984
SHA1:	C66FB020B62A193C9B1F051FB2A6E02A85ABC853
SHA-256:	8D8ED83FDA09453311481ABEB80FCE27CD1F484B140B9E8616E10225125E3FC2
SHA-512:	1354B537CF209E61B49249E1533D47F06F96A0F7EBFFA97B680374D9E0675D6DCC282AD4E36BB1B6E692030F5594EB3CC36CF3298BE116E86AD5F50D7C36603C
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs................siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:34:53+08:00" xmp:MetadataDate="2020-06-27T16:34:53+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:25:19+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\5.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	66080
Entropy (8bit):	7.78079865321265
Encrypted:	false
SSDEEP:	1536:KV9rU6CXaC6s5iAd059BZLvrh06HWlhDAmyQhtrYqYvjD:sw6s5qtvuAWltvyQnUqcjD
MD5:	7A95E7820473612F0C8B6D003D10D003
SHA1:	F872204F9BC57064F3329C35828BB136DD1210EA
SHA-256:	EF42076B5A9CAC973FB435AAF0CA05C48084B0F528C9E91AB91373CCDC101483
SHA-512:	8F082C0D4A4C608E2A8879A9FD4D2B193A66D1DD980B6ED4F14D4EFA12998A25217008552D7BB94A99B6BAD195E0D9F632FF8C37B953C1A5E8B78A071B6C3CCB
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:38:30+08:00" xmp:MetadataDate="2020-06-27T16:38:30+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:28:27+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\6.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	77185
Entropy (8bit):	7.831410237774752
Encrypted:	false
SSDEEP:	1536:X/OdMgI/bgI4x+i7p97aac+g8qOvW4LGKTX57/2iUIrTKwn:GdMgImN7faac+bq6W4j5r2iUIr+wn
MD5:	A452E9A341AD7A852F526C2F89402A26
SHA1:	DFA46523FDF19B2AF2B9838257BCE909ACFECAE2
SHA-256:	FAB83A2CD9A066E86C7BADC97C67E205946B68710EF1B296E0DF9C45080DB559
SHA-512:	D1E8DF1ABCDC95D0D0A51C3386EBB3A8F0FF2C2A5E80C5F93B397318DC9FE84E2B1C71577B2DAD5580A92FAE77C4EE63E3B1DA8739D7A97B344939C3C5C2CF7C
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:38:21+08:00" xmp:MetadataDate="2020-06-27T16:38:21+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:36:16+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\7.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	70939
Entropy (8bit):	7.804252924307122
Encrypted:	false
SSDEEP:	1536:OR0BiVc/Aq/v7Q4ho/cLeLkvHcj/mABJhBzkO:jMK/jQ4gwHwuABfP
MD5:	514B2EF7426417EA7C14071600545482
SHA1:	1E433C6D4E2F1D79E6B1F97C0F57D690FA37C76A
SHA-256:	711C87CDB015B70905B92720CF18A7643180E71DEA0D508F66DF8EBAB1B608A6
SHA-512:	8864023522E8C0E769360ABA2A3A62ECD62CB35666E2B5DAD87745B3CF34ABFB4B47660877E722DA400A81F539CAA0BDFB3668F955A401D810001C97B4E2D5C0
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:55:36+08:00" xmp:MetadataDate="2020-06-27T16:55:36+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:38:40+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\8.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1030, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	105168
Entropy (8bit):	7.85290436161251
Encrypted:	false
SSDEEP:	1536:iQ+hGuw39xWx8S/FgssLuo6dYV0N4z9rgOlBMv+1MliBQK0jtVo9MLFbQWYz:p+h+Ncx8S/yHLuonCNsrgUM8ItKM8Tz
MD5:	0F57730CF5E8F67085D3BC078C98B74E
SHA1:	667E045BCABDFA91CB63D48E4B1BA2AC6D831461
SHA-256:	407BF322023E3EE88690551DAB788BBF4CCEDD7A51A31F0B803A3D9418CEF0F0
SHA-512:	86B75B87F951E35C62EF28545419F639A3BA8717DD2C3079325D978D1286684CB17A9A692B7EC5C25EB101716D33F56D23C7A67A37D2379B7C9EC9BA6E5FC510
Malicious:	false
Preview:	.PNG........IHDR.............Y.0.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-22T09:06:43+08:00" xmp:ModifyDate="2020-06-27T16:57:50+08:00" xmp:MetadataDate="2020-06-27T16:57:50+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:49:02+08:00 .. ........

C:\ElitechLogWin\Images\Guide\zh\9.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	60661
Entropy (8bit):	7.677966741892107
Encrypted:	false
SSDEEP:	768:w0odBXtrW5NjRSDbgraOgG5ewYmKAMT8h3Brso8ZM6FrYeoKjsPg/FSe1Cwj0cir:wPXtrW5NEDbg45NrvT8h3ls1uKjFFpgR
MD5:	572B9346A94DD2C7B1C76A7C9BC986DE
SHA1:	A9484EFA5AF1A06C40E7EDFAF372115F8EAA97C6
SHA-256:	E34CADFD9886B487959A050E4DF26598AD4B0198971DAA0CF640068F7031DCE0
SHA-512:	1B8048BFFAB47DE6C41FC9386CFFA0FB822722EC9C942FC7C2D4D5CC663C0596F304D062EFEF3141499A1392444531051703B9DDE8132511BEFAEC01AECEFA23
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:36+08:00" xmp:ModifyDate="2020-06-28T08:43:43+08:00" xmp:MetadataDate="2020-06-28T08:43:43+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\is-29I7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	57274
Entropy (8bit):	7.676927171759635
Encrypted:	false
SSDEEP:	1536:Yzzl8ZIV6aB+fvHq15h3MxgJ7tSUvhmxpY7um:u3v+Krh3MxgJlmx+6m
MD5:	FB238F06EDC7E13BCA1EF4F1F20B2447
SHA1:	59FF88E5860EC5C139C86E0A8D416694F075435D
SHA-256:	261C52DD473570B35D94E51F01D9B347BE61BAFF85E0A3FD7885296911CCBD99
SHA-512:	DA5A936CE78E45707B600E7EC8DA049176C6841523E71687F94D40FA350E5A123648EFD8C50E704739455122482769B2FDD97F0DEFE86B4EF4E923CA35C82860
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs................JiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:48+08:00" xmp:ModifyDate="2020-06-27T18:09:05+08:00" xmp:MetadataDate="2020-06-27T18:09:05+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T17:07:54+08:00 .. ...png ...&#

C:\ElitechLogWin\Images\Guide\zh\is-29NF0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	59624
Entropy (8bit):	7.737544339564268
Encrypted:	false
SSDEEP:	1536:qFkm+jlTtg8KDt9DZKII5nWm8MoE8JblqzfSQS6Y18888888888c08888888888d:AODst9DC98Mgiu
MD5:	246012C5BA50E6AF4D52A7E601ECE984
SHA1:	C66FB020B62A193C9B1F051FB2A6E02A85ABC853
SHA-256:	8D8ED83FDA09453311481ABEB80FCE27CD1F484B140B9E8616E10225125E3FC2
SHA-512:	1354B537CF209E61B49249E1533D47F06F96A0F7EBFFA97B680374D9E0675D6DCC282AD4E36BB1B6E692030F5594EB3CC36CF3298BE116E86AD5F50D7C36603C
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs................siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:34:53+08:00" xmp:MetadataDate="2020-06-27T16:34:53+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:25:19+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\is-ADD01.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	77185
Entropy (8bit):	7.831410237774752
Encrypted:	false
SSDEEP:	1536:X/OdMgI/bgI4x+i7p97aac+g8qOvW4LGKTX57/2iUIrTKwn:GdMgImN7faac+bq6W4j5r2iUIr+wn
MD5:	A452E9A341AD7A852F526C2F89402A26
SHA1:	DFA46523FDF19B2AF2B9838257BCE909ACFECAE2
SHA-256:	FAB83A2CD9A066E86C7BADC97C67E205946B68710EF1B296E0DF9C45080DB559
SHA-512:	D1E8DF1ABCDC95D0D0A51C3386EBB3A8F0FF2C2A5E80C5F93B397318DC9FE84E2B1C71577B2DAD5580A92FAE77C4EE63E3B1DA8739D7A97B344939C3C5C2CF7C
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:38:21+08:00" xmp:MetadataDate="2020-06-27T16:38:21+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:36:16+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\is-B7QP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	60661
Entropy (8bit):	7.677966741892107
Encrypted:	false
SSDEEP:	768:w0odBXtrW5NjRSDbgraOgG5ewYmKAMT8h3Brso8ZM6FrYeoKjsPg/FSe1Cwj0cir:wPXtrW5NEDbg45NrvT8h3ls1uKjFFpgR
MD5:	572B9346A94DD2C7B1C76A7C9BC986DE
SHA1:	A9484EFA5AF1A06C40E7EDFAF372115F8EAA97C6
SHA-256:	E34CADFD9886B487959A050E4DF26598AD4B0198971DAA0CF640068F7031DCE0
SHA-512:	1B8048BFFAB47DE6C41FC9386CFFA0FB822722EC9C942FC7C2D4D5CC663C0596F304D062EFEF3141499A1392444531051703B9DDE8132511BEFAEC01AECEFA23
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:36+08:00" xmp:ModifyDate="2020-06-28T08:43:43+08:00" xmp:MetadataDate="2020-06-28T08:43:43+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\is-GKPNI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	62624
Entropy (8bit):	7.753393613028599
Encrypted:	false
SSDEEP:	1536:6FGBtPWVz4Sgep4cDxg/Y4qgNGV6RuFy/eidtcBJ:VNWZp4JNGVeuFmeMtcBJ
MD5:	AC8FDD80319E013A3134BD2D61B9A934
SHA1:	109CA1E666F0B5E1B326168DFE20082A7320D4E4
SHA-256:	4729F4FA79E350BA6D2374822134361BFAA6897C36F2793CFDF9965E117BBD87
SHA-512:	23409BC00AB298868CDD3B7A3DCCC8988E1DD0A9B210D016E792B5056F4CF03AFC9D803E101586FEC9807DCD417029E913DCA48FCB7CB4AEED15171AEFEC2F81
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs................]iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:35:59+08:00" xmp:MetadataDate="2020-06-27T16:35:59+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\is-HDLK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	70939
Entropy (8bit):	7.804252924307122
Encrypted:	false
SSDEEP:	1536:OR0BiVc/Aq/v7Q4ho/cLeLkvHcj/mABJhBzkO:jMK/jQ4gwHwuABfP
MD5:	514B2EF7426417EA7C14071600545482
SHA1:	1E433C6D4E2F1D79E6B1F97C0F57D690FA37C76A
SHA-256:	711C87CDB015B70905B92720CF18A7643180E71DEA0D508F66DF8EBAB1B608A6
SHA-512:	8864023522E8C0E769360ABA2A3A62ECD62CB35666E2B5DAD87745B3CF34ABFB4B47660877E722DA400A81F539CAA0BDFB3668F955A401D810001C97B4E2D5C0
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:55:36+08:00" xmp:MetadataDate="2020-06-27T16:55:36+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:38:40+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\is-JDNGO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1030, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	105168
Entropy (8bit):	7.85290436161251
Encrypted:	false
SSDEEP:	1536:iQ+hGuw39xWx8S/FgssLuo6dYV0N4z9rgOlBMv+1MliBQK0jtVo9MLFbQWYz:p+h+Ncx8S/yHLuonCNsrgUM8ItKM8Tz
MD5:	0F57730CF5E8F67085D3BC078C98B74E
SHA1:	667E045BCABDFA91CB63D48E4B1BA2AC6D831461
SHA-256:	407BF322023E3EE88690551DAB788BBF4CCEDD7A51A31F0B803A3D9418CEF0F0
SHA-512:	86B75B87F951E35C62EF28545419F639A3BA8717DD2C3079325D978D1286684CB17A9A692B7EC5C25EB101716D33F56D23C7A67A37D2379B7C9EC9BA6E5FC510
Malicious:	false
Preview:	.PNG........IHDR.............Y.0.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-22T09:06:43+08:00" xmp:ModifyDate="2020-06-27T16:57:50+08:00" xmp:MetadataDate="2020-06-27T16:57:50+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:49:02+08:00 .. ........

C:\ElitechLogWin\Images\Guide\zh\is-R7Q5A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	62648
Entropy (8bit):	7.743145675387049
Encrypted:	false
SSDEEP:	1536:io7849xeHLXho7gaiMiegRrr6wl0D9WwCKNPeLaWXO+:f7849x6Xho7XiMXEnloUgi/Xr
MD5:	E47B4098A3EC150AA76338366EA60C1C
SHA1:	68B24FC30D94E8FD648ED71ADA1ADBEDE2EA94EF
SHA-256:	97FCA2C971EAC51730FF4FC9EFF19BA6837BB7770043BE4C22C24E32BD4DB523
SHA-512:	3D06152A9F1D3616FB3E0FA30F5E86B60E3F3431D3181F9067BA0F407CE26EEE817F8FB2B41E504D3D81371C2D18AED8634D5DA6E1684201A15211C14571681C
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:53+08:00" xmp:ModifyDate="2020-06-27T16:35:25+08:00" xmp:MetadataDate="2020-06-27T16:35:25+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Guide\zh\is-RQJHF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	66080
Entropy (8bit):	7.78079865321265
Encrypted:	false
SSDEEP:	1536:KV9rU6CXaC6s5iAd059BZLvrh06HWlhDAmyQhtrYqYvjD:sw6s5qtvuAWltvyQnUqcjD
MD5:	7A95E7820473612F0C8B6D003D10D003
SHA1:	F872204F9BC57064F3329C35828BB136DD1210EA
SHA-256:	EF42076B5A9CAC973FB435AAF0CA05C48084B0F528C9E91AB91373CCDC101483
SHA-512:	8F082C0D4A4C608E2A8879A9FD4D2B193A66D1DD980B6ED4F14D4EFA12998A25217008552D7BB94A99B6BAD195E0D9F632FF8C37B953C1A5E8B78A071B6C3CCB
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:59+08:00" xmp:ModifyDate="2020-06-27T16:38:30+08:00" xmp:MetadataDate="2020-06-27T16:38:30+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" photoshop:History="2020-06-27T16:28:27+08:00 .. ... 2020-06

C:\ElitechLogWin\Images\Guide\zh\is-SFAST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1920 x 1040, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	67698
Entropy (8bit):	7.784388438826608
Encrypted:	false
SSDEEP:	1536:hbQaDu0SEGAI5+t1R/1ndQ36ex8cgqg0Unn1rIp2/:RQsu0SE25+tL9K36CJgqI1kp2/
MD5:	70F25918D569ADFF288C4B140FD3251F
SHA1:	40555E1C4BF632E02338AE242DBB96360166B97A
SHA-256:	9782CB5718452D814C2EA394ABD1EFD5A2FF57E027FE369E9A3FE42FCF83DF00
SHA-512:	C35FE231568665AA9A2C99A7C417F4AFF7914E72391C40D011C14F2907F6E971941F7BDDDD94EF1569CC0D52923E112CEBC84BE0119531791DAE60853564DD18
Malicious:	false
Preview:	.PNG........IHDR..............N.O....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-06-24T17:17:53+08:00" xmp:ModifyDate="2020-06-29T13:50:55+08:00" xmp:MetadataDate="2020-06-29T13:50:55+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

C:\ElitechLogWin\Images\Icons\-logo(...).png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1030 x 249, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11435
Entropy (8bit):	7.837482650219245
Encrypted:	false
SSDEEP:	192:80+8JW4ls+RrYZ9vBhjfrL6XCDzjPqGcDGRrQi7CUDZdplp17XgQ3Xj:NzPriNq4zjHcDGJZviIj
MD5:	DF5983FEF86D41E19726F764F9F706AD
SHA1:	4847FB5BE5C1078333A3306424623845845B5DBC
SHA-256:	3BBBCD21C9C76008967BC85E920252210D372E14C1189281F85DD7FAB69F1C8D
SHA-512:	781C5337666726261D61479A562B9029641EBE0EBD5027A77407B73BE328D3DEAFE63A6519B9699D20A8765AFC3C713DDBA3C5C2EFAF215783E01FFABA6CB73D
Malicious:	false
Preview:	.PNG........IHDR...............7...,rIDATx......u.q..=.<.&4.{..QCf..e..h.:.0...A..@.H...M.. ..q!cS.Q\.t*... .m..\...T%K.].tus...~.w..>.. ...{.....k=...........z.!.....@..............@..............@..............@..............@..............@..............@..............@...... .?\|.'.7A........O.....~......;........... ~.w.]........!........G?..............C...?7.H`@.....Z.......C.................i..I..........P.?....h...}....?~F....?..!..-........$a.......7..7....;..!...........,H$..uH..}w.Q`...y.s... .......@..]e.k....i...............Ax.(.7.........}..3........a......3...m..-...2@..{Kq........m..C..U..T.D5.V.A.....(+.l]..Le.V........ -7......8.EZ.......HI...T).F.Y=..n}0................k........ ............"..w...G......`.?\|.'{.....;......0...{K........".....w.?..\|.;...!...y...3.........M.....G...V-.R...........H.-pJ?.R.@.......>[...............j........?.o..j`..........}&}..........;......~..U......I......0.....h...a.....q.?.g....D.S.......&....

C:\ElitechLogWin\Images\Icons\-logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1030 x 249, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20013
Entropy (8bit):	7.902461362168988
Encrypted:	false
SSDEEP:	384:7UWPbcxojN0X2qj2pLEoWY0DFF2aIDoekuWajU/6oMMH6:7TPwop05j2piDHetxoMMa
MD5:	9046D3D05C5F2CDDE8C3B102279BFC27
SHA1:	D5D1273FFAA18A2E93A260C6644B6E40C681585D
SHA-256:	92D4C3678A11A3969E065A5D653CD2CB9AEEA33AB822CBFB96C08AF8394AB5D0
SHA-512:	6EEFE0221314BF131DADD5BB693369A6A15766C47A6966DA17A267C8FD69AC655BD24DB6F5031D8D5CBE2DA8BBCA9808F7B54E3E7BF6053F0ADBF7DE39765349
Malicious:	false
Preview:	.PNG........IHDR...............7... .IDATx....x../......a..`...P......s."...^..z..j...r...r.r.uh.[.#..\i9jAP$.....C.0...BH..nLv.......=.....N..o...2...........L..........s.....................C`........c.........x...........!0........1.........<................................C`........c.........x...........!0........f.........`...cQ.. .............x...5b..cbcE..\yR<.....a....m..+....G;.9.mvF.E.............g.Ge..U{...=..m....1.s............oPy...{.}..?.3.y.xX7.............Q@..............Z. @`........E..^Z.5....hwE....R....U.E.3..g..A...;&.............p..............t.?np..k.N.).a..S......F.....=D....s..........8g..21.."....J...\|i..);a.....U.c.]...9e`..).............?.M.4..5...4.r..g.0^Z.........8.F.......(C..I...E......*1..Q..(8...A.[..............`o.Sb...Q7.&...k.H}....e,8............\|.6....%.M....fx.1F...........[..&O.#...`..@..g.........R.#..h.m[P..zh]...G..^.n..........(5.....>m..../..mZ.XUbbe...w....d........;4.......l...X......

C:\ElitechLogWin\Images\Icons\ADD.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	7.563304778908065
Encrypted:	false
SSDEEP:	24:fonSynYtnUhjxYlbyX3ej016jQP7KE6K6CM0n//mM6lSIG:gnQsjxYgXM01OQP/60p6lSJ
MD5:	F55BF6DDA2B1ECF41CD6555E5D78EBD7
SHA1:	FB27B0F8617406AA5F3AF66BE61F14368B8277F2
SHA-256:	BD225E0450F17FF2A29335B201AD2FC35572198FB6498591F581560DEE5C0645
SHA-512:	557334820EBC65AFB3742548371F65DD7E2C89A0930F225CA2A4138A75AB38339179F93B7C0F953206989996CD047641191FE26099629653601DA654F0FD983C
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.q.0..7....T@R...H.@.@.....T...T@..R.P..g...X.eI6.v.39dI....{R^..c.9T..?T.9.....%"..R....^..Q....+.s...K..P...u..%...(.z.KM...+0`J.,....R..s.Ay.x.."..`q&RKq.\..q.G...@...\|<i.._"F.TA4.....).[Y. l...1...p.(.3F...Ac.../B;n..b.w...\|....%..N\|...`K....2....D..P+.'e..(......&..........."......_VT.,.......).Hu...B.f.g.+H.B.D`..........%..),.a^I........;.y[r...V.0..... &....-......\Y..5.-.`.. j....}._.i..;K.[.....Z.........P..]..C............#. ...........h..Y......j.?&.k....X&>.Q....jr..j.Z.p..9.....H".}.E0N.D9.....2cG.)Kft..j......]`.....}.......9....6..ai. 7=..B...}1...a.'.<%.'...5...D.}KL.p.7E.!. .u...p......a:..,..k..-..[Y.....j....F.b...qAbj......B....Q...P%R.....g#..$EuX# .....a.. .h...(F......t.O.c..m.\|QR...>...!...o.UY.t..\....k.-1!H.X.h...0..1Y.....lX[.$...E?..p...j...B...w./...AW?..[.b.V......)m.?...b..$xj..........h@..F.D.Q..x..4..R\..$......G.n3..,.P:..r..R.......9....m.`]..y._.........l...

C:\ElitechLogWin\Images\Icons\Data-Export.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.484530310368009
Encrypted:	false
SSDEEP:	12:6v/7iLOZRikIXjJ2x0RIbhif1x+a+g7DGTV+bBz2/l:IZMkIXng9TUVza
MD5:	A4490677CB0D4B1281E17C31BFEFA023
SHA1:	879C51111C5140B3660A1F3C3C4F90633970CDA9
SHA-256:	009C7E52D698C913ED7328B417393A19EF1F460B53798791C03DED6F4D93BC6D
SHA-512:	08EB935C681106BF3C42C749B862BFF14A19708207EDE8B30EA4C63F793D5E5756578A66DCAE752CE89B189434E0A82563076978F8A04A48C482BF3A45E1D889
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.;R.A....T.....r...p.5..O.7..H........U..t.U...j.e....!cf....F...=...`..........ws61.f.P....Y.7y.l.........H!.ya..v=W`..Z..=..lK/.4.......)...Ks.O..u ,T.w>L..N.8.t5.8...s..N.(...3.hya!.D.~z..DP...Ad.......;..H...\|.D&.5p;H.:.)H...@N...#/6.pI@A.T.....(...T...[.4.8m].+.....Y...F...v..d[.6.i.-u!......W..+...\V.f..>.V_T2.$......X...{.q.u..2..p..B_.N.\|<.......7.A0. .V.x....,..q..>....-k$-[.....Ox...JjH8b...ZG.qm(.....\|..`..14y&..K.j@..<....~..9B0-x.f....IEND.B`.

C:\ElitechLogWin\Images\Icons\Delet.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	7.651241143946083
Encrypted:	false
SSDEEP:	24:V5+3hizvVrImwOf+GYyoONhxSnQoVR9izlWH7MRxQbgginineROKTcx1:CoRsMfDYyoONhxPoVRABeMKgvbK
MD5:	3883B1B16F0EA17F84FAD118AEE282CC
SHA1:	7BC4263ACC48827D415C1DBE0905B93BD01705D3
SHA-256:	3B5C84A0A37BC3956FF24C2E8C77BA5DB09C2BC7532A14A0285F6F43A8DA89F1
SHA-512:	2A398006AF30912B0329D2F8FF3EB0558DCAAB39BDB7721F2D2956D25004C201C0A094AB62095E8A935925DAE69CD91BC2F7E37C38D6E9211DA9056DE18A0FFE
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^..q.1..........H....T.......R.P.I.@.0........g....X....H\|.C../"7E.8..h?.....o.....upGD....D.Hw..,"_D.b...{f.x".&......".q..Y...FD.y..'..j.k.0..;.O.....Cm........... xv......MD....b.?...^./D.............'..B.. .M..........(^.....m.......j..._..6.u'..P.@...Hu...n.M.{...R..\.P.@.o.9...Hv Vx..)._7:.X.N.i9...@......xB..k..'.M.....]Q.... C..B).awX_(....{[2..z.~).XB(..xm......O.J.E .9....%.:....4.........^.f.....f...[C.-..........h..`!>hd.\...<.3...x.,uL....K.k.,......q..o......<.o...,^zF!x.....f.....[<6...5>..,....B<z..0+.... p_n.......s...V..3.C...........B...]K!43.... x._l..@..E...........X....].O..^A.5.)B/.nY.......^...9.`.ZE..z.,.:.B....}..[...R.[.......V1ay.b1.bhfk.}i....n.....I.F.{{.....z#\+...)./. (.......agQ4...i0[.5...f./.-.{..xK.[.c.Df..z....[@....[6H.....K.l.K....m.k. w>.gZ.....M................&'D8).m.#2...x.x..M..j.m..J.\|.....r+ r...=xMA.q/.E.n.....f...l.9u.a.\.... .Z7.D...N.D..'.j..n

C:\ElitechLogWin\Images\Icons\ExportFile.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	695
Entropy (8bit):	7.641116702192887
Encrypted:	false
SSDEEP:	12:6v/7t5esRZRLKvynfL7piV802MmTBXZ8X0uusxS0JZq1FO5m6f9:KdL+UfLIX2Mv1bDZU4mQ9
MD5:	5DD24D4DEE71B2021EA8C9521264F2BC
SHA1:	4DDFE0DAD545E368DCE7703A9B9DD234DC3D31CD
SHA-256:	FBCAC8CEFDC9A047BA9D68C247E0EE65D6B912796DB67F430C283443EB50B925
SHA-512:	086C1156C8D9E084534474FFD88D02EDA22AAA9917BAB7CD8759A5292968DE93E7B6136B04779DB015BFF4703D5CEFB58C58C232DF81C80873BB3800A9E399B7
Malicious:	false
Preview:	.PNG........IHDR...$... .....z.....~IDATXG..k.`..O...K.....2.A..2..d2aNo..6. .....w..EE<..d..C.v..?0..Y.f...k..L..?.4.....}>...y.....`O...yHD....'X.d......o..x7Z...a.;.q..O..T\.:.i-C..,....s.....MQQ3vI...%..BY..u]...>...\v....2..gN....o%...._....A........N$B.hy.1.%...Iq.)sa.......J....\P..T..Y.y.+......:.T{..L.?...nI<+......)j....L..,S.t...@A.....F..8..('...\|;.d.\.SLk..- ....T.ed..`....K...n.Oy...z...(.q.c.H.z..dP.~.G..]'...BUY..6k..U..y%.)rc.=.....o......5..B.h<.u7@.`..o.#TF.k..^....).4... ].MH...21.<.F....y.n...#...n.p.@.JL.t.."...*...L").0w..D.S.).~{S..+.....p}.....&.C..voC\.F.....G.\|.z8..+........!...2&R...w..'...#..F_.......?67......IEND.B`.

C:\ElitechLogWin\Images\Icons\FDA-logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 600 x 542, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	31566
Entropy (8bit):	7.949245203415111
Encrypted:	false
SSDEEP:	384:idbj2fmZxqJf5V9j3DW36HKFBrQvgz8AXdjlNx48jykfRs8typBYwakZIzqhBic/:idbjgmZ4hLqFBEg9Nx48Fs8o0aZPn/
MD5:	9862349CCBBD010AAE9B4D7CEED22F9A
SHA1:	9D8C7D3E6A95BA269F7C1B2BCD5F6744F17D85AF
SHA-256:	A46346B49714FF5C918EA0AE35EF458892CCCC44140A9B70885D8A3137586657
SHA-512:	F8003A63135DF52922A4942FFF6681EDBE86C57319E4800E1A61EA73634F1DE4B788DF70410063AE89F9C5A709FC31CA8D33E618E1C0AD4F00DB7B1D6C65E6FD
Malicious:	false
Preview:	.PNG........IHDR...X............... .IDATx..w\|.....gv7....".kh.AP."..tP...QzO...@.H....- .T@....]ZhB(....Rwg............d....!,{....{.=...RJ..A.D...... ..8..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. .

C:\ElitechLogWin\Images\Icons\FDA-logo@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 35 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	7.784836156153588
Encrypted:	false
SSDEEP:	24:JuMsrS/PwMelqvkV0kdhCLVoyN0i5fZQQmuGTF89uWgNjkTXWvnxqb9aqJj7u:JuMs2hMV0kd+Hx5ROq97N6fxqrS
MD5:	5EAC833E254B08BE5703AA743C0C5CBE
SHA1:	492DE7E03E70E9FDCA2A61B61DD4709113686A94
SHA-256:	78BDA2C4730EBE256F21FED473A26FD10D386385F13D10C2A535C64B31954586
SHA-512:	5CD8EBEB52FB15A07B955D1DE6F6A5302D68E2855C23C4E6F5D3669448594332A4E1A3171D51498D5EFABFE6FEBDBB64B8475520F9DDAECD0BAECA5117679B5E
Malicious:	false
Preview:	.PNG........IHDR...#... ......M....."IDATX..Kh.]...3.m..RS.-...\|.,>..XRua.R7RR..T.f...I...,VHQ.BE.........E..Pu....&.5$1.f....L.....{.w..y..E.4Q...a...(..;.<.WH+.T@....73.jx"R....mP.Y...R<#.Y*.J9......u..f2.(._r.......Z....6)\|../...\...D.\...r...DR..a.32wE.m.._B.,UX......TC...C..........x.^>\|...........s....P..uaa...Y...I.R..d2...,...l.....iy@fff....[....N......#.L.:..gn...oW....f6m.D8......F...CQ..................7.p...@..._..n.).......VSS#.`P\........4Mn.-....K{{..r..]9x...../_D.4Y&M....O...e[,....I.w..r..=.a...S...].V.o....?.744H$..UU..t..iy...).N.L&.&"d.Y~..Mmm-.d...Ncc#...LMM.q.FB........tuu......\.z...N0....LLL....7ox..Y~.(g...nq:..p8..;..w.t.4M...~.$....\...... ._.l6+....UU...R__/---...u....u.V<.O..........m...yam.Z.t...N........TUett...6\|>.CCC\.r......p.......,...b)....,.H...F.....x<....N....:...Vz{{.....v.k..FFF.w.g~.......X,/.,--..v<.......?....G..e..w.......s......8...^/CCCz..........7v......f....7R.........O.>1>>.k....Bttt

C:\ElitechLogWin\Images\Icons\FDA-logo@48.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 53 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	7.861534567565303
Encrypted:	false
SSDEEP:	48:A18cZ8w963YY1dTWaXARjM602g0zqXFgghiGU:M/J63YwdCaXARj702IFg2TU
MD5:	96FAA1C30804D1E5DF8936AFCD07EE2A
SHA1:	564CA6BAA0F6726FCB38C18DF3BC5F4C5B353A8B
SHA-256:	3C92DA83202A9A06E51EDB67CF696254F79DD22E0F073B707547E57A63B27C3B
SHA-512:	09822EE0BB0ECCE1F9A9EDCF047E99162D3630FE2CB9E4854D128C7702AEAAA984133357620B0427BF9DB958C2D39FC7CBEE093F5B95C08C6439509A08F1D2FF
Malicious:	false
Preview:	.PNG........IHDR...5...0......+2.....IDATh..YkHTM.~.Y[,o-^.%ZJ..).. .....B.....J..BA.Y...$....0...vC.U+..R..t.......iw={vW.......33.;...3....'D...`.X.Ng..f1..j.i.Z.u`J.......1...6.~..j..)g...M.k.V.?n....E.D..HYbk.~Y.g<.Bes.D.`.VbP...&.G...$Y.H...5.}.}..OD&..l-ic..No..c.....C.".Y..K....B......B__..;.....;...,Z....Z..V.5.u.T.{{{..ttt...8..M.6Qnn.}....Z-KD.....f.8..PVV........d4<<L.b.OW.[..O...222...../.....H....Z.n....../..y.@)))&..'....BCC..7n.@``..off.}}}hjjBCC......AAAx.................T.q.BBBPYY..7o..8477#&&F\|G..T[[..=...........{..Att4...P__.....@{{;.]..H..?.r94.."##.....\...@...a.-....\.Ggg'.R.....l...........z~~~...J.....>\|..2......_....Lf{......b.W.Z....6.....o........=R?~..J......`.5x....]....:..J.BTT............@zz:...1??.....@ww7v....n........q.y......"Av2f/SL..jivv....I.......?......C...F.!___.@...4::J....F;''..>}........2..)U,).J.GYY..8q.........3......[....N!!!..lll..7..........00......Z...G.Rbb".}...G...t......"c....m.....

C:\ElitechLogWin\Images\Icons\FDA-logo@64.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 70 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2999
Entropy (8bit):	7.906131705173593
Encrypted:	false
SSDEEP:	48:RSmZMzvLUne7hEZu00qZzSeoSKTFQXabCXRtAOJGtoojQu3FlAwqnE1/YidEmh:Am/n/aqZmYKTQQeOUKx3FlAwqnERdEu
MD5:	8ABAAD7CCD86A0A9DE6BA42A3E9B9D42
SHA1:	0635A623ECA23D5A4BB5993A3273B4F1A6C10A8F
SHA-256:	AC61DAA74872396F8A848C4431517E0993915EFF78612D3B6D7E2CFEB907375D
SHA-512:	0319E265F1E4B4C2E90B03606E7E03AF441A4BABBDEFB7B222B061EB7B05606BF1D12237F45EF2F656575C5E1DF90D4E6C79339F26DE4F1968B15C982908DCDD
Malicious:	false
Preview:	.PNG........IHDR...F...@......w.....~IDATx..\{LT.............6]..T..5J1ZM.T.Q4.#Dc4E.PCaI.->.B[.&......hT.&b...O.4.C\|.&J.........o..w...._.$......9.o.<..............`....`...\|...+...o.....II.oL..ztZuFZ.k<.$.......N^..:_Y .d0........J......6.....Zm..H.1^...VG.A4....N/.$5..".W.._.FQm4.F7.:.....1z:.f....7..{..o.f/..-...M...c.H.."]..L03..Q... .6....Q.s.B...+A....t..p..].7.....R..E.j...]0H..Y.cj..S2.....p..<%..}..=X..+...y.2T).`Q.N.]~k%-f..4...;.....oR..%......L$tj...1..=B....;.:.w..v<.p...8....`.....3h\|"I.bbb`.............{....88.N.<s.L....^.......h.0$.`0.i.....?~L.1""...d.1*...u..F:..<...q......GA.ID4.........?.cL.J.a..K..d2..o...c...F.$qyYY.b]j2"".c.bbb.......y.....E....q..]\.\|........7..b...).....Ckk+. 66.W.\........Ws.3..p..&M.....[.........<~.8b.a.!66.QQQhmm.W_}...F.O..\....X,.......V.........'....s......r....?~..$i....,w.........L&z..7...............2+V. .......<..^z..{............7.......Z.........1.e.....G...&..I.O.t.}...'x...$I...6.p..

C:\ElitechLogWin\Images\Icons\JingChuang.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	2.9642721625564956
Encrypted:	false
SSDEEP:	96:9dP380aCET0PQZjoW7p01/wjgpqX9JnPcbOv/O/1D7FN:juLiM6E9JnPcb97F
MD5:	3D689127F19830D828B3BAFE0E44CB73
SHA1:	0B81546785D2841FCA3F9EA56ACD3E271AD05ED0
SHA-256:	C7A83C3348DFBE67AC7C59DAB1FC51A63269CA510334DFD7123F53191770873A
SHA-512:	96B59F729AE2C8A89D02DF1B8FDB767B1C5F6FB12D1B0BEA25C75C90FEE1A2F5071A19C6496A38F0BF00DF2BF60317C71FC43BE0BECD43D97B097DE4B4988F7B
Malicious:	false
Preview:	......00.... ..%......(...0...`..... ......$.................................................................................................................................................................................................................................~.............................................................................................................................................................~.....................................................................c...A..V...M..S..U.......p..X.......-...}...............\|4..?.........................................................................~.....................................................@..Z...J.....G...Y...;..N.......F.........x..............:.............................................................~..................................................................<..^...\|3.....L...a.....E.......b...r......^...t..}5..e..F...........................................

C:\ElitechLogWin\Images\Icons\JingChuang.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 188 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7952
Entropy (8bit):	7.939319145856382
Encrypted:	false
SSDEEP:	192:hIIHUCD4wa2LaG5bisgJuTTlgiK9TtT36G:X0w4GN3oqTQTtTX
MD5:	1523B8A502622C2D0C6A6E53060285C2
SHA1:	AFC47D05AC745C977C9E153755BD985EE6D8A9FA
SHA-256:	E0D715BD24362D34D3FD6483E9D68A201AB7A0626C28C0E3F0FAACE3D0CF3000
SHA-512:	B7AA11FBCD839167F036C0D219DDC52D1112EF4C0B6E7443B5B210CD5CC0173F14274E9A9E10E6EC5B72F84320F4E79E63A5E11639F81C796B6AE199530ED35A
Malicious:	false
Preview:	.PNG........IHDR.......<........s....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\ElitechLogWin\Images\Icons\JingChuangLogo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 188 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7952
Entropy (8bit):	7.939319145856382
Encrypted:	false
SSDEEP:	192:hIIHUCD4wa2LaG5bisgJuTTlgiK9TtT36G:X0w4GN3oqTQTtTX
MD5:	1523B8A502622C2D0C6A6E53060285C2
SHA1:	AFC47D05AC745C977C9E153755BD985EE6D8A9FA
SHA-256:	E0D715BD24362D34D3FD6483E9D68A201AB7A0626C28C0E3F0FAACE3D0CF3000
SHA-512:	B7AA11FBCD839167F036C0D219DDC52D1112EF4C0B6E7443B5B210CD5CC0173F14274E9A9E10E6EC5B72F84320F4E79E63A5E11639F81C796B6AE199530ED35A
Malicious:	false
Preview:	.PNG........IHDR.......<........s....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\ElitechLogWin\Images\Icons\Next.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.672863914480044
Encrypted:	false
SSDEEP:	24:xFPLRsCi5zUkDCoqduOQpI0crwWoamV+PM7:xVRhkzqd9sfc7o6M7
MD5:	F9BE9A64B2D443D78EE3BD137BF8291C
SHA1:	9EC3BE8660F8BEA3128AD59CC7544D8061E3BEB2
SHA-256:	DBB40F8B775BC37221E2C86C1ED703A819B9F63B22FBF4F21A05D0872C72DF0E
SHA-512:	D71CB240A28A06CD79C7A19EB1290DCD0CFC76638F1960D7F399E979A506EDA9B4900DE8E88F5880ADA077BF1EF2F7B6628A667EF7C450D05360B8BE00FAF877
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATX...K[Q..?yQc.Kp.pS.P.J..!...=.t.DAA.........c...B....,.n..5...A.!.D.....R.....y.....=..s.-..r].i..C.u.Ei...(......2M....x../#LN).=.PJ}..d.....<v:.TWWc...F"k^]]....d2b..J...tpp`.>......p..$_.L......@.(.../O....S..a...........n.#[.C.USS#+.L.t....J-09UUU.H..@...#.. ....o..HB6....P....az{{...\^^...x<..~VVV...!...............M...9<<...Sgg'cccD.Q.nkkK/.......).....buuU/..\|jvv.:..b.PH/...v377Gcc.......$..yzz...6........$.:............)eLkk.^...m+........_i..p....j..#..[.\...,,,0??OCC........5_.@..%.,--......8...E...tqq....kkk.\|>.....(......1::....===tuu..e.5....{{{.TGGG.@..jnnfyy.d[....\0.:S.B..+W...J../...z.....l.....m6.MK8.......o.R.C)..x.H$8==.SK....2....../.'...H$....r.Q...JO..w...F)e.S7..L...Ra....L...}....'[e}.......b..\|....IEND.B`.

C:\ElitechLogWin\Images\Icons\Next_2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.613713129298825
Encrypted:	false
SSDEEP:	12:6v/7csFYaM1c+HIylrRoRE2sjshKsYVtyrWMes/Eb/O6W6+8yvxPmoWAPy8qCP/D:kFYz5vQi29KtIWMee4O6F+xPbPB3D
MD5:	36C2F806FCE4810A55ECA2497D0FCCE4
SHA1:	C393081F04CFC33C11C86EC34FAFA31B5EFC836C
SHA-256:	A606B9FB6783E498113C286B35E59F1AEB49011EEF4A054920ABC6EBD4D428C2
SHA-512:	6FF4156932B57766A93DA4AD80EFB67E2CCAED3DCA20C9B05C6EA91A5663A2CA6EF8DD1E7C4230BB73D454B89DEC15C893B391A4F95E07E5FF150EF4C398F058
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATXG.M..a........aA&....Y("Y.WLaJ.....f.....e4YXL..J.....Q&...+6b...3.u....{.{.y.v.........#...8.& ..U......L..2C.g...P..w...^..M.o.- ..][...=.W..J...>......@.._.....8....I...Ze.l..N&...V.g..D...M..lo.n..%.X.....rg...\|.9pQR..e..B..pP..J...hZ.L3U.....!`......=.....\.SM2.Q`..wy..=.=.x.<....(.w.3$..;....k....T.k....@...$...ra(....JIOF\|.v.........[`...,.H......@..\|..I....H.).5rv..h.vk...j)P...I...@..H...c...."._.S..L..B.L..L2o.Q.j@Q.G.ZwQf;..x.f3e..3.O.nI}...e@t.u...I..;"r...,P.K....EE.v.k&##..9S$...-.^..$E.Uu....7b..`.....v.W.%...r.@........lw.7.....Z...nIg.T..\|..=6,.\...D...)..,...TIK..Tj......Iz.L.T...K.u~.Vz.{...B.6:.Q.3...J.(w.a..\|I.....$E.........E..d}.T@.8.v;p...L...<..w..o4UZ.@%9#.fC1#.e>.....=..W.e...E`.=..%.4C.......IEND.B`.

C:\ElitechLogWin\Images\Icons\Previous.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.642050986844882
Encrypted:	false
SSDEEP:	12:6v/7iVrhoQ78OPc9czoH/hiNmS1MfNcOCVEh0k7Xe+8FLABZS4Df/yBfQHmv0PQ4:nnor9fHJiNmGMlpx6Qu+8FcFCfkPz+E
MD5:	8DEAD4B7D72EB28310C560EF20F3412D
SHA1:	33DF6ADEC2DE031020D8D9E89A7CC1846D4432DC
SHA-256:	7B80F55B6FA1FD7BF4BB8B73E424870DD3D45D4E3663D6D7AE3BDAF31EA52EDD
SHA-512:	0893FCA57781E3321B911F1DFF26A2E22BB8BC6B1106D17096FD941C4AF203A14F6E5557DCBEA8DB8BA85F5908186C78A521EF20AB8CEAF7F4F82A69C456220B
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATX..?H[Q.......V.H.[..K.A..G....n..b'AA...f.(".. ....C...S+.U....;XQ.$..1)..(...{....{.w>.;....B.@....p.p.xP]e./J......Z..B.s.SC...@..(.>...Z+ .<lnn..tb..jF"1s...d.\|>/.z..zc...q;..0....6..G.@n+..svvF&..l..R.R/.........@.`.F....<..........r..#..K..444X.STcc.\I........'..dXJ...........hss...Q....z.j.,.nuu....\|>......e2...............?P".`ff....A...+.;....q..0...LLL000P...:8803s}}m..`0X1....]3#.......C9........aii......PN.R..'''x....$.....h4.....-p.D.H.@ `v...Y.......$+....X,...$.......C.B!......K..e@E.....Hk...H.S.j@...>....f.......c-..........fzz...-k.D...&TWWW..$..}...koo.&._.....Sy...x.J$@.eKk.J.'..~+....o....u.P...B....D~....J........fJb.\]...)1h/.{*....iCv.r.Q+.e.2...\|.....9.o..i...3 ..ar.<.+..x'......."(...%....IEND.B`.

C:\ElitechLogWin\Images\Icons\Previous_2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.508694365561838
Encrypted:	false
SSDEEP:	12:6v/7N/aAFOrdLzWD2nIg3e1dECAr/J/NIArCKq6RBhj5UJBRNlw4AuNp5rxyiOzy:yFO5qD253evRI/rJCeThlqNlw45pnXOO
MD5:	E703666544D75EBBB90359485F0317C2
SHA1:	C7202278D62CCAAC3FE66281DC51AEDCA7959F5E
SHA-256:	F8EBF3DC497ECD403F25358CC72A7E43A46DAF889B789267E2C9711D611B977C
SHA-512:	8D251BE74C77F5B36E3417B89DD418CB5B309E125D2DE69F69602CDDC7B4731AE6F993F9FADBE1E085C8562433620F6326679DCEA6399A00AC90CC283B189EA5
Malicious:	false
Preview:	.PNG........IHDR...$...$.............sRGB.........gAMA......a.....pHYs..........o.d....IDATXG.k.A...,..I.J.!A$U.. "h.)..l$`.He.TF.+."6^g!.X.H.I.".b...C..J....v.z..w3s.`...s.v......\._..v$EQL.G'.Iy#8@...n..K'.......(.=...z.4...f.Mt.-.S.<..M.9t.m...E+.....=..[c.<.h..u.a.H.j.V6.s...(.l.........3J..[.a......`.kH\....t7......q$..B/...O.+w..~...P.[...gmU`L.C.j+.j.0wl.........4.,....0...q..cI.A.C.W.I.#.S.Ww+l...S....j5...#n.q.....x&....@M....s...0".....n".H...Ms..n^R..s....q.>.\.z.C...FC..B.;h....9T..Q...@hE.L.P].?......d.u......i...n4...!..b.Q.....S.&.2._.U....0n...z`."..._.b`?z.~F.m...W.......a....0.~.......tjU..X.....i.(.~.).Tue.E.IP.e..`]3._t..1.j.w.]A....e....J..k.v A...L.HGJ...<..s....zO.k.\|.....Z?..}g..v.....IEND.B`.

C:\ElitechLogWin\Images\Icons\Query.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.736198150587555
Encrypted:	false
SSDEEP:	24:JP3gNyb5MvYp33eWRfRGee1hnVkpYl9N8:JfgN/vU01RVkpYl9N8
MD5:	F9D9324AD3182CCF7DE1D306CCF964C9
SHA1:	2A601DEBB5857BEA366A389D67D0A6BD628FD19C
SHA-256:	EA78BA46CE8C9621FD61FE51C44370E1E0AA298CA42E0ADBC09F8768C6EFC792
SHA-512:	CFE7A9A5487A20F705ABF38F2F7446E3A1E2691A9AEF0C4CB34DABF4DA56789483845C12306DE61C808222605CEDBE9E5407CAB63A292A814DD07B86FC35D465
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....`IDATXG._h.U....i..vg.TAZ..T.V../!.fk........Zm_...R}(}.d."E.E.b....6..j.`.dv......Ze...d...f&;...!.8....s.~..q........V{....... Z...D.q.R.q.Wy.......`.>.A....0.....X.m.....l..+.2...P...8... .........x.U.....O.;@..5G`<...N..... ^.Z,"...m..d.......2.....$`z.....z.f.....R.e...5(8.&...+..?N.L...e.d4,.<..K+...@>..BDN..No}...fdz.M..J+H1.p.k.q.ZE..-.L..DOu:g.,.T/..:>..i..S....f.X0?\~ZAo..DT......L...U.Q...)..*...ju.\|..u.....".!.k.n.$.&.......V{9..pw..\.<....".C.Wr<[.qK{4.G..X........n.X..M.._[..9..........&..e....\|..=.....K..."....P.z....L8a[.'`.)X....+..(4..^u.&.......J..n..S...F...Oj..s<E...........L.V.....E.i.:/.......O...l].o ..Mo...}.......&#bX..C ^...........-C>...".A..A...@..ME.F.m.k.H......x+......+]?...^i.E.......</".........E....M=..Z.Ay-..b.IX7.....Kv.r:..p (8...9ft.Rg....^0..E......U.A..3mj.....OT.U..X............0W.:_....IEND.B`.

C:\ElitechLogWin\Images\Icons\Restore.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.710936747231506
Encrypted:	false
SSDEEP:	24:yzDB0zu2csxUnO3pt7c4KfJbWWa89SgaqtZMuK:yz8uH54KfZ9Sd+MuK
MD5:	095C9F6AB4987C07C604848BA9743092
SHA1:	40C2AA3371E0C157E10437517A6BB4F2545D6253
SHA-256:	D72784255491BCFE0127C13524ED0ECDC8D813D1218E5C523AF3519572C9F809
SHA-512:	B458F569970A2DFC74146D676D388383979802B91A4D3542D56CF05DDC162DC45346552C715F92E9FD1C6D4A4A172A514E53C21B519D2FEB8E758BE7E8BF849C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.]h[e.....]7.&a-..Q.9.:.....9...^..A...M./..Rw.."k..5..P..Z.S6.!......+.....].6.9.?..OO.7...\|...<..}>.....d..>.cT.Z/........i_....1.k=.>.WC....g..'.y....`..B.s..l.N.u.S:0..\|:......\...;w..:.........u...s.....w.J.\|%.e..........;.;..p.............Gotu\)g....!...l.+x...@...x..OY.rAI.Cp..K$.....{...S..@B+......3.........Tx53i\|\..?.....o......H.3...u..j.&...IGs...A...rg...>5..y.tM..H.....^....B...lX..r,.j.xZ..6.........G....D$i.Q...Z.x".0.]...v(.B5...$..j.....b.5.I..t.\|q...h..[8E..B....xs....Z...}.."..'&.=....k.E..g..E.Y:`4.K..k.oA.......n........$:GW......J.l.9.c....o...Pq.....m...!.Y..\|iU..o.yGz....F..~.....V-..?.1.i5........P....A`".4.qp..:...*.kz.J..$...~..%.S..l.8U."<pic.....~...!.0.ym}S....P.}..f...QB}..oK{.ZD.>!.....o.H_j...(@T..+h,...8x.n.(....A.. [. .N../..M.+<pU\.0...."....: $..r0.c\|YM.=...S!w....x.6...u......Z.......-89...w.\.........k.s.:4.)....M...0........IEND.B`.

C:\ElitechLogWin\Images\Icons\Signature.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	909
Entropy (8bit):	7.692122420294677
Encrypted:	false
SSDEEP:	24:X9iKDGDDW0SASp/IdMsPW0VI5cpiAvGxm4Y7nY23m:XsKCDDWZASpxsPWsI5cc0GxkN2
MD5:	AE33E500AA31F84D6615A3D8E918EA1C
SHA1:	DD99A745522D0C721D2568417716E6B9DA2FFF99
SHA-256:	4C4B3B45A63BBDB946C229AA0C9F70463B840E617959BB52E11DA185ED8A3754
SHA-512:	94A8DA2E3101F38DFB21B27516D2CCC1C4E18ABE4674C68D62ED85EABE61809D78D53A99EBE7775397A4A879CE5A00DA6997DFECE268CD50926BC3BD5598898F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....TIDATXG.Oh.w...7........B#4..R.k....."E......J....b.IP.'.(.......(.JO.).i{(m...%.xH.gv.J.l..d.7$.S72....f........{?..5a53.D.....bF...P..t7f..'..Z....W.h...E.......j......SzP.[....?}...IX'....Z.B.s.MAwv....=.o..u..-..m}......./.`B.r....T....N.....8/!Z2F.......,...V@5..&\|.E..se.'.....3R...{.oW...._."...c .............K..7........x?.]..rSH....)M.\|{9....M..7.....T.>..C4+.,5i..,'.R....G....l...A\|j.c...j&w..Gf\%._.n..0e...Y..1.zs.t.Z.....u.......?....:..o&\I..W...4......Bl..4.V..B3..=........p.........j.:......\|.....P(....{.....cCLX3..y^..9v..-3.Z.~../AD.S.B..X.t.../...^.\..N.B.Z....b..5..`.&.7.....7,:?.....F...]..$...~.<-..`Nr.:J..s.B..i....fR.d.TP5.[F.1k%.0:.@j.3.Ld...'..Mk.BXT...9/.=.<U~r....TZ}aB..<~..v;...EfA.L},H^.............:..J..c;..:....K..d.q".T...\0...,....E....X...@....E......Fnx..(...(..}O....1.uO..p#?C.U.....IEND.B`.

C:\ElitechLogWin\Images\Icons\Skip.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	7.705362782732972
Encrypted:	false
SSDEEP:	24:0iAKjumoI8CQdXUdLUwtY/79Ux1P+PXywfTxQDtEw6bANy/:kOJDQORi9SPWzWDeNb3/
MD5:	5FDF2ADF0C3A8285107FCC73C63221F8
SHA1:	D729489E24CB2837E0CBDA5417E697575576DA4A
SHA-256:	7F24ACD181BC69972276998CAAD418BA920815485FD65861FF43BC37ACEE093C
SHA-512:	6F3338BD2890E7356A59A5DA47C3773C3A52A65AC7F5C072084D2C85B9701238AC6B3B445B41009CEF6137D7458AF318C246FDBF7DDAB7A869E11EAD02158299
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATX..[(.Y...^g2Neh..M..H....+...r....hHB..L9...4.r..S.\.\|..drH.!.PrJ{;.=....07l....{...~=.....l6.t]..\|......%..J)..U?..........K+.....o...RK..t]...;.o............p.......L&Z+G)5,@.......4...\]]...T&..GGG...$T.Rj...=.w>>>6..4M...i.7n.9........!Byxxp.4]......]`...........K.@..@..}Q..W.1.766..Z...........F[[....>=[YYAQQ.ZZZp}}m....N...@)...)........Hdffbzz....`........D.knn..........(.YVV....,//....u..95......^.[.....gee...........j]........ ........~9.......!..q.M.(___qaJJ....QWW...(1...'G.-.g6....RPP...9.%.,88X.F.......lNN.X....9==........Q......^....T...ckkKf.W....x{{.Y.8.......n...XDEE.<...mM\|\|.m.X..................jkkqqq!U.qeu.......f.......QDD...haa.MMMr..\|........... $$D...._..E@......A@@.Z[[.....gll............`.pS....K........'...."--.UUUpr....z+)).CCC...........l}Ysjjj.....Gnn.P..,,DPP.l...#..677....u..l...-.....X.,u.E....r..T...<....?{...R....yL..WWW....W{....@....[..=D...s...R.)......=^

C:\ElitechLogWin\Images\Icons\Skip_2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	691
Entropy (8bit):	7.552614817850465
Encrypted:	false
SSDEEP:	12:6v/75TsmOCC4on8G1KxFZUZM9Sq0V3H9udsAKQ+3UCNMGQ7UvGMB1FnCfL3ReL:+9ox1sUqA3FdudsO+3UmNQuh19KU
MD5:	A1AA4B043C583A2F15A78DE3CBB5F656
SHA1:	F0E8CBD141BFF11392ED6F60EA8CB1155289A914
SHA-256:	38E4A1791C21BCBB8489EC494033C7382AA204BCAEE154DB11B3157C6F9ACB8D
SHA-512:	84D15BFB3EC22ED3771A1C098D4CEED04FDB42D476306BAA2E6EB7BB2A156CD91C8E0EF7A43FBC0E3A9CE5F96C700940860BC5147117A868C9D145986EAECF9B
Malicious:	false
Preview:	.PNG........IHDR...$...$............zIDATXG.k.Q..._a..,D\|5..Zhl........R..AQPl.....@E..E...B,,.....J.D...2.....l.$.Y..;.~.s.s..j..Y@E...!.;...."'-....H..{...m..w..-nX.\|..-.Ij.i..~.<.#.Y..v.mo...C.F.>..]..I.mg....~.\|.4P..).\....Yg;........=.X).].........c.0....0....$}....P.Hc..Y..O.8....x........,...UhU.B..#.m/...1.[..9.-`../)t,.....v.I.J..T_...}..Ig..u.P.p.8...t2.....G$........h.w......,.[.%....t(.....".........[.{.rI.3..\.K.Z.z.X#L..uI.f.!.}..G%..0.F...$E..ZWs..a..0(.b.3....I:5cI.)....%07..@..H.&.....&....&R.{....Jz.ma..q...[....%...@..vHz=]....(....h....u.`0.cqn.....%..f..;q)8#.w...g..P........V.C.;.7.A[$E_..2EP\|.J.W..b.r.s..<F-8...SDV.......4..e.....IEND.B`.

C:\ElitechLogWin\Images\Icons\about-us@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	815
Entropy (8bit):	7.594371274102484
Encrypted:	false
SSDEEP:	24:spHpX79jp5XULqAOfvO64ezqNJ9iFuJrX:cZltXXbIIe
MD5:	85F959F5031BBEF05AFBF392AB4D31C4
SHA1:	E1D7AB4078968C731DD27DC72D6E1027DA1C876B
SHA-256:	E1DA12FAA403429D1079B4EF6B7F8B8966C9343C6EE9FE0836276D3C8ECD7EB6
SHA-512:	E43FF5EAC1016BEFB4399FAE3B1711121171101CC5FD2BAF0419E22F56FFEC96AA095D92EBE7E475C00CF5C88971717B2CAC763C5BD27EE18103C2B86F2C2436
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.W.q.P....[..0.D\.+.T`...h8.W`....c..J.&..Bf....X...eYz.J..a...~..o.v\|...V...e...#D..p...#.G"..7_....c.......\.p+.Kwl.E e..k.m".A..3B..g.,....9\.....Dp.JG..'.C.!.l..C.}..g..=..Y@2...y.=..."+.=t.~.7....{.....nC.)y.......,r.Pw..2.x.@......9\|...I].....':....q.@....^..N.R8M..b.\|...+.....\|t.R."...Yw.v\....+.A....0......^...xw<...'..........A,.Q..H...-}.s.c...<.7.9..S].mt..E........'.).:..eA....t2......N#..9.&.J.`.hu2.y....%..........,... ..y.4N..y...M.S"<.B.&#......i.K......6._3..E..: ej m..D....Q.j...,..a[...y.....z.......(...X.s Fp....h..&5.6...3..S&$..E......f.!.%....s..D>....vzR..94...Y......g..>..T<...".qE...F......t..........s...-.{..&}.".3_.e.."...".... .W.2.....$..h...V3&..=X......B.Y....9..* .?...D....IEND.B`.

C:\ElitechLogWin\Images\Icons\audit-refresh@22.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	547
Entropy (8bit):	7.529624444226664
Encrypted:	false
SSDEEP:	12:6v/7d5lyujWB7f4n1CzZy/cuQtt0dihd4xZjbO3PHwQV:CtnOKcOIhIjgPQc
MD5:	F2D6DBCFBFF24860A23A9970AAA8173C
SHA1:	AFABF047AA058E5405DE17E5D90A13A356BFEBE5
SHA-256:	46291B9D50B7AAC3D618FE71AA184766256AEAEBF383E5FDB5A78C9586B3C153
SHA-512:	3420E17BD50D9C3BBBFA994FBA658DD3C6C6FC3EBAAAF13A335D0185BE3137F6FAB85C72ADFDA726C0B8B91FB698EDE536BA7B6011529328AB528525CBE297A2
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK..Q.P..w#.5....W..B......... \..P......... .....!...18......{...p.......j.^U...P.".@..abCfd=.W....,..S.Ny.....RU.;.E.....[P....1m3-.[...b.H.M.\...J&zG../. ".8.-t....".....=....%.6@,...ME.&j..0....d..... Vc..9.a#..O.{.#.n....M..'...,\....?{l....=./v,..l....L..K.cm..............sn.Z?..E.!.V.T6.......4/.Lg..$.)t..Bf].....}._B-....1S.....d.0....e.n....;%s..3.....#.!.aT.0....N...E\l......3o_....=\s>6s...G /.L..9.F...8%=K..F.j....*..<.+$...M.4.....O.%G.\......lG......IEND.B`.

C:\ElitechLogWin\Images\Icons\audit-refresh@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.69382344574231
Encrypted:	false
SSDEEP:	12:6v/7i538P91lvWeqtEjzV/uI7FGZgVVLrTBcV81hY32q3dBOTvajHVIvBL3Zin6V:nKHW+mIh9rTBcVsqKveV6Bgnm9B
MD5:	13BEF9E5A1192875EC8150F9FE044D0E
SHA1:	00410CBBA25AFC46B3A98C3EC38CCA865D0E2AC2
SHA-256:	D866DBE9BD1CC1345C4D16B854F1A41185807DEE095F91BC89A19CFEBE3947D1
SHA-512:	3831499E800A914BF7AA94303A30B39351D03536F8A9EE10A093DB6C1F70026FAA5DA3556F03F17895E8B85B6CD7D35E6DEF450BC0049159AD33895ABA7FCCF4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WKr.@..V.g...@U`k\|......d.,BN`8...........o..H. ..N.Q$....Hf.ri....L?.N.......`}]W..^#b.....!.DX._....Z.9..N.."..T...21 ...o..H...`.`.N....eM.Z..=.-6..z...<~...pV.z..%..j...~.....t...S..g..j.L...n-..`.-\|#.n.<#..3..>.A......R.....d....WsD..?B..Rj.z....e.y.....33.Q.ifw.....P.<..7......R[ ...U.n.Wz..q...F...'+...,.gz1+Yi.t.jG.....c.)B. \=7~h.j...s.....V.`....w".C..S{.(k......a...k._.c../T.7...Z.............d...g.X..&?l......#x..."$Znz.."....:.1....6..j:...c\Dq.t..@....6..1..".Q.....].A.G.;..fx...D.....f.....-.....8....?....Nh.....#...f.......^y..=.......Ca.%.s.h...!...\|...Xo..z1S.HSj....x.5..>../v.]?.}..D..x.;Rl..AVM...r]L&.*X.0!....\...0."!......g.J.=.V..s1p........Il0........IEND.B`.

C:\ElitechLogWin\Images\Icons\audit-sys-event@16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	470
Entropy (8bit):	7.465680157838254
Encrypted:	false
SSDEEP:	12:6v/7c/KtBnW4l6uSjSQRz9QW3po6isKv83s6Dygog7hsAoPLsc:j/KtR/l6uYSO9/pJ3Kk3LnoAqPLsc
MD5:	AF1FC4F7DBEAE8B8CD5223ACCA2A4182
SHA1:	FE95521CEDF4CD517DCC2E25720D326183D86C1C
SHA-256:	30D98169B7883C831BD9AD4A1B5643B4BB61049A9FC8BB41C55E74A44774677C
SHA-512:	3534E19B49B64164B7D7FB38FEC767CD2CFED0AFC6B876E03FC2C408C9D1B6665CD838ECD8A852CA6BED490387F562AC271FAC576F06544A5173ECBC182119C2
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.SMv.A..................0.aC..p.................d.!...K.....~....>.t..>...^.&4.1OI...z.....W'...>..YP.^\}.c.@.;.5.;?.e.2.4........q.. .R.d..]T.y..~$.<..!.I...+..-0.jB.A..).knE,3sJ<m..9.....)a..Y.d.R..;04...7.z............~..\|.........b..\|wmw.....\....)...rt.......W.c......b..~R..nb3F....U.>:Fij..A\|......B...,.<...R'....?..g..AH..F...B.R..a%&K9,e.K(2..?]/.,..). .g....3...QP.......s*....P....D......IEND.B`.

C:\ElitechLogWin\Images\Icons\audit-sys-event@22.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	696
Entropy (8bit):	7.593329488150688
Encrypted:	false
SSDEEP:	12:6v/7ndQZ2uibdyiE1aAEFSN+75a5NxkJZCHflqG0hIkQqYxQOYgOfJRMtaL7D/kS:56bAiEEAd+FaTxkKtqG0hHhYx7PIUElN
MD5:	6E1E29E79723B21613C61A8F461BE0BB
SHA1:	95CFC87FE0D20D8454342F193247DC63A3884BEB
SHA-256:	4C74BB9A36592F2C571F56F7109583ED291713F08E94659096F9422340377230
SHA-512:	9CDE1CDF748E9FBC8208418576CB1A5FE8EADC692981016516A32D37636EA45F06C5C76DC018DC959F9535C336CAAC80BAC7273AAD6DA48DEAC9B84533CECF06
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK.U.q.A..Y.... ...."...E ...O..~X.'20D`..q...X....3..Q....a0R.........e:.vP!.sn..Y..qSM.$.f.=Oc........uI....~x.P....Nv.......w.&.%".0.u/D.f~_.....\|..Ab.f..]P!....~...N........t..4q(.y9..69p..B$...r..w.d....8....D.....r.g.....E..r....Ey\|....x...^SyV..t.p.c.(.k.4}..D..B.........]d..)-..!.:.l.C..d....G(`..%............]r..%..18..=..Q..B.^..l...2-.3..p....y.6._.,2A....D~0..'-...5.h.W.pw..{...l...-.".....x...=.r.n~l.GaT...ic.....6..H.....-..I<...H......D+.#.......N:.[..F:.).P.TD+[b..K+W1...L..F9..fm.......Q......$...D..?&........./...%^Nu...W=....=C........W.T....Xg$. 4P..-..7/.......7}L.=...;.[7=.5..5..k.^f....IEND.B`.

C:\ElitechLogWin\Images\Icons\audit-sys@16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	469
Entropy (8bit):	7.4418666112473595
Encrypted:	false
SSDEEP:	12:6v/7+o5N7uja2aoHryTyMoV7RGE6cKgRE1PLbL0FzIWQIDb:kPSa2aoLyTrKK1jsFzIWQIDb
MD5:	85BA40FA6274813CCE711670A6B66267
SHA1:	5A2798D4BBB79D9BD1A76E1D3CD92AAFC8DDCE2B
SHA-256:	F01F1146D657AFA4781E746D7AEABFF2C2FF0B22A0A15361776E40D60B058AE8
SHA-512:	4DB16EB658857279C6466AA33C1CCE4F5C24B513EB934E309986735DA2D714E0FB1145FE2A607DE3CF1AF9E46009624D1372983024FD74FA50BE5E40015FF892
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.SAN.A...1.....D......?..p._ ...........gL....L.i..vU4D...S]]]-X...q.....?.A"@..M....W.....C..."...x..d...x1........+..G/H....i].m^X.jo....1....WE.A..."`d..3..c.\O .P.N.[m...h.Uu./;...6X..]....jR..oV......4.C..C.v&.....4}..zK.Lo..D..,........K...S.R.{.%.;..zjT..`.....)...Z..._..1...{.#.M.Yh..d...<...b$.}......<.t.@..5.pO.F.>.l.:Z..>.k.....9.....;.?iT.3._-..e..A...V..l.g..J..J....rG..r.^b....IEND.B`.

C:\ElitechLogWin\Images\Icons\audit-sys@22.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	703
Entropy (8bit):	7.672023987976782
Encrypted:	false
SSDEEP:	12:6v/7ZqhECJOXWFsRHkYjmZojoyj6o/AeQEduwsc7F2i7L8gZai8XdyZKkEemXkez:hXz+RTStoCNinWy8p0k6L0
MD5:	FF214497D997DA68FBEAB5B30F293BE5
SHA1:	063668A35F5160DCEDDDA7F75A5CDBD03CF04A20
SHA-256:	6DE46E044C5FBC415A67D34A824B1A5FF9FEAC20D687FBDBC62E4452D0D4A77E
SHA-512:	ABE231CFCEFB37F2B2B05B04802CC7B9A6073D1530B563BE104BE0D3E54AF0D6F808DA06623BA93B0805B92F07348A8081C947A7BE0362188E08A0122DF89F47
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK.UKr.@.}=.&........n.O`...p.;'0..e..!'..l!U...eg@V.[.....gV............f.".......(.[.cb..L..c...x..v.-b\..=........x.....Y.....E...?%U/.e.@.6.1.s.....X<.A..#Yw.........@..,o.........1.2U.'.>.N.6.....^.%.o$.,ky. A.`.i..g...8...b5...... ...h...x......0..0_z.R."....J./\.}.........1e..."..%......!.........=.X.]4K.s..k......s.u'=a.". .`....?=.4..h...a...q.N.S!.g.[...`...(.m...#.."n0..Vr.\|>o..T.....:).f.=R.....o.s..jI.j...Em..H....WN...M.v..b.[.j.....V....X..A.f1.+.=...<T)..J:..m...N....L..J.b.(...qZ.....m.....v*....&.~h.b..`......6...:.mjP..@......(6z...y.0...5.4....w.uF...k...:.}......Ii....<.0.y...../...S^.......IEND.B`.

C:\ElitechLogWin\Images\Icons\audit@16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	475
Entropy (8bit):	7.370137291098814
Encrypted:	false
SSDEEP:	12:6v/7y7jGJBMei1OGG1gmb8JRiV7QtqqwAde:t7jeHR8JRac6Ade
MD5:	AAF818727E1F51710D74848592143616
SHA1:	512B4533C3129CE7CDA507B1324E35631217C1E1
SHA-256:	560DA7FEF60BC5C6F295A9FBF1F9253FCC386E5FDA76BD2C36B9C01D1E51D04F
SHA-512:	6769EC6E84D49750F7DFEA48D48B1A09DEE2C8CBA165799737DF35E17B209A67DC816A5E4742E78989DAD25C81352C9410CFB042449B5952B7DB5A4D01310630
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.SKR.@...8)v...2..........'.N`8.p.o`8.q.;)p.2...'?~J)S5.$.....k..5<.S.....y.E..3$...O./.....H.`.q.}...T=..%..j?s.......q.3F.9D..8`.M...p..z.Sug.S.22......ac...<..:BC.-....h....f.~7.......,..e"......L(...N.......6...[....R.aU..x..I.<pz[9....i..\..G.6.....<o..g.N.A.G...3.pr..J...k;._..xv'q...x.X..R..I.3.>...h$%~EH@!..eB....f\|n.]..O.\/.T.-I9B......I...7.lP&e.dR..f).../.Kxc.......G<..3.8#o.R..8..D..l.7&.....IEND.B`.

C:\ElitechLogWin\Images\Icons\audit@22.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	710
Entropy (8bit):	7.60144390271197
Encrypted:	false
SSDEEP:	12:6v/7LQFePeyEgyKTeSivWIYudRcGB05bUyr3DQbUAFxVvVJt3p35kBtCOz/V5oN:8Qk7NDC0unsnr3jAFxVdJt95kBtC0IN
MD5:	A3A9CCDCB7962C0F5BB20A42FD4C80F9
SHA1:	9B994825AC961302CC74C5C2746A3239F400B751
SHA-256:	25ED3EA81152240CA1EC7B2E8867B43BECC17035388A1F4D3F87DCA73EEC476E
SHA-512:	59EB134BD5E71D5F730BE8DB29B0DAE11CA09056861C756D83CF82BDF4BEC75E5933F1D4EAF0242A6C760860C703E76AA0B16C0A7EBA3DD94C4B6859C751BF1E
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK.UAr.1....LU..c...d8......../.~A...../.yA....r2.K.`r..a'-i.^..LU..h5j.zfZL;.}.....9S.B.J.T3.BC&.....l.e.~.<......D\..~.9.Zg.....6,...........bC.....G..<.1Q....T.B.!..V..D....7.F.&..f\|....=....3..z....A}...{.6....:.ep..yo..7..F..j.V6..bm...W.k.\..."r]..].$......S...p.s:!.......C.f..2.L.2.N.&3.2d.>.......^.=.L.w..jCWT..e}.....2.>Nz.Y2..%.O1r#~.g.@H.)=.<...6......k......IB..`.>.(r.p{..&..8}[0..$..M.....[..o..~..p5..M.0+ta..........Uk.....[.h.2..w..I..bj_.T..%...-.N..vlY...........aB..N...Ja..h.z...$<..o.V4O...5...pc...}..m.X%...Q.J.m.. r.g...4.*..M'n...H..3.>.....-...F...D.}.....mm..<l}.\.....).%.d.+...g..cz6[.w....I.........IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-dataview-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.767458306200851
Encrypted:	false
SSDEEP:	6:6v/lhPKVwcxGNnp6u1NfKOFHZl9Q9I7Dnx2t+p:6v/7iiEoYurF5l9Q2PWs
MD5:	69F06E224954CF456FF9F6A2872E1032
SHA1:	F581732768F4F37108C43BC5CBC0973AB4561785
SHA-256:	4203DA69A6B16255DA9F97D7B636A64D0C32AAB222073744AA5F441AA2D7B1C5
SHA-512:	78D1957E4C15ABA236DC25714FAACB36BFEDF6B78394F9E2F231CF31D5F55BD3E0488D1D30534AD75A5405733DD30CEBEAFF53BF73F309A00B1C5C7599107233
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXGcd.`.8..3.:`p......i.?z.....!H......i.}..#......v..r.....`.L...S...T...:`4.PC`...l......p"..'..0[.n...F..h....5.8.f`.DL...?.......O<..`S..S.q.:.......F)F..6J.........F.......1........GC..]..!{.F.....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-email@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	890
Entropy (8bit):	7.676773138293751
Encrypted:	false
SSDEEP:	24:nJ8lwMb/aiKpEg6DmAZafSHkys1P5GNXp4:ylwa7KpLynsMs16XW
MD5:	58FC884C974D2AA42F5BA900EDAC4114
SHA1:	B0C2DDDA32E72DED12DE78A9EC1AF3AABE2AC2A7
SHA-256:	E7E4A89FDD5BAB821FFAEC4B203BE0B7B0388E7AAC0993551A063072B95DB514
SHA-512:	F4DE6ED3EB860A8045DD95D972A17F7C3DCEA8E6789E64EF692F5090730A1CEDA821D765BF1C55E3286D4D171CE982487A61ECAB965230EE4C59B19FB7913B33
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....AIDATXG.VKR"A....3.i...!l.9......Ka!.@<.........`..m.....Jt......$Z.p#.D....../.......'...n..LGL.y....@.......@.y. .C...,=..,....PD....tX....=..82...r.Z.k..r..wsOn]^...o..l...&Hv[^.!:.....l.=..{....CrAB..J.n...^..pd..g^...`.....[...D.,......b.1...'..o.J.F.v..GX_..w.TTv....Xf L.....\'..TS..n3s...D.%........z.YW.....Z=..Q./g.q./.0Q..XA..6....V........J`.?......$.......r.f.B.FhL.t.....`.R..U.(.Q....y..b\ha...y..u}..).%...3...2L$..;t-...-...U.~0..]5.1...@..&J........i].Rxo...tyU0Q.....}......9..@d..dU\|V..B\|U..jz.md.r.4.>..<.....4.voT...@...-.'q........<......4.y,.\.Z..D....nH...TR1Z/......?.......s.'.a..i]....k..+,...<...F'.....\.AL..KU.Z-Z..b.....T..Y..Q.....{.p.p2....f..T....m.,....+...a.......?..a.cy.u..m.kX....\.Y6.. ...].+t..X13@I..2.....T.6g&..:...gQ.nL...H,.,.........7U.m\d....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-export.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.352453414659275
Encrypted:	false
SSDEEP:	12:6v/7itxpwV2EVzK9MYW7m80lGzIZPjbTF+4upngD7jABNVN:HwVvOMYW7z0lRZPnTF+NpngMXr
MD5:	FBEE6E4349846542F7C7E109ADF47FEF
SHA1:	52B3AF9146EBFC66C39055D5012274E07924CEDB
SHA-256:	D88AC212F26EC336782FE1F4E0F6BB9D953DD0B20475305A74A9D9D9A568DCD7
SHA-512:	B0C52BDDFB5DA9C2EB09D59497673B3CC35AF8CEDB5EFF3FDA93554CE01012E96E9CE31C89C3318FE3B46DB1D9A9C37740B3DD8BFC1D75583840E9A47C673E75
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..m.@...!.@.q.....$.......!.$..t.t.t`_..v...2,$...,..}...Y.Zx...[7..<.....Br........l.q.-..N.(....y.m.w..@o.."....$I.8........(.(..Cn^..].4M_$.....!.D.. ........D......@n.......B....j..n!Bbc...(.$......rA. X......p.4.. ....3.n....=..3...2..U^.%.}...2....>..9.......{'<...R..$.......y;Ni....R.Zqz......}.5.fK.`.O..x%.&.Z.>\..........n7S.A.rNF..c7.Ce.u..X..k>..f...@.B.f&..3...gB...7f.d.Te...ZF..9@o.W../...0........IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-help@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.688963947606658
Encrypted:	false
SSDEEP:	24:04kbEidDRLgaHLrK787GyQanPCR0bh+ua3PQH93P:L96xNfM8qyQaa6OiNP
MD5:	B6B35F7ADBEE59C227E0A5EE6BB8092B
SHA1:	B0A6B1439F08F347560F6F52649C99CB1148347C
SHA-256:	0727FCFE3D312E7FF946525D0ABCA9762EF3E278F6F80C6DF8D2BFBC07AEF3D0
SHA-512:	0A62C2FBE79FA560575BF5DE2AD2786A4F4A9710ADA18FEB82D2846D7902CDCEEBDC170B2E8FF175B2EE96A3B569737A93D56ECF11A0531B5D0C5C430A142815
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....&IDATXG.WAr.@...In.\|.Peq5..............@..c..Dy........@..j'..8BHZ..\...............W......fQ..#b..L..)..h..... ..9..eVf31`...Hp.A..dK....$.&.........\|.....k....P....R....1t.+NZPs.0E..1......X.i....@........K.M..w..\..>.~"..x>a...N...1...xvK....;.. .]6../..\|.L ..{..........hS. .{E..M@...N.:...).u..s..O=.\|....F..@...k)..$9"P..Dh&).4....Y..;....i.....Q...\6K..../.F-............r.T...w.v..f.\|w.t.....aE?..ky.Wx.h.f#..V..,.3..0K...).......7J.'..N..N...\.`..c.(..$...r?y..C...g..C."\.......F.F.\...(.....7.Z>..,V.x.....".fQ..Vt"43.a....W...Y.(.~(..$.... a...H].Yq.E..sIT.Hr.......h.....Z._...M.. ..qh.}...L.x.((.-V..$..w..ZI.R......=.5......;...tm.^....R...m\|........ZJ.K..a..8.P.-...r..w<.8..4~...;...r......\...u...........ZJ..........8.C.6.....\...c.....,A.0...l....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-import-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	602
Entropy (8bit):	7.549829661442623
Encrypted:	false
SSDEEP:	12:6v/7imzIHDi0fbzlXChFF/JcstXMuJ1CXp9atsmOtichnfHil:KIPzqxh1CuOzignPil
MD5:	F16654704153C1231BDED7D39549A17B
SHA1:	6D771D6801D1F55AFAF14F353A39481D5AFF7D89
SHA-256:	961A1D8DDA52384FA04ECE9930DA163525CE1A6E521D389FF3AC8392AA589818
SHA-512:	F4614ADB31B3759C2DE570B924F832B1F9ADE686FBF98D08C93D7AB584C0E9681CB0EE8ACBB6DC386582BF9903B4B2994C7B600B7B04ACBF4DAC4B355AA121FA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....!IDATXG.AR.1.E.G.\:p...x...z.u)l....d........f.B/.9...#.B....-......N#..._.... ... i7.0.UO.>.n..Y.d.).@-.....7.=O.......o....^....v.,D...!...VR].......f..m&.m.h.U.....}...8K....4;g.}.d.."...`...!......).%...L......R78.L&..f...Pf%.C"j.....a.9y].h.4/...k...E.....RS\.B.U.<.i&..m...9).....u.4..W/...-G..J....O..f...k...Z.......]S..Tb.G.oAQ.P.y..16+..FL..'.{j.'j.)c~.#sM)..P.\..2-.r..v0.1........l>.H.......t...]...w.$.;...o9..l.....X....&c.._..&...%...![.0..........J=..w^..1.PN:.+b..ev.....Kh.~^&\&.k...U..+.R..VR.?........IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-mail@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.649037439253414
Encrypted:	false
SSDEEP:	12:6v/7itrdnTCenjIwFGbwu7FJdS9J/0F4raPr8534rtzbMgV4gFy01jR7ChovImYc:v1Tb8bbdMxrNIrBbxVjFB1lGhaOQ9N
MD5:	1167646F8E6943AE344EC19A8204C21C
SHA1:	01F46961E51B31B6E5F1EF569F12C1A8AEAF50A1
SHA-256:	12849AD15EDDFB44933ACCE9E74DEBAACF4715FFCA6DA0327CF9DCA0F7AC5DBD
SHA-512:	1FE46AF9F37F1DC47C8FE98A885EAB95C7F1A39674E815C8B762E787299C648FD2848744B4BB4DF660E309BB3D75044DB9CDA6CFB349DF0D61FAEFA61B7D820A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..Q.@..Q...b.. ...T...SA....DT.i.r...SAH.....i..2....p37.Z.{.vo......G.....H.....=.e!.Y.........r]..K.$3.c..8..\|...;..E....Y.O2...k...p 1....'.......>..m.k(...cae..7.>..Q.n.<.....K>......x.P..)..F...d.....p9..P.7r.oB@.]..uW.....6R......V..S..H]=....jlM.?MN.?....^......&......K.....w......'.o.....[.y.X.g"5..eG..M.U.f.:.^S....w.b'D....Z...85b...&...p].R..$}'...~'..DtD.H...u..\@...D....."PW.63j....jP\|.p...u...t.F&.t.9...v..t..V.X..#....'... .m..Q.r.?zAYW!.;IhLs#....4...V9hz.w9#.5.q&..`0...../.L.........T.F.9...sHA..+...R.}G....._.8v8..+$../\.9.gB..N{rD..f..8..-.`Ktb.....{=.Z=.K...K..).....p.k....&".^1...R..0...g..b.Lr.-<...Fr....x>..\..5...,=k.....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-param@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	650
Entropy (8bit):	7.454678678722653
Encrypted:	false
SSDEEP:	12:6v/7ihY5Yux2K5t4X/XY+ricdZsxSM8jEAm8G/MS16NyMNRXA3G4BR5bAqlEL9:wGux2K5t4xriUhpEAm1MSuNNQG4BR1m
MD5:	3D088AC292002116CB889BA6952EBCCE
SHA1:	989D2D0361C892C16AF59BBAC88E0585C413FA53
SHA-256:	D539EEF6A08B56EC4000EDCF2C8EB359CC4BBC020D4B0038E8C45B7E8C7F1658
SHA-512:	3A1946FCF81280797E79C4FC2DE82584B44F77F696B63C71E757E9BDF0A1DC8DC6F889B936C402216F146279AE8934273B3D82D2D5F9E455FA4D5D2C1BA98D8F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....QIDATXG._..A..9.7.^...b...{.. ..r.....D<[.......E........VR..]....{fyi...`.%...`>..j..\|....8i...N..\|$...A.7N..G.q[....zy-....u.!t.^N..n<.....lgB...C%..u..g...d..2..i!-..-.T...$ ...).D..:5ZG.bC...l..e.,.d%.". ......'....}.A.OA..[.&..w.O9+.z... P..g.....V7.. ....T.J0fZ.P.Ay_..&].8{.....Yn.l@...l...2..7....\|.]`cvtr...LV.k. .{Y......R~ .0.p\|..d.%....YJ.b...[w..`.d..,...BLu..L5....`.&.?..<.:Q].u.6.j).X.C..[~!..F,..h.h.7.7..C...fC...M.%....M.....T.Q.A.A..].M.....).{;..-6..r.=o.....~...CO..u.#^R.J..X....9.4.\|%.9...y..VXN...u.o....OB Frz....y...dR;.<..$2..\|....5.......!...B....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-query-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.608114171662278
Encrypted:	false
SSDEEP:	12:6v/7iLedqEU6PO6Gma23Bg0Eia5oULswSf3h3pLEzrsqQ3Q061e7o/KMdV:9edqWDr8itnwSfR0sqQvmT
MD5:	3B1ADC4D52116ADFE997951F790ECED9
SHA1:	368BA1DF8C646EEACC5774DED46ECACF71C8826F
SHA-256:	395B45097B0022DCC0D8A6439FB65574F4A3BC78E746B591BBE5871F059583E8
SHA-512:	E75F2523C016BA4295158913D6AEC5C78A32E4179BB5BC0D11F101FD35360342FA3485EB68B5FC6DB7244DF89D78E42FE7C517C92C787B82C42EE7F0EFD1A7CF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....WIDATXG.Ar.@.E.Ue......,.!'...9.x.ia8A......r.8'07..E......)O.[AX&...M.E..hf.t...B..{..^..;....;..."2.4'.Oi......z8....r'.H.^...<..4.!.<.......x.I......O"...$....(..`...Tqa..t....~........._.S[......F.).......@.&R...tp...X...X[\!bK..R...N.q.....5....CX.4&.c>.".P..Z.....D"....o.....\..\|.$..B8)..@#.E.......I<.:I.f/.....qV..LDJ...e....L...HwZ.....:...q..........(+B..E.3..]...m5....V.2.F.X....../}.F@fgR.f1.N.=.a...L.e.T...r.......Ik..Sp.f........Y........... _.oMP/.cn..}..1.W.W xx...`.De.m9-.. 4.d\|..l.U.<.. v.....@..s..S.-W.7..\..?../..M...$..V%..\|S..Ms...)Z...5.r..v....6..0.D\....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-query@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	780
Entropy (8bit):	7.649232897330324
Encrypted:	false
SSDEEP:	24:50P6hj2HMC7yvOIF5Dg2ufJebGjSxsBnykWr5DXd:o6hj2Tm3yOmBnrsLd
MD5:	285AE9EF7B55D0EC4C1EC3CC7846D40B
SHA1:	075B6339435B667E4BA4D6E96FF7A43FAA578479
SHA-256:	1EA6ED3EF7BEA93BD0B789347F7A92E3211901A81B43560081D8C0954991A8A9
SHA-512:	C467D7670F15FDA09D0439E50FB272E25657F7668698BAC12E7496CE291DD79EB31816C3A3CDD68A19EC95139163F4134C376D41DD8A60B7BEDB5EF23D7D771F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAv.0..Q....@.^....... t....BN.Y@.!'(=A.....^...YRx...m.1...c.o.d..?.....G~.....p:....5tJ.N`...8.w9..P...e...=O..Jh.k+.p.....z.w...$......u6....d....^..3.5A..p...X. .....%..................y.`.`.....# ..l:....;..@.f8..lwL...W...C..x......d:c..Y.}.w........h.3n..%B.r..u.d..!.jG.l{..E<.......Y"...........V>".t.p8~..rT3..-....y..Z:..O.........!."C...._=.Wc.;......4C...".S.f.E....U5v.is4... x.D.8."._y....,P....!...X..R..D.1.'.:(.%...d1..@3u...6..9.p..u.......QA.^....]b.+-<..\z......S...lTq...@QL._.<.E.i.mh...,........W.;,8.Q!.M..2..(.....33@WG..B*.7..d......!.......d;.m)../EwgAp..ch.-p.6..Zz.I.D.T3..gt....x....Ob.6...y..........!j..%8(.....7.!....-.$p.n..l/}..CK\.fG......0C.......IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-save-gray.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	7.6306628995991295
Encrypted:	false
SSDEEP:	12:6v/7iHHRhomN8KnaLP7rcJu1aNJH0Rl/77zcfPzNp2YOFHVSGK/8durU6PhFCVlV:JHRhhba7IukHRpGn82n65FkP
MD5:	7ED8E819EAF45FA3F8D4C69E37EF752A
SHA1:	321908EB98B1219A9CB8D60D14E6868B84AF2473
SHA-256:	F4F114F3548674AE0B2B4BC5EC6B37C1D7BC17FFAAF80B7DCBA3A21835B876D6
SHA-512:	B8F75B5129FBC954EA647D1622F919FFDB95525073B3C130311539EFEC8E4D08EDC2587D5F9065F298076A30250DA90EC1A018686A410522ABEB16C29F9CCFC2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.W.m.@.. .........:.T.x....B..:.......B.t@. ...9....;.$.a.wfw...F...1~&...tj.N..a.........w}>..xf.z..n`Z.&.I.._..........".>...+p...V..q....r.........i..&...A...[e.$....".....v.......F.)D.c.Pkr9\|..=).!..._...D....v<....P...s'9#QZ..L`...i....P(...~..O.'mQ...#.j..&8.:...'...\........I...C.3.yE..d#.p..1...p..........l6.F...b......fX...~.(.Y....-.. . .@J]p.m..n........m.HH.....r...i@I.Zp.S. J."..N.B.#..a..E....l6+v:...T...; O..O......5..^.N...cy0.l<..(..UDA...X....R.......Z.-.....y J.I.y..e.n..p.....(..SV.x.}.H.......j8..J..L.d.Ll..4.........F....JN..K...!^.=.WP.P5..h../.feRJq.Q[...`....d..dt......67'..!.O0.s......IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-save-green.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.598988990039078
Encrypted:	false
SSDEEP:	12:6v/7iNtteLt+vIEOiTC/ZVQqAbL4ndoWvf2otRpFXluE+q7ijZX2KwTl8wvSVfiH:DhvIEO3/ZVpAbq1GoNXAq7oZ48DCBN
MD5:	0E2DBE170A8FA57C1471E822DB666818
SHA1:	78828A1457656B26F3479EDEB6A18A8DCAEE27B9
SHA-256:	C4AE7440D34809875327CD287BB0FF7AEB7332889F21BB2A84BE110BD2A94B2D
SHA-512:	1F976C896F318423C9FDA8131A9C319EAF511DF086C754C007008A95AFD24E1641421BFB816FD2705CB03E89AEF110DF0D8BEA976FCE24F6C59411D1F4559C62
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.]r.0..W..uOPr.B.....4..JOPr.2.....=..{...JOP......=...13x&3....].w.bt.].?5...>IvC.z.X..{:.E$H....@\|Z......m.wD.;^.....T31\<.....N{$..3.......\|g...xo....S..Hl...#Gb..T.S...3._NuZ....Z.....@..u..K.3.9 ..Q..w...sF..RJ.b......h.....+.....kO....r..+.......p.x.H.../i.P.b....gRn..\......\.8.'ZH3.m&s.... ...\.Fi> .3...`.".....8?..W../....0..,bAQL.2S..]...H{A.e....2........#.B..Z.3..q.Jr...~..U.q.L.. r..&...-g...V.$.[.8.M.GE.. ..H.]........U..X.2...X.5o.<...e..`;....+.l+=.......s.M...}...Up..,.`.c.....yq...[wD.`V..;U.....fr.]1q....;...Z...j:_.%.\.:..j8...f".....#..M.uc.....z.8j]n..UL{....p"..n.Zl.EgUSp1.'..#h..e..qfP.Xf.f.0.3.{...&M.%k..\.6}.......a0._......IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-save-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	491
Entropy (8bit):	7.388359908709326
Encrypted:	false
SSDEEP:	12:6v/7isHAPsi8iT5zyvXKrIropWC0yf7SvMWt7uNvynDBMYAxu1Ft:5si8ihyvarNp50yfGYN0BRAqt
MD5:	046EEC8CC220822470BD1422977810A0
SHA1:	A87F24B1CCC118C7DB55367F4D1059D826E8B94E
SHA-256:	8C64652D581623953ABEE622FB3E01C357DF118EA38B6C0FF69640977086F9A8
SHA-512:	89A7D242632B67461875092D92F0F48B871ED19270354C3AE03BAE9D0EFC785016E4A7C0F684FEA18B4B292D7209EA598C7F5AF84C140123480C2587542FB83D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.KR.@..{......f'...7...R..N`8.VY.Ro.7.N .@.....(..'$..$..,2+(....LO7.5/...k.e.r.iqm}.....0,..`..Sx......>..N\ .+...$......s.^Ck...l..k.e.6nr....Jp.\|...7..`.......W..[... @}_7...VA........0.}X.."...u....s>V...n.gT..c-...o.....t.JB^nAS\..b.B..X.......k.q0.....D.".....f......D...d..8.N..z/Iw...=....W..'..C..]....2.2.2.6K.1.......J..pX87;..I.v<j....-.de......E.o.......Bg...g....1iQG\u.E.#...d.Z...O.E...........0m.......IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-summary@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	474
Entropy (8bit):	7.392245123665088
Encrypted:	false
SSDEEP:	12:6v/7ivAh+s4LoLaaosm3v2hEvwA839udp8OGc5I/HONmH2Xsc:BA1IouCGz8tudIPvAI2Xsc
MD5:	B8DA427255BBF1016F9B18C3A30C477E
SHA1:	359E029583A101B77E667D78AD1164CF6AF68FDD
SHA-256:	318C954225F12C665E285DD4A5D92930C5F3EA461810E65C1EA5290B57BFF544
SHA-512:	D64CF08B063FA19C2440854AED5107A6B60A9DBFC34DD30CC1510FDE5853D60727F030907AFA1B113331D98ED3DEF20804C7B2E1ADE0AA7875208C8054E64B0E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.M.0.E........e...2.0.... .......t.`...%.jb'...a.+Ml....&w...c>...6.."u#\........$\|.6C.8\|...F`.fG.../l@..^Z..O....]...7DP.@8sJ..j=..P!.sG....(...+K...0...M....C.=k......B.......$....x.. pnU(I..^s.HP..$;.J..X.7...j.....C`.#+.Y.........:......G0.Al.?.d.H...G..W1.5.[vP....%+.7...b.#-r.8.;.;EC..(......w.,L..}.NS.E)....&.Q#...o..:$@Y...v.M... z.lkL\.......6'7...9.kFWkF....9...M@$....@...6&.....!...x....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-sys-setting@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	7.750752700425879
Encrypted:	false
SSDEEP:	24:aCKKx0dAzuqlhYVSE14dq6PLrOmWqd3bX/ZojVy3D/aWejXI:aCKZKzblhTo6PHxBopy3jaWeLI
MD5:	C09CDC57CACCD16725246852EA1F93FC
SHA1:	BA25C0B52599CA6E520A155FF7D9D08955E9DF07
SHA-256:	72BD5797EE6AB106EC6CAB7A599F05F362E47B197A5CF266F98E3E104C33EFD6
SHA-512:	B88EF9A9B9B3ACDDE8255A9ED30607AD171D92C249913861A61CBA3888022D81D48F901B111328FB2E423FE8CA94442E6051842DA467AC9DF08036F2E9A84F91
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAV.A............JN.<A...Ka.<A....d.. .......=..`\.yS........Y(.]U.....2...s}..@x6.ygv...>._...d?.dS........}..!...$j.;..@wK...5a........}.7...{....q.\|..B.%.....Vr.0To?...&d./1.}....U....H.'.HC.....L...@x....f.0..x...3...Yi.T...k0SK..q.@x..{...,i.P...{[...xZ...F...v..v...... .<..B7O.T..T..X......f.....l.AAAr..d.e.k.9&.. #.T.......t3...h.*.}.51...."..O7q.S.../...@r...r.0t...;...R.t.t....^........>...d.NJ`..3{m...;f#....n.S..<t....Uy.9..i ...(ZI..8........r..H..[..c..}..t..q.........pv!=O...5a.G...4.5.@}.:.F.4.u......,.._.b..A.,t.W.......}s.z..0..&.~.J..@.H.e.w...0w.e...z...< 1.k........!b.-S..s'..;fzi.b.`..4.o.1.t..L.K..4_#....9!.....%.c!...a.../w.........=...dZ+f.D.W.j.OI9.4+f....@..<..%.{g.MG9.r........l...\..4$~.2...... ............z.]k.8...{.......1_.#U"....yZ..(.. .v\R\|........av...9P/.?..R.W...L..&l.so..2 ........n....SV._......K:...._z....p.n...I.1S.....V..@.X/.v....9...X.....K.......k?

C:\ElitechLogWin\Images\Icons\btn-toggle-down.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.873772094374294
Encrypted:	false
SSDEEP:	6:6v/lhPKNQEk9AroCp2vR/6fE89FywRqDZ/m0hN/7BxjQj2U/bp:6v/7i6nAkqRnMkqDZ/m+ns9
MD5:	DC8E90A99670B7C52FA4FB9AC9338122
SHA1:	04C5EDBE7E890C21C36EF77BDED6BEBF30740307
SHA-256:	B231448C2AC9CF3AC36BA688EEECF3B731EC2DFC59AC79AD3E0839F541580B10
SHA-512:	939352268694FDD2751A3BDE275C2C3D7D99DDC1B94BD823F8E24A4C32ED256ED8041269AAAE8068411814110BD1191188D9285F6EBE1FB6AB6AF6630F671FF5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..A.. ..a.B..K..4...d..+.L ...y..B7...?M.x.0b..L.!.Wfxf.....).)..EP.}\|[..0.r....P...............-.*.%."...q....k......B.....7.c........iQ..Z.Grn.._.....\...e..W..Q.W.....W...-..X....V..7.P.%n.h.k....L....l...!.z>^-G.....!.Q7p....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-toggle-normal.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.704253992728635
Encrypted:	false
SSDEEP:	6:6v/lhPKDP1YYPXWNx3kxLH4tCBSuc1VUyHnM0Qjp:6v/7ir1JPkCxLH4tiSLUyHeN
MD5:	51872103A21ABB62845FEC55A8B1C751
SHA1:	230726F93D462D98A235200229674EAE58CCC866
SHA-256:	66F1A3CA82A0EFF3D29D5AF938F71927E47337C2B8583FA73CEAF65270DA85F9
SHA-512:	E37F0CF0F415DF4AA695F856A3A6787D477ECCC719B493B0AA1141F2F63D1D6008D9FAD3CE5F5576748178D42B94351E4D160151FA8EEF8595E2964E4C445EDA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.... .......<5.+E.....2..,.}X..{u.....SJ.2L)...7....R6.!.....T.....AP.V....H....L8...J8.h.z.QD.0".A..F.G.....-D.....[....:0.F...ve..0:........".AD.>..p}.......X..N.P..N."....j.%\...qz.'._}.{....!.C.....IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-toggle-up.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.837272920124565
Encrypted:	false
SSDEEP:	6:6v/lhPKyQEk9Qz+IfnnSnKy2t2x8wTTssYuhbRpf1bA9K9Esto0Hlp:6v/7iHnQKcnLBtuQK9EGo0HL
MD5:	840557465A1CA133EBE26C3FEF085315
SHA1:	26D1A35ECAC449912368B2E343CB020143D13361
SHA-256:	B94A0D1072846FF2246A174022C95D05C522EDD56B399145BD66A639C541EEF9
SHA-512:	CB62B0F3A4EABFB9C3BDD9806D17D07FB5C705CE01E4FE818D936773ED7FB0B32B5D7AC13653EF2DE6488868A228294199378E05E2BEF660C4B582CED0D6BD73
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..A.. ..a.B..K..4...d..+.L ...y..B7....b...u.?&..._.Y...../.O.O..,........3 .oA...8...H.A@.K.P.L...Z.(....G.Y@....\..!..=....;0v..v .8y..O..+.4.................R....{ jq......E q.`E.q..EX.f....)@...i......B....r....E.!7.......IEND.B`.

C:\ElitechLogWin\Images\Icons\btn-user@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.5643971318787475
Encrypted:	false
SSDEEP:	12:6v/7ih0nNtrHACVArGO6MsJAoDGM6j8oo57xGsMWlhad1ysado8m1:MjgCVArGOGjGHQvxGsejyfSb
MD5:	083D684760A548BB3FF1A1671CE756BC
SHA1:	FADEF4DD58B48A64CD3091B77828FA6AF79E1200
SHA-256:	7B861BB29824C3B3EA08AE1D6F031E5DACB55586F02DD5E7F840FAE140D9C20C
SHA-512:	2518E83FD08F59D60F63164A850848C6D9D83B4DCAB1D9425333A980DFE1607235162B13828B227D9981E3F0B2FE671471C5725808226279061E289445B00433
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Ar.@.E.....@..6p..... xi..>.........!'.9A....\|.4[l.N..Q.%1.,.X+A._...=.G~.....`/.......G .'%D...y..U.kIw.p......p.vf .A.N..Uu&.....s....k..z.r.i .?.+..!t.X......I D.I.......N+OjS.,.......S.. D..~8.$M.....+....U..p.....c..$#..}....'..=.m.V.8.!g_.l.u..)..1.b.u..a.A.M..;.0v........N.q.@)....nw..O......,)..O.p.9...R=..A.$=.T.I....6...e....V.......1..\.i)..1....8....`.&...}.!...)...&.....8!"......L.K...]c..Kf..`.\.1..!4....]........].%.H..".....6...^Y"x..c..3.kB..._T.c(..W...RNw}.&.'&...l..=.r...'.dm;N.}^.&.n./6.....e..)....j^C...........U+i..~.d'.a.......&..W.<G.L.R_6HD...,...Z.^osO&..w.<.ms!..m@.%.X.......v$2"I.}...]....O0.Qm.....IEND.B`.

C:\ElitechLogWin\Images\Icons\cloud.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 51 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	7.8512021042817235
Encrypted:	false
SSDEEP:	48:GZZUbQnzWCwYgOe4232+znv9akMr57GvzCbxIrqN1dv6NCIJ6Tu76:XbWWRYgN4826nY97Gvunmk
MD5:	A1991CBFBBB4DBD7A6CDE1563B7A6F88
SHA1:	F9DB5A4297492093DEE27F4A74B8CBD55FA50F3C
SHA-256:	74697ADAD8D87D0B3D459E59A75041B8FC214279994CEC09CBF7A7F5218C427A
SHA-512:	5717BA71A40BC96E97F9F7AC5307D20FE3057C3223CC314B8B3DF5C0C069C94C091424D3707B36AA4E7881EEF5448F1C2C7486D3A0C05774DEBFF5CE207FD7F4
Malicious:	false
Preview:	.PNG........IHDR...3... .......@....$IDATXG.X{pT.........c.......-..p....ma.1..-CA.d7.`A.."O.@ d.q.Z.iy.....:..%ul.. (...n.;.....lHH.Bz....~.....<........i..MB&.0.`.........`Mk....3.. .cxj.<.m7A...Q..9..$......0.&j..;....`.n.~'....@...M..s...>2".......35J5.._].8.5L....#...\.....B."..&C..;1....j.......R..j...2.F.kFk......3.\|....-..9......>S.n..h..._...d.....%...1..l....c.H....V..~68..........J..rr.](.....=.?..W.29......d}... g.mLn.2.9.sD. ...#RK`v&..4......l...eN..&.4.......B.T..}.q..J...$...R`.....8..W=..^0.../8U../....Z(....}.......K.;.p...Y.As..,B_$^f.y.J.U'...x....w..BF....F.d<fl....x9.4.85._.........V00..f.d\|f..&.k.m......../.=(.x+d.9..Lml..%.4p. .%..2'`...b.4..@.....)...s..5..B*D.FZ......;.+..$FB.j..%..}}.e....)...&...4..m..)....q...1.O.....$.%...a.6G1.5c..lP.../.y..T..R~..x9ll$.'.V..p#..=..yt..t.......+............SF ....m.qkU...{../..&.7...M......m...B;Bp.....'.F...."..5.[@..A.i<q....X.]..C...... .A...&9.mU.Mu.)4....

C:\ElitechLogWin\Images\Icons\connected.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	561
Entropy (8bit):	7.502991107969295
Encrypted:	false
SSDEEP:	12:6v/7ibiR+xn8R199AuYFQHVIKmWk/PM7QXcBODOXPXLHTin6HVUWhQ:pkoe1YFQH8WkMXeOrTindWW
MD5:	6A65D02A325EE5237F3EBD141691EC9E
SHA1:	96B58BB21F0E9130F33E9D4AC219CBB3FC3C7D61
SHA-256:	7815EDC91F7D1141D53AFF385D83A4033ACC57DA5A5F2A3DAE1C762383B0DE74
SHA-512:	56ACC6164C39738BECD0E0F6B78C910FC351EA25B81876205B7147F508C44A36E6475543132B56A74246F8D7CDCECDA3FE32C57868A8D3696F836619B9696F36
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.VKN.A.}.k...........4~..@=......5........C..{..3`z...X...]U._U......p~......@:..7...B..,.s. ._.....up.5..u.v....`.:8....jG.y...&x....3..$s;.A...Y...a#Z.J.(.....sZ...k..L%QT}o....d5a........e...0..5....D........._.v.oB.<..T....<?.~...]DQ.[...@...!..x%.. ...bV.......n..2.$ul..JX.a...m.YY{W{.........(.P...w...l.v}... .'{.{n..Y..XR>.(.Rb9fE3..yjVJ.~/.9..q....7j.M..@..X....%V....%.J..m.v......n......}p.!.,.NG..\|......c......zFt2...5,..h...S"...r?.^...os.......z.3Q../3g.....OD...k......IEND.B`.

C:\ElitechLogWin\Images\Icons\elitech.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	2.6137809854184813
Encrypted:	false
SSDEEP:	48:9OUMfMQoo8Hl29utsIvXv/+TQgW6kX3FMt1Le0otP:9cX8F29umYvvRVUBeTP
MD5:	C7289EE7D185C1D8E535E2E3DC7162C3
SHA1:	92FA40B8036F0D78582565695ECCDAE9EBD8BE76
SHA-256:	8BB97D0A3226702D409D8D399499993CC0E6B73C0D398046E8E5A526013C468B
SHA-512:	AF4C7FE927655639EBF7CC05FCBBB61DA3F3B9A7657028A274735F052A4BC5FE22B725D4FC211AB1286BBB3C76D987D84A91CA53398A31100BFAA44CBD570045
Malicious:	false
Preview:	......00.... ..%......(...0...`..... ......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Images\Icons\elitech.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	7.815751368541433
Encrypted:	false
SSDEEP:	48:R4vONDdOZIVbdSRqjmqg7kiVBYgGDdQiCsX/lUi0RqgZatRc7nVz:jND4ZIV4qjmfkoBWdQuvGHz7Vz
MD5:	EEC9ABE37ACEA108219B920F8314C27F
SHA1:	50CD3A0F1D9E654A8FD20BB0B49BE476DB27B15D
SHA-256:	F756D6EC8516BF90CDED07CB5D23493C0556B97F265CB56AF1F1AE6D48E8828D
SHA-512:	B87C96BFEE8CDFC9F011449427AE13A8B61CD7E7316F187BEA4F23E42DFC47DEF956EF3A0E0C8D0A32419583329137441E7533A174D8B1006C2C92B939930162
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB........YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y...]IDATh..{p......f7.l^<...!..[.Ly..[[.....PdZj. .Nce.V.h;2...t..V.(.8...(Z...L..S.R.`..&m.....$...~..d7..fwC:.393...~..{...s....`0h.f._......\i.Nx`...9.I...^..^..C.b......u..A2..:....$..1....Sjw~...S;.........<...}.....aT...R.....X..0..y.<...x.~..0L..).`-....%./..j..L.p...a...Ji........N.:L h.:m.s.......<.../MB.RB...Y...5K..@:.O.w.....X.=...7.q..U.......?.tt4..+......,......p....F@.m.A...X....JY..tbx.t..K<..oJ..nNj.s...9...{w...)]....\.'....6b......=Jy4...e..R....x/..+..2.f.O?w.#.-.\|..8..{R........=...[<..`.O.7.n-1..(r....\|6.N...S..4D...TVB./..E.l....

C:\ElitechLogWin\Images\Icons\elitechLogo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1030 x 249, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11435
Entropy (8bit):	7.837482650219245
Encrypted:	false
SSDEEP:	192:80+8JW4ls+RrYZ9vBhjfrL6XCDzjPqGcDGRrQi7CUDZdplp17XgQ3Xj:NzPriNq4zjHcDGJZviIj
MD5:	DF5983FEF86D41E19726F764F9F706AD
SHA1:	4847FB5BE5C1078333A3306424623845845B5DBC
SHA-256:	3BBBCD21C9C76008967BC85E920252210D372E14C1189281F85DD7FAB69F1C8D
SHA-512:	781C5337666726261D61479A562B9029641EBE0EBD5027A77407B73BE328D3DEAFE63A6519B9699D20A8765AFC3C713DDBA3C5C2EFAF215783E01FFABA6CB73D
Malicious:	false
Preview:	.PNG........IHDR...............7...,rIDATx......u.q..=.<.&4.{..QCf..e..h.:.0...A..@.H...M.. ..q!cS.Q\.t*... .m..\...T%K.].tus...~.w..>.. ...{.....k=...........z.!.....@..............@..............@..............@..............@..............@..............@..............@...... .?\|.'.7A........O.....~......;........... ~.w.]........!........G?..............C...?7.H`@.....Z.......C.................i..I..........P.?....h...}....?~F....?..!..-........$a.......7..7....;..!...........,H$..uH..}w.Q`...y.s... .......@..]e.k....i...............Ax.(.7.........}..3........a......3...m..-...2@..{Kq........m..C..U..T.D5.V.A.....(+.l]..Le.V........ -7......8.EZ.......HI...T).F.Y=..n}0................k........ ............"..w...G......`.?\|.'{.....;......0...{K........".....w.?..\|.;...!...y...3.........M.....G...V-.R...........H.-pJ?.R.@.......>[...............j........?.o..j`..........}&}..........;......~..U......I......0.....h...a.....q.?.g....D.S.......&....

C:\ElitechLogWin\Images\Icons\export-elt-x64.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1491
Entropy (8bit):	7.748008058803004
Encrypted:	false
SSDEEP:	24:z3WyIJO1jFISqBdhSamh++bNgA+ALUB9uOll8t4shCLErMT6mmVvGWfmE3/:zmXsynB0bRleUOlC1hCQrMT6mmVv93/
MD5:	16DA74EC8F1482B09EE8E547D79602C7
SHA1:	C4AB25D816D61483C684814FAB46CB8C7F769085
SHA-256:	B7BC1FDB5C979414C0B5536C35373ADDC5129267A3FB16335AEA6CC801810478
SHA-512:	BDA0CC80D2413220800444835F2EAA21186718A735D7129A689AF0B49E19B97E91DB4E66A70D0121B804DE3373F97D93ACB69030D6B2862BADB25F4FA11D13E0
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..kh\E...B.E$..B.......R.T..(R. ...&m.l..-&...4.6M.D........+..A...j..I.c........?.....6...{..rw....9gf....d.f...M.h.i.i.._{kJ...I.......I.H.H.!.....6$$Y...@O.....`.(..o.!.[....tQ. ../$.....x..9......A.e..)...9...5{G............ii..9.@........H.W......9.J...........3.::.......!k..r$.!.8.....7...?b..80..'..... ......YU..`;.{E2.....;..dt.z...!,M..,~0..8..d,t]=....)........ ..Y+.......... .....J....0...... ...Ho.....x ......Y..a...!x.@0..1..t....q..CX~'....\|..t...!.V1.b.B.`.<..@..Q9...0C(c........^H%#G...ae.A.....=..tR.x...P.....u.S......F..8y...y8.....TM....P@}..t\.....R.3.;....mBU...[..../X.X...X..!,.A..x.2..g"..x.P.q ..<.q`9..2....G9.f$.g,..]....@F.x..<u...\..........p........k.........wQ...?..M.g.C.X.#.a.o+......AU.:.Q6.\|.Qm..C.{.u}.I.........q^mx.g.......?....;..Fatu..I6t....l;C..7.....?l..#$....G_...i....m...h8T.i.....W.ro_..{.<.Z.xJ.....L.e.@..[.R..7.h.A..Q7..j.V.0..1]PW.......6.oK...s....

C:\ElitechLogWin\Images\Icons\export-excel-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	624
Entropy (8bit):	7.444335907239522
Encrypted:	false
SSDEEP:	12:6v/7i+2reNByZGEv7SxEheQrXTwNdSnpLcGKPrUqFrE4CloBpRb1:s2iNG3v7AceQrjw3SnpjKzxjPBpp1
MD5:	4952344E16B525DEE69196BC3CD579C3
SHA1:	471AF6BCBE5526100D817290CE8C1FE161A710EB
SHA-256:	90B705137272C554E8C31F184281DE091427601AF1612786C01C4FE93F60B3CB
SHA-512:	44C4DD8F26C3AE9DECF176EA209B50199FF02E57EC194A9D695DFECF5087D476D147292691BB58666EBFAF06310640FD8CD5F4505B8D3C8E0F9B57A71A52D510
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....7IDATXGcd......,.......`b..Rf_..c.j.(.D.~F."..........OM.F........j.hE?$d....."..RL.<........<%..4s..7....y.T.@.....OS..,=...#KIc..s.....1.7P.......R\....@.Ywg.`U.s...D9....M..av<.?.S.)........,e.c......!....@.....A.G.....#&.......Z..V.:`4.FC`4....7......F..O\.K...G.-1....L.8....0\zs.A.hp.Q&C.&.P.."P.$........./..f...b.>7.....r....%..'{.4.Pl...;.X@..@.)..3...?...16....3.B.........{..D;.d0.....a..E`.bs...V.&`....)....3u..A.J..x?.L......wX....(!"....!*.........x....__......-.Q ...!/..a......r.....u.....juN......o...........s.....!.s...?.?.`.E.j.I0........IEND.B`.

C:\ElitechLogWin\Images\Icons\export-excel-x64.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.743624362063275
Encrypted:	false
SSDEEP:	24:M1CQBrcoBuAoJaqLnrFBLZlY10+BeeNDciqPsfGZzRxPpTA2q04Rm71IpOKcX:wc3nHLnH80UPoiMsfGZV7K0SOPX
MD5:	F17879B0C2A44C07CF8623F43E7371C8
SHA1:	00D56425410DCEB6FD23A7D6A68921FF78DC9828
SHA-256:	C562B3C7F5A56D0149B42ABC9DA31F0767A477F4F119967ADDE0FBA7F67979F1
SHA-512:	2619D87EA80FC4467FE44B39D44977A8614582DFAFCFD4BBA3C9A9571A77B5CA048E88D61DF2EBED09E028B7E4C13EB210E8458661FCA08380B65DEB98BB360F
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.[l.U......J...z.M.D.....T. m.Da..JS.qM.F..5....mb.a!..-.6([$...P....^....F....-.[;.....lwv...,.$..s...;...E..mq...$.M.......+.\|.}u~...XO2..4P..$.5..Z....}........r.....$Q..A'j.....o.4g...:..^l.$i9.E...<;..h...rC.s..:....2..y..p-4H;....:_..c~.....!...._*..LS..l..'......./..:.%[JjNZ..[.........(zw..n+.l..J...v....3.....BH...@H...p.....tn.ks5_1k.I..J..8.\|"........x..9{...Ig.L..m.,.^X...-.4.n....t.]..?.1......T6..`@...-.LN.}.[....-.@...+....-C..... m.`T...S.iM.+.....M?....`.Z........A9....4r.;;&.P..5E.T[.`...(4<...tn_yh....b.8l@.F. )\..%.... b...".j..: <.$.1.).h.H."..4(.H."..$ ..Q.........)i...?..4,...ed.._.9............O}W.M..61.J....f<O.....\|O.. xZo.......S...rV=...r...Y.m....?}.M.q.s...$.2yO.7fw......K?./..4(.4..qD!.e9...uj..}..ygM.W...=..j;...W.!p...`.....X............m.....s.;.m....f.g<:\.`!...`..../.Or./.P..u:9..........e.A...3.X...N....7.....e@q..D...[...i.-.F.;.t~......F..WQ.b.h..7..;..UL

C:\ElitechLogWin\Images\Icons\export-pdf-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.431091159634797
Encrypted:	false
SSDEEP:	12:6v/7itBXnNxUK0sMIsG0lHmVrWc/unX9XQywnhk9bPFRjp2Afs7yrLpium:D17UK0sMMdhWOmXpQrnhk9Pwyfpi1
MD5:	A17E9E22E63E3A83682DBD9E2112BA6A
SHA1:	99CF1E38E46F68F3DCBB05A1A44F7C93B6EEC839
SHA-256:	85C1F43D474C032EDE5FC23880C43D5233AD20D7E4D7729AEFDA1CEE3236BBC6
SHA-512:	4DA41B6D8FF1B2AA31244820648C47EF97A8BC26E83D81C2CF2289462C358AF1F77592198182B43BB53C098DB8EB67BB24C616D55FEE2EE267F9BA97E6F3166F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....*IDATXGcd..~..........`b..&...?>~d.?g.%b.3..u.Kn`dd.'F.>5V%..j~~.o.Z.i]S.yp..HH.'...y..,.....C.#h...c.q.M..r.={.).....=.;.d.....(9:.bs.]....Tw.aJ..Ss#....\|....CdI.;.GZ.!..)....esu..S`......j.!...&....8.d....5......:$e....4s..B...Q....h........=........D...v..0h..1..h3\|z..A.....c..{..j..ax\|.8..<...@$.$...2(.l......1..V`.f.H..+`."..JQ...}.u`.....6&%3..8..2.i)..)dH=}....p.a!..1D.....+W...........(.T<<....3........O`...Q.......9....!l.j...E`.......A..T<.......9...@..9=.Kx........%.....juN......o,}.......A..?....C.....,?.'.~.......j=0........IEND.B`.

C:\ElitechLogWin\Images\Icons\export-pdf-x64.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.732042945432951
Encrypted:	false
SSDEEP:	24:jpZ0SARuJRj3AvXvjFTnZdqbgV0jEQj1+NujwIC1yf:30nRIe7FTnZdqbgbQjo2w1A
MD5:	9A996D34FFF0F95B4000DC5C11B3058B
SHA1:	82040CE12A720D73A769045D9CAE754E07809556
SHA-256:	0626DC9D2A01B486FEAA75603296DC9861DFB9C17AE2951C5998BCEF305C81A9
SHA-512:	722BF6DBB758564280409A89B6F5C6C8EB9965D9A79A4E9D33DA1E553934831DB51AA9B865141412F89D3DA903CBB3F827E845C3D228000E58021B9372D130A8
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.{HSQ....Q...G6.Q....X...V...Q...4.AY.....R...e.T...+.!... [....r..w{....7...v....:.....;....\|.w...vD&.b8f.0.r.>.../..f....1..V.d.9.P.........t^lh..6O...?./........(.}.........Ht.e...J..0L...D..../ x....."......P..S....e.......\..k.[.j#.@$.4Z............._mUU.9....l.........=.iSg.....BL...B..@......./......'...4.EK............q\vVP.............._..`.......w...'H..y....M.!....D...II..AGX..A ...1iU.,;V.6......B.....'.T..?....A.m6.8y.`nii..0Q.p._~.......7.R...o^..........9y..^...Bm.....N...j.....-...[ \O..@....4.. .F....t.....My..h..i..A..i..i./.Z..:@@..BA~$58>..&+<.Y...nc..0_}M....<... .'..zC@.>..5..<..u.k2AS..0......k5....3`.].kN}.LP/.5.21....km.U.^Q.<3.2.wA.B..........oB....rPh4.#.Z..m..A..} 6.......,.......i......?m...W...I,.4j].-`Mfh....W..E.9...w....k.w.....@.r.+v....w..l#..=. .....R.......b..\...\|.....D...zxK(AB.. ..5...u.^W.....r...!..,.=`H\<..u.............7..~H.=.V9....- L.b....3f`a........

C:\ElitechLogWin\Images\Icons\help.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	7.805120493437256
Encrypted:	false
SSDEEP:	24:aDqdDBF0QZ8AfqenWYcwcmSlbq0KXzg3h2y52lptw2PQAgrOwjX:aDq5BfFfs4vSlm00zgwy+P1gP
MD5:	3974D3DC43E1C1F34C90CF1D93CFA580
SHA1:	7C079EE22871B8C67D98229B5AA6C89034416C97
SHA-256:	7859DA6A1E06C268C963DF055E1A82DCBDB5DD85A2452E2EE3936F6DD0110308
SHA-512:	895891E8CCE6D55F04C58E747F993E72D9B942A1F13C456948F16DC66925164FB270B66307EFFD8C1600FD69E288EC5B40C0E0B9BC532A487D87CC70A99B7C40
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Wkl.U....V..tw1.P........P.c4jb@P.....;Sj.1$..D@c..2.....(..E..%.. ....................E....;.\|.s.=.p.?...Q9..\...S..A.&..N..@.0..@'..g(......n.V.s.........PW.Sf..q.T....K..5.D.dW.0... ...8a3.D<....h./...P..s...Q.HQ.Q.....z...6n..:..'r~....7XO.C.s...DW;..$.<%..o.l...V.......k.X.Uh.....r.:..?:..e;....^<......o.@...C.......q.&z"..7V....2.pT....V..3.m..>.............\|..A..Y.........=5G!Z..t...IE.DV...mw.2.....Wn..?.at..3.6c............]d.q.....(.5.}....?.+....3..Bg5...&.W....0...b5...........2pT&.c@....@ms..P..Pw.&U.2.........L.8..e..t.!4).....,-1.o.... ...l..lCb..@DO.....,.m..$e.0O....OR.S........`F...k0.:.........8...,5.@...R.C.H....i.)3.!..".:......,..#.5.......RML..0R.....v....r.5...T.....R.._....~,-.6.>i0R_.4........8..H..IU<.. ..{f....@/.....f.b.. jdp.T.W\..5.kb.s'.....,.4.j..J.`.I-Q.] ....&.).@LOO.....X...g..=.lc.....N...>.. .......t]V.....M.......q..."U1.C...........hs.......h.L.{.....C.W--......

C:\ElitechLogWin\Images\Icons\icon-chart-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	503
Entropy (8bit):	7.257423485506751
Encrypted:	false
SSDEEP:	12:6v/7igHAfg8nsV3sZX209YAY2c+sVeH5fqZ8jHOsutayhkSb9C:mSgF3+G095Y29jfqZ/v1h9C
MD5:	82116962FC77734535642345E6B80883
SHA1:	7A8E715C8CE68F1546EC2C8B710B1A028304CCAF
SHA-256:	598982BE1255D0D937017F0A3C4BEC5EFBD37F383FC6FB1797618A8D99CD7F27
SHA-512:	07A4E8F265F75F664850E8A6B6D7011CD658762703E782D4F02C8CB84ECA61D7F568B3A24498B2B06BD0DFB65E9EE105F310592F74A41D8702C5662E35862618
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXGcd.`.8..3.:..!`..e...>...N7..,gdd.?....N.....]......&Z.........S...d9.j.y.....7.Z...@...Zn.SO.....N`dd.[....!.`..............q8.!`.......>'+..A...7.....?0.....!).0..P....L%..,....p...\.7..9.....!.......:..@t.....,.W=E....AT.......C@A~.Y...;.B.!.P+..A..8B.................x^.b`...A........x...+..r2......A....j0b.r.O....._-.!.w..=^...BD$5....?lL.wl..^j.`2.J.9.<n...lC..D+#.....E.6D.L.BB.`.s.%..i,..F.0...?..O.TQIt..*.a1d......!.as.....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-chart@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.587360887008445
Encrypted:	false
SSDEEP:	12:6v/7ii5G8jTAQyKxeNvQjk6PlklQfxFBLqtbn+3KIcpbRUrMAsvRuVgMyG9:EG8PymeNmzkK5FBeFhSJyIgMyG9
MD5:	8FF3A00A4CADB333C3E9610B2E4E8F1B
SHA1:	C2A58EE4DB7E3BCF7A06F92D1A323212D3831869
SHA-256:	9D401A6D779C9CA22677890D60212E11228DD499138539C8E99C1864ED5B4EDF
SHA-512:	A87A61C03CD494A2C061008C757EE4BC0D4AC3EFCBD9E66436464D3C363F66853E30014450B5E7460902B42F0C43052ED208B88473A427AFA0569F21667452CB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAn.P....,c8.H5.&'(.Az..%fQr.....g.r..'(...B.....2..t...oc...Pk....g..y3 ...#.....S..J.j.c...7% ...N...`_O.. Ip.u..A..@e0...7..R(..2....8){..W.....u6.>g..1.~..D.h;.S`_=.XZ~...Lmw.rzYE[.&C.....=.w.p..^...w.?......p._$.......U.\|......jR.oM..."p..hBZ.....~.B......7.......r.`s.."..G36.5AD...[_3..".@...N4.p..z\.7.&a.^.A.KK]....s<...L....A$...~.[w.N...N(.v6...c.\...H..a.....r...;Z.c...I....).,.F.- .{<G i+.?..oCG....a(..N....Y.\|.8.'f@I.f....*...uMQf4Dg..q..f .PV>..F".~....a..\....>...k..mc._.{...E..N].,0..%Wt".+....a..)...n..;......%1..N...)x....`.>O...d\...p..h?.N\|/...Y<..k.e..........[.x... ...H..../...TI4..+.l..CG..X..........$K..q...d...z.G)6...&...$.4O......#r...2x`.@s.....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-db.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	718
Entropy (8bit):	7.646727724138583
Encrypted:	false
SSDEEP:	12:6v/7LnZLYkVQr7s8AOc453z0uXaefJRj6DuH1SMYosXMcggVkZyw2kGE/BuVFux:KZLdi+ObD0uKe/uyH1SrrECCLGEZuVA
MD5:	58145130D8C2EC4F77B2A90C9B095C7F
SHA1:	BF515A9C6332E1381C18F06E2B9E2F5051A3413A
SHA-256:	A69616F59DBAED47C86BDC4E31B2EF5126DDB835AC3CA8B63AFA8F72061BB71D
SHA-512:	41DD77EF4884D72B3AE728E28DEC9E1DF39DD708DEA3254D46518114D4AEF7F654B0C3FEC540587D9654BF03449FFE3E260620F6B5C855D414C59E109D1EA3AB
Malicious:	false
Preview:	.PNG........IHDR..............w=.....IDATHK.VAn.P...@......m...... .2.(9A.A....s...pOP.......k...7..a.1Q.%d...?o.<..\...7.c"....j.....4nT.o.../]..9^..\......,N.',5<...D.Bz,...T\......H.Y"+..GH..y..aj.q.. n\|.'_=.x.c...".........j.g...m.b..._sv........YmkT.@...4.g...7..(.... .[.E5z..?...q..`...F$.a.I..S..6.-R3."%..1.........T....... IJ........[.%.....i..^{i...oP.f.HN.t...]...\|0.2. ...t.0W.P....X)O.L.R...er@T.......P..f...X'Z.6X....>b......yy'..-..p.,..N4....6.D.ZU....H..B.N.....2..m&.8...l..M\|Q...^.......OH.Mq6...L&.....N..5..\{o.3.L..Ay..=...C1L..dG.7.cU.{'..w.Z..3.....En...\..!:{...K.$.a..._wu6g.D....2-3)f.ObI2..%...p.T.p-.=&...LH.j..Z...iI..8.c.......(..\.....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-db@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	7.735253982698676
Encrypted:	false
SSDEEP:	24:tkr9Kq+cgZlCBPofEQlRKxvY5ipYFZg2atKFz1H:+rCfWdoMQmv+VFZPeKFF
MD5:	1CDA9D1637E589BB1CCFE2CB32B9240D
SHA1:	5D9EAB2BE93D6E6A26C0F89B64B38ACEE203F530
SHA-256:	4F0CEA61314D5E4084F6CC2EF0B8825F035BD9171F2250C8B75AF2EAF231B59F
SHA-512:	686EEFB9DFB9D1670D1419BBF93EC187C5002D3A9D745BCFE887BF0832A0FB72308A291CC49EFDC95679A20E8D3909B3A569BCBF06B53912A8CA30046DC7B301
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAR"A..jQ.........@\|....*....@....../X\|..W1B..:.U........u'..b....3...2>..M...S......0KHN........k.V....e.."."ph.t...E...ta.<<...3...t..u.J4k..;..c..0.bn..m......G.`....n.,....B.....>.p.\z.2q...b.k._.&......_$...`.........Z..d.........P/V\|.g..r..2I...Y...p.....}..fAX.....@B%..NV9.../.....@n...:.^...1 ../.C.....0...u-s.%...8.....s....c..p.T...S....'Se......T......yd.O.}..C...x....@$.l...5p..tP.::r..... .?8.+......2..B.... ...B....(.y$..>.,.. ...v....W!..5#.F.s.h..h..#_.....\|..Z.7...H..A..b.#RT....;..o.x.......j`t.W...B!...1w=..Q....R`..&R....\...^lyq@.@,CM.kP......'....#k..~.. .dE}..Y...O...$..Y....>..i......\|...mM+$...>{3bn..s.......5#...$....P.W..:...q....C.5-.z..2.....T.b.&.U....U0(...Y.P...\|.....!...O..&.@.. F.^_e8..x.`..dI...+.....W.7...)]...(....D..z..O......Rmy.^P..F..L..........mb..(..z1......hHj....}.,.y../...O...zE.`C-..ky].&..\|!..[...h..5..~p....I.....i...........t?.(.....IEN

C:\ElitechLogWin\Images\Icons\icon-db@64.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	7.875031842325401
Encrypted:	false
SSDEEP:	48:79nTHOZ4THENxTPJmq07qlVaNELhCl6hZXR67Yxlo87nZAw:FOZHTPJY7qDPhCl6hZuYrH7ZAw
MD5:	6D30D151C3C44D3B8FA98184810C9B53
SHA1:	82FB708082CC4CD5595FBEFE43CA829EC7C6BA1A
SHA-256:	44F3B6EB9B54ACF2B2AFD15D4555D941579C9E4A7D969203BD89FD82F0333BEC
SHA-512:	0B4F07C061516CD650832EC93317C63320DC108C7A82AE1846BE1C1B2945AC9B7AF830AD425AB0CCCBB7CE12394FFECEB6E83FA70600F723AEFA53F680FA61F3
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.[]r.9..&....XS..J8...dO..HBU.'...S...8'.9....WL.......Q...h23......TQ.2......nIq..Y.....uA...uOR].E.'!....b.B.1.N..........j...0.^>..m...p..%.}.H...6>..J!...o...$hGB..C..<..x.>.F....N..[.....\....w.P.YB....``4.3..k..Z..$.u.A.....lK).N.."...:.G'.@8...'.`!~t".Xk...S...}.............;....`.c.....L..F$M?D..Z.-Iv.P."&X.$..k..........$k/.X.B.x.h...:..?mq^.V.iWP.e.2.pK....A..)g...'qJ.........w.](.y..W{2....p.x.)4{.o...mW....G.6.........Y..@p.}..<....Y.0y..4.YK.Q.d.+.. ....]`.......L...5.n.U.............PR<..l..,bUc... ,.X...i...z.a\.5...G.4......P.l...b..>.....R..K.@c..[.....e.m..........zl.E.@Tuj..k...\|.%.\..,..h7.........<<....D.@.....C...B.....F..S.....N:`.I.2...."........cO.&)f.......u.yh.Q:....fz..[.8:Lr..8.&\.y.k.b.....T[..O...=.....I~.2..._QR.."....Y....../..K. .H.!AkH.b.....].or..~>.H.........YZcKAj......{.i.`....Q..b..V.T..\|:yB........>p+.....g)..u&C&..T.....Z.I.{..O..E..EY....w..}.r+.......

C:\ElitechLogWin\Images\Icons\icon-filter-blue-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.659876966836795
Encrypted:	false
SSDEEP:	12:6v/7iRQD4oFdv9XM/3X5tYOK/ZEN3r0HMjrCLPqdJqp4cny7stONjTLekYk2:73C98/3ptGg3rJWLPqM4cny7sYNjXekE
MD5:	2323DD1EDD0465AB0DEECF2FEF4F8297
SHA1:	7FAAE464D9020848A29C6BBD68B025EC16B5209A
SHA-256:	839810D830EA3B572EE05E57A62E93D48399E8DEB81E589197B5ED5C786484C2
SHA-512:	B0667FA13FC63840EDB89B84085046474945F3FC6EA93DF9D80683AFDE2AEFA45090093FA61E44C80D326CCAD0BB31C5CB5CC6216731A3E2D6B8AC741011756F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Kr.@......!.@..59.p......T....x.YF9A.... dk....yD..DQ .@..X...f........?x.....U..s_0.....@G.l8..}.....w.r-.y.h.... ...`0..s......E....o....OHh..9....8+.>V...d..#......15{...qvUHM..X..R.......L.... &..m.......A4W.15.e..8`....@.o...@..I.<.`9Fu.TW....p.........mX... .yh....B..ac~.b.@6... ....s.k.QP...l....m.Q....'M....f...PF...h{..g.ff..r.B. ...6AG...t....?NdY..c.\.a.B..3..Vv........0w.X...%..S.bLx.....c.6.u.....X.. r....J.d)j^.u.%H..:l.....&<..nL#..}.n....<..ap[.(H>..F.\|'......P=>..[.....!]...$..?...4/y'.t!..#D..j.pv..m.[w..[.3_.w.h`1.jX,.Z...q.G=~S9..........0jl6...D=}..}n...m....H.......O.."....eE..7.e...t.*5......^.b+1I..>....!.w..J..7.N.._,..W.X..............S..q.G;.Z.t....^.....0..W....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-filter-x16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	343
Entropy (8bit):	7.006839353189143
Encrypted:	false
SSDEEP:	6:6v/lhPW5J8A5Sc7KZ9Dbsi99ckRaU1HRLJM6d6ilFFNqBCrXxCMTRW06Tp:6v/7W8AF7KZ9fsfkRHHFC6kBCrtA
MD5:	BD5CFCA91FC002244BBBA427C0CC94E7
SHA1:	8DDA0013E4A12761220BE0B39FCB52A7B0EDDD0E
SHA-256:	1781A4CAFF0D60C000E95C9190F5895FFF4F8FEAACDD161337C98EE6CA12C46C
SHA-512:	A3FBA92944C75D71DD545E85C1B940603A61A15FF176BCF17B68EBC05A80A4559438F3066260867A2A99D0602CFDB691B3F226FC6CB453F182FD79FD85112E3B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.....@.E.7.H.....:..`!^...v...v.v@.........v3$....c#,Fz.......M...<.. .+...w...=..-t...P.X#" .c.?......~...H*.H.!. .....6k..E.r.P].F$.D.&&..q.Q.v.l.Z3G<.&...d.....8..h.:.n.O...+....._...H^..Q"........e........y..q$.D5...8:.y.'r.%..N..6.%.XN!..(^kx=V.R..."...4 .^.A...4..........IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-filter-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.595898861148111
Encrypted:	false
SSDEEP:	24:qSdYqWXFvv9y9UdIOAhpb4oBD0sWJHG29S8:qm7WX5FSjnLFGHJm29S8
MD5:	2886897DC6FF2D28D01E7FD5E8E141F9
SHA1:	0577969272997A626A1A8D171478AC438AC73848
SHA-256:	3EC8E03A710EF6FAE168BCB154BA647D1AC7371811DC971F7709032BAE728DC2
SHA-512:	EC7EE35748F7E528012F7ADDB4DE306A4E6AD01C4662CDBCA17E3FCA90523A0E6CD5BD062A234A7620E7CB53EF4B913CC7A4B7A05CB81AC72316A70E2E40231E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..q.0..1...x+XRAB....X. p..S......BX.....T.PA../#1.H.=Y.xd.....+;...].........lV.,w.....o..w...v..W..'.P...Q8NP....X?C.K.......i.Z.......m.F_.^..{.....z....^..I..X.(..B...\c....6...n.....$..el..0G.....T.:Z...........(..3..e....B.B..P..{<t..i...n].1..0]^5.... .....aZ...SxF.. .v...* ..6O&..F.A'=i......h.8.su...D...(....\=...........s.#h.v...Xa....L.Z..O....".O....1...:.s...t:M..j...X..O.L..(..g.+.7.rB...Ir.D.x.pVQ.)A...R.?YAS..=.^(.@....'......p.K5...`....n7.J.^.qT)...:..).u...LE'..w.+....:....t.#.....pY%".3.@........^..L...X3WK...D.....zH...y.k..@..#4R6..?.MG......... ".Z{Q.OH.......N.1[.)...!./T..,.....V...Ba.Y....lv./^..X...c5............u......E.-x.........'..c).XNl....=...>. ...C.....z@.LU.+W...T,._....!...0......K......y.....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-reset-blue-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	841
Entropy (8bit):	7.676663184223963
Encrypted:	false
SSDEEP:	12:6v/7iojIyQWnV1wr738VDJGMrdYYkozs0ZAQSUVYPgUni5OZgTRdvKrlTzOD7v7Q:mI5Wnkr7MpnWeAR7i5kOIl/e7dzwl7
MD5:	45B1E10946A741D3EACE8BA0211C735D
SHA1:	7AE827ACC0EE5737C5C9E51C4E1B8659813E1364
SHA-256:	88E888EDF07A325AD3FCECCB646E163F52289173004CAC5B071CCCB3558967F3
SHA-512:	EDFDECF1A2DA357CDDCBEA6282FC9983A12BE538DCD8CC50878105613FB1C17208DC22DC41B889763CF85BCCB97CC0DF3D345370A9AF030FD67DBBE95B26FCA3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WMRZA.....p.....O . x...`.p.....l....Bn.[.JN..%H..=.......YQ.....C.pJ.v....@TB.\'.9 ..0W.f.y...Y.c?...R...$.SD(..w. d.Z..._.mw..*...[{..P......Y}.."..X...-.l.X.a#f..N....@i.h.7&...}..O....e....@[^x..RN@..X..\|....&.{b.@y.....G..X1.2.6.........7.B8@..Q.2..b.^.....'.<u.W.S..~.hc.....4.MP.Ph.........+.....qY]..F...~....c/H...W.r..Z.m..z..J.x....".........@...a.NeD!.5K...../..O4Q.\|_.x. ..>......r.QxV[.2....,......_.=Q.-..5....u...:be.dy..[..r....."3.]..!X..[..v>O]a....?1q=.HO.&a...i....B.I.Y....pt.l$.ICW!.../..X..4.x.Z..Z.R...X..{Z......{I.....0..r.t...H...5..Q4...j7W.;n.{.0.........A<#V.........n..PT%n.^...@b....Yxq(.....~(-.r....Y.H.u..:...6....B+...:..."RN3.X.w..\.m..$..^.<.4.&}...$...0....[D.b....ZN...M.d0...z..5.B$.+..../A......\|W......IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-reset-x16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.351790659789098
Encrypted:	false
SSDEEP:	12:6v/76W5TIMHH6v+Vuf+9w1QR7vig8EVQP19LHa1:fW5TPLEW9vFig9VQP19LHa1
MD5:	9EC3C6B9E2E1CB52B406C3DABD27E8FF
SHA1:	C95CB1CC18336631FAF28EBBCFE50DA27AA5C8DF
SHA-256:	38F30513F51A7EE5E9D7AC3024E187047E625A04A0D0F361562637A8B4E99138
SHA-512:	E818C6375570DDFC6B5EF7013D6ACC798AF7B6CC6E75C5C8A0DEBAE8A04202D412E7DA06D7E8D7E8DCEE7F931783F25D7DE3D80F03BC1AE0B0C78492AC224698
Malicious:	false
Preview:	.PNG........IHDR................a...aIDAT8O.S.q.@.......SA...+.]A....^y2..tbw@....../.....\...ZI+i.c..K.teY.1....z..j..2I....T#....^'Um..q..Kl"@....t ....Ld..@.#.'.+#..u]..:"}...(`4.m..Je....&p#I...L.N..y..?R2.3..eY..>.nJ.G.....;..i......;la.....h...$.B.`.{.$.I.9...<!p..?..UO..F0.Nk..j.....g.~.un...7k......q.0.+....KY...tH...z.S..].I..l...<"...z..........C@.8........U......U.....L....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-reset-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.604801986926686
Encrypted:	false
SSDEEP:	12:6v/7Gi/6rfuDHjnqhTDc7Ip3ywb9pWf+aTe8g7iVX+0ogkl946WOBz/kc:k/6r/+RuTWma68g7oCgj9OBz8c
MD5:	308F31E523108DBE4267F5A386EC3AE4
SHA1:	3F4FEFB77301EF3B5F8747081EBD77C8B00F52D1
SHA-256:	4873493C05444C4904BEA5030A0BA2EC1BE4D065FB0F930C2C23EE285BFA47EA
SHA-512:	AD904CEC668CF2ABD8A5D6B5520FD8F88F811841B2CFDF6ED69D36FEA1DCF2B4416B3FEE2EEBFE4A2BE3D788E1347B9BE66B803E36CAC18E65703DB77E8C1F4E
Malicious:	false
Preview:	.PNG........IHDR..............JL....XIDATHK.V.Q.0....* T.T@R...L..C...N.$.........0.@.\.eW#{..,@3.d.'..}.$..`...F.\.BX.O.....7.3..v.~..iZJ.>.g\|o.%../.x......FSL...H....i....s.@...^........`.Z.v.y...#..&3.c=.../Y.K....f.. .\...e.6.....y.v...#U....R ...]g..... R:.Y.I..Pk.8........X...M.D..2......tqd%..!.&9AtL...`s...I..v.NY...4R.C$...l.8.V........&...=t:.G...a.$#..g..}..L`..V....>..,..... ..x<n.....[ ..\|.~..n..../....t........L"S':...V .ZA.....?w...f.....r....=m.Z.......G6,.4d..n.T...0.J.....M..8#.dmJ .. ...S..."....h..Hl...OU...c".,8.,....!YtRg.r...Bu..-..}.j...........EvVw..-Qx.W.x&t$........;..V..x..........,@x........IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-row-selected-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.623633476425489
Encrypted:	false
SSDEEP:	12:6v/7iLH3n2EguVtLNAddaeGB4PPfby+apTiIE8Uy5fKOnJFu4K6LOCgNwVBr+mEH:dH32xkLWdIB4PPfypTf5iOn8SEp4ZZ8D
MD5:	EDB94A9617DCB24A2803CA3CF06C7665
SHA1:	92C6F62CE6CA01DED3747CDA1812B670D624CDF1
SHA-256:	EDE00958AB686FDC8B8CBAF073FA5E1B8DE498FA93B407811CDD149776CA7E5A
SHA-512:	8B7261B194E5EC119BE566803D6ED604B7E8F0FFD090686CF01FBF59BE8CDFBA13AA6F03A853B24F3653889A59D89F06A6393F7ABF9CC2C43EB26AF64EEA90B6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.W]r.0.^..3..N@xc...p...p.Nhs..'H .{o.r...0)<...N.[d..Z.?.-...m....O.....3;.......uq..O...@...ouv..tYV....vl>A....h... ....G0.....gGc....8..Dp.t9._.........KB......N.....\.........O~.......(r;..:.BD.Kn.'.H.@..h.W.F._.GO...[..p.......D...b.....n/g....3~.0./(...J...k9.0.h.....M^...=2.S...\|X.....O.b..."!.x?..'....XS..2X..?cT^1...@..9.8......).....Q.X....{.....O.....}b.9#o....6x...."..r(=..9......KX-.<.G.."VB...$.M..fkH4..]...#4A...\n..G.4a.@...%A......i..mX].....uGp.....?..XO..8.x"v..Fi.......(.....".c. ...m...l)...b.....q....?5$1....._.o...R'..!..T.j.~...M)...... ...5(o.U$t.s..V.,e..}..IR.S69.............r.........zc..]N...l.`}&.K-.J.I.u5..as#<t9y.h......K..o....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-statusbar-com@16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	231
Entropy (8bit):	6.275216877597046
Encrypted:	false
SSDEEP:	6:6v/lhPck3tFrCyU6bc1BsCuVE5aDz4jnr4bDBVOpyAuKdp:6v/7JbCy4BkvDz4iVGz
MD5:	43163DCF3E558DD7A68C575CFF8065F0
SHA1:	EE7D7A0BC8FE86017CDEC29A2CDBB2E3F6A5FFFA
SHA-256:	EF24B54A0454F1330EDFCCA6F66DECCB1974AA97263AB74491CADC80E96C81B2
SHA-512:	EBBCC3EC0E8159C289B12220812A191352A4582F18379F665056D1F2DDCE51BB631DD2232D011EC93693FC9E20EEE0D71CB0FA4DAFEDCDA3F225F12C3C3B525B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8Ocd..0R...d.. .'.. .......f.D {.....\.3@...@.. ..a.8.9..8.J;...h.* .-..Aj...h.r.H4.....f.F ..'.....v.c@..... :.f.H."..\...G.FR.R...=.Bd.@N.9..d\4. .b.!MX.)M......r:L....)&........IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-statusbar-usb@16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 21 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	319
Entropy (8bit):	7.118775518578914
Encrypted:	false
SSDEEP:	6:6v/lhP8znNa1CgaIHrSvxkvLfqnSUP8GRvlCNM3etnmd6ySbNN68bMwbTp:6v/7onI5aSSvxsLfqnmGRcN7Vm4ySbvh
MD5:	63C5DF96616B604A61D61770AA82B334
SHA1:	F9B0BE5F072D1453A0C12DF4387D406DE6E5D2BF
SHA-256:	4EAC39FB304C5EAF9EF4A45DCD6D52B178F3B86AD962FF2DA191590D78D219A3
SHA-512:	9DDB85B52D41BFC1C6EE82E392F30216D3DD28F61444F4BA659BDBA2741B71020FBA6FBE548D5E781C160D08DF2C006C3952BD75E6608068FA46FE11379230C4
Malicious:	false
Preview:	.PNG........IHDR...............4%....IDAT8O.....@.E.....&...@.....J."...h.i.....u....qg.............`... .R&.m.!.........P .)7..@g..P.I..)5.#..6...>.vf.[[K .f6...Zt.^.+=.....6.c....`....K%}>.@....\.zu.U@%..)(.C.H._)........h...Db.k.{.:6..L.%~.....;B.$.x...!.=.C.\=*.w.............l...OO..O../.........IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-text-fi-audit@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	580
Entropy (8bit):	7.41967298197041
Encrypted:	false
SSDEEP:	12:6v/7ivwmHiVvt19oDC0i8RO1wCLOOnaut/6c2fSvM6J4fnCb:hwmCRtDoDC0FRO1w77MPci4A
MD5:	9FFD8AD1027E6B683EFCD501646170DE
SHA1:	51757AD78C9522DF631D246DDA084611B5F9C05E
SHA-256:	23DBCF5F78C5883B0CF131BB38FA23E267EB627BD499BFDF29E187E1DE5D63C8
SHA-512:	B65B4D23070313B77D5459764A6EA3F18CDDB951FD4A9587DB3B1F35F34C20EBB5472427B236F801FB00DC9CD8E14D6216D68E9194E7281D0F83FA61F7DB4601
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.MN.P..g.....H.n...'.O.,....# .....7.o.[J.'..5!.g...E.k)..o.^..7?of.p.'........@...\...(<'1&.@.......D)...v..B+.Dl..7;7h9s.jN.A.....;..{..m..g....O....:.yG..g.q.\l..n.zq.......H...."..K........}.$.1 8o..1{.....@..\....0..z.(Fz-g.. ..I0Z4...XP.....;.B.. ^..........Q...X...\.k........$.Q.t.G}.+..!...U....5....?...........<........9..<..\w.D.V...r.....sD>....J.d.!..!.x...ej...;`9...R.....z...2..t.....5..@...g..n...s........ iEL-...@..&.:...#Y.k.....Pz ..A.u.P.J.-..A`z=P=..0......*.{_..(.`....X.0s.BP....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-warning-gray@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	515
Entropy (8bit):	7.451082465646724
Encrypted:	false
SSDEEP:	12:6v/7i7swKTeW56mCRTIUC1qGZdn+epj5wSZDbN49J:qB/XNvDij
MD5:	3C8BBFA2B66A18340B2B06FEE9EF57EB
SHA1:	9DD2E31510D3414F98A1BE7E787C6F507F10B6B0
SHA-256:	F91E6F68049869A9270DCF7491D09877D5802C7CA775E203DBC67C0768046876
SHA-512:	5F25D0A7A80F48E48C32FA10BE722FDFBE6F942DCABB5F006B75AA9794605B9B221035F97FBA2A7FB1D7154022AC2DAA6E510D770D7AFF1BC56707836B58EF47
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG...U.@.@]^.9.h.............#p@+......v.t.9..3..y@....D.2...3 .`+.r.4.s..(...4....[..s!.=.L&.I.....u.......j...)..%..P1...v:...(.....[0.!\..n..p.........."....;K.....4/....~...u(...R..._."T...T.LC..CHp.g.....G.\%\.Z...+.(@.8...uk.[.._.c...9.......#......tH...%.$`rV........9v8]..{..v.....Y..,@..%H.L8K.`k2..<..Q.....>.\+@..j'4+ma..p..f5q&........]%N.!....x.';.T.)*k..]..,C..........NLG%.,...,.. .C...(...p...^e....H.G.v.^.............?..........IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-warning-no-x16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.72016995562674
Encrypted:	false
SSDEEP:	6:6v/lhPN2mLwMb+QCVtppIIHlZXQ6IzTV29AOTjm/ljp:6v/7gmLtCQ4PpvNQTUG/lN
MD5:	BBA7ABA6DAC37E0D3A54AD778B0ACD83
SHA1:	04DB4F3FC71A843C37AC9ECB6169B8D33780FC1A
SHA-256:	03149CA247BD92A1ADB43DE73E32E46E25B1ADF77B54D698A2A2A8C61CD67795
SHA-512:	D58ABF73906669BCD7A4A255AC63B873FD6EFB3CA506ACD2ADB37D2EF3673D760BF84749642B079CD56F194134AA4664AB72351273187CA97D72D79EF098A662
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8Ocd..0R...,.4..(....d9..h,.N`b`...._...H2......L.....$A&........\"....!..y..........P.0.c.......b.>..@.^*j.....tC@........u6...a.i........... ..PG..J,`q.X=..X...!..3,...:.W.`M...#..oJ.X,.p#...By.....0......k..3k(....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-warning-no-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	593
Entropy (8bit):	7.570693847348377
Encrypted:	false
SSDEEP:	12:6v/7itm+Xx/7tSHtIlL4my+wzBmBAUwRGutkxmz/XZUaP7GlFIHcrd7xc:mutHumVuBWjJwk4zxUaPgI8c
MD5:	DB5BD47102307DD93A5790E269BE6EEA
SHA1:	BE417E3AD48FED998CF29B1E8F2516F7554AB159
SHA-256:	9CAB598A9A89D5ACD197BD5E08CE7A5C829E243B339EB07478AFFA336B79C594
SHA-512:	970AAB5C2A0CCD9FC2D7DC5A842D9A2F1ABD59B87017244F55CB9B6614926E66E6A91066B24CA84173EFA0308E6069A9F249DC768ABAFD565C18E5BC1219EB51
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.VAN.@..i..(..X.(.7.7....`....P.k.........K....C..iK.23.`...#.......-/.e\|.....q}:.......%.{.X.-.EU/X..N....`...5.r....a{..v...d"....ap.{....\|..EQ."...K..<.......B6. L..H.....<........~0+.(sbS....~.......P...3.@..H...V`.ydh.....~.+..S...@.._..S#:)}_..!o...t...B....:........8....qeP...= .Wwf.&.".d..u.4b........mN.E}.c.......[..:.H1...H.hda.........x......G......>..i.I8{..,..!...{.....B$0....3..3-..wY.B..BB..K+....).R].&%MB..D#....)...(..w.Djp..7H..x~..c$!..[.B ....Xn.."..>.7..&.\....%S2.z....&.=..../zv.0.......IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-warning-red@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.430074309419948
Encrypted:	false
SSDEEP:	12:6v/7i538/wRppAcA96y7OradFfT7s9gAcR90swZ97z2NROc:M4pmUy7gWFfPs9gB3s7z2NRD
MD5:	71A63B5615F515E6915E8A907CAC1026
SHA1:	0D3CB45045CA867B4E1A86D6221C8925A3CB9C3C
SHA-256:	B1C53DDC71084E97C5F8C5517D339F9BA511E93925033E6E6CFB79BC8FFC69A3
SHA-512:	78C5FCD96A97B53096DA2F5DD2A5A858AE5433DD221A768DE49FFEDCB832B960D5C6D43F275A979A552C6E7DB821D3AB700CA1F796ADB690330AAB6C9207B96E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG...Q.0.@..N......FN..0...@......@.T@......>.d.8!B.`c...di&3.G.{Z.vG@.x.H.....}..>..{...=.#.ns.....8\|.....^.d.g..O.A'<......$...J.A.......`t.8T...."........g.9......N.#{.1dI8]...`....B.....".3.HFO.X8g..."a......K.\%\.J.[.W.V.+!.)W...T.vUU-%.l..t....5..S..h-..y.2F.['ry..1..#.#..n&.zKZ1.y[..=^.ta/......6..V...h..<...J..n+a.0.....E..&8o.._...0.,.MuB..R..8.N.$...:.%.:pW.\...EB....Jh.....E.....N`...$h..N.T*.'..uP.=a..^.Zz...mWV....H..N.. &..........^.m.$.7._....F.......IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-warning-yes-x16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	7.023181535859194
Encrypted:	false
SSDEEP:	6:6v/lhPWvfKdffb1T8QHERqObt6Q36DSLwsz/SytuQP1xYIEtVp:6v/70fYTJHERqOMQa+zz6UjP1xY/
MD5:	18F7099E8F53AE6E6FFEAC54246D773D
SHA1:	8446705D79B56B6E30B05727986C3752ECC3211F
SHA-256:	88F8FBB7B64EB056A18AC2B3C085050B0F57F7CD77E2E4334134F9B739F9DCD1
SHA-512:	9A89CFFCE8FF7D34FC44F4502681427B8603F65EDE9BED412EB5034915D0D029D9B93E7F319878BBE1085E5262475B01A974171A651095EF014BCF3154A872B7
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O..A..0.E.................'.o.+...$.............3.>.F>d..4........"..\|YAe..s...t..$.p..:..;.".N....R.i.3z...U.?.F...............%..m..-.M.<w7...\|.Dug...N8b..U6....a.n........>D.\|...I.mc...A......Y....a.K.j....K....3..$.e...e.Q.. .y.3.....u..7..o;....5.....IEND.B`.

C:\ElitechLogWin\Images\Icons\icon-warning-yes-x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	551
Entropy (8bit):	7.559793879225985
Encrypted:	false
SSDEEP:	12:6v/7iwHAPeWsdk+oLF8rK5pfITcXqKbwI1i0k5nMxgpkLSZqu:2g7/L1V6Mqq1i0k5nMxAQSZx
MD5:	06E9912D08322BA10FAB9BED7FA4A0D1
SHA1:	4F66D61DD581A40971BC4A458EC858A78E96F620
SHA-256:	F4FB8B6182BF4A304186BCA43271E8C5A83CEAF21E704B214DED83351870706C
SHA-512:	E78AEA59AC8F38E1F923BE5014DBF9BAF4A13042598B1763F20A67DEB1B4CAC6C2269E93063871775B00CA1174597868D62763BA4D35941BE26D7F6A4D79EEFF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.;R.0..W....1...0....p..A8........MB.f(..x.....Zim.P..#..i..JV..6...... ...}..o.......~.......^m.=.J.pL.......1.^.]9N......E...p.."...M.Kq..i...+.P.T.5..\.....b6{......n.....&.K...B"n...Eb.lp&.a.vy..!$.9...5!...E.4.O..p..Y.i....k...e.N.y&.Bqiwz..N.........>.L.[.<..B.....v.).l..USv......^....@d.p.D.`......C..2q3O...m...T.z{.Gu..g#....Jkt...}..<k... :jM..1..~.Ys...;q7.....b.t.3k.p..:....@T....m.. .1...81....w\|...._%..y.+.H_.Y`23h=....1q\|S.?`.....:_.&.....m.MD.......G0.+[.....IEND.B`.

C:\ElitechLogWin\Images\Icons\index.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	466
Entropy (8bit):	7.26750530654124
Encrypted:	false
SSDEEP:	12:6v/7in9mVE05KRNg/U6O0uyUENhAl1uIbCK4r9w/cWJSxyZrysl7:Z9mVPeFbsr9MyxKDl7
MD5:	C7FF13C2977C82CD8070D8FE6E15A103
SHA1:	6888542CB4E59C16B57D274415441DA8F0C1988E
SHA-256:	6DAB1F775E089F06B65E7BFE0118855257B96199AFB1DFCA56AC5BD7951A7C6F
SHA-512:	36BEDF9C043DA3C8354E074D34746EA3819170904605EB095622060A56AA5C1DBDB0E4B6C97FEE3AB07898FF17AC59D9A0C3DE14C913A84335CA7D4141FA0DDB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..M.0.....2..P&.&.l..P&.........A..&....d..#...'...{...;.m..[...h4......d2c..?5.....V\|i..+1.`O...3..../........G........`..O.7...../r r.\q....... R.GJ.(.2e..w.... N.?..-.>.h....X.g..2J..B.}........B..v.C...U.p...E.G.=..p.^....H.M....Kj.N......}6.J..=..;?_..v..J...m.]............G....z...3.....d..\....}kp5.f...`+.h..R.......B....]...<..x...!..Y..nE.W{.0"...S'...\.......a..y...Rt!.-=4....IEND.B`.

C:\ElitechLogWin\Images\Icons\index2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.405433171083131
Encrypted:	false
SSDEEP:	6:6v/lhPKqvq+eInbi12ZDfiCfm6zrQXaIy3LxAUYuf6jJQacpu2mwlNPyTp:6v/7iF+w12DKCfhrQXpy33/faNcpu0y9
MD5:	F235037D27749B7001467ED61CDAC18E
SHA1:	D2A33608326368A745ABBF288ED0A29B1EDF46ED
SHA-256:	27305F1BCBAFB9CA0D0CE5A8E24C1D40A25FB24D8D74B65DA25F86FA9604D586
SHA-512:	C96BBF7B480FE342231BB3E86AB4A1882D5B73C1FE2DA4BEFFBDDB58B046FFDA1D3D38FC2E0FF65AC53825625DACBB1E7BBF0BF50A436DCF5AB61CA89CE95952
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.M.0.....!L.L@..6 l......P&`.............'./.)'=.u.{..>;..c.c...p&.Ka...!.."}.>..."..0.'.g.A$b..q.....V..p..w.p....<.....<!..... "9D....G^.....MHj.(.H....g.].%2....S.g.H Q.r.5..A.....W..!g.x...q."..k%...%O.`IZ...c.I.d5}../B.....c..H..D...r..T,`.F...Ta.....a....\.L.g)P.[.....6K....-..L.....%.B@...O.....M.W.k..Mf4......Z....o......9.........t.`...T..#..tC.l..u...r.....'..1..E5.Y...o...9u.!!Wy.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-0E4V7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 157 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8275
Entropy (8bit):	7.937075402202231
Encrypted:	false
SSDEEP:	192:ZSHIIHUCD4waAxjwEFpn6P8I+IBMLANJBqYRW1x62D:A50wBxj7iyAv0qWf62D
MD5:	AD3FA9D19D9B5E2BEECB11D9D2743FD5
SHA1:	6EFEC2B9865E096461411BB9BD26482C6B2CE2F8
SHA-256:	527B4F272E926BF803DACC7F6F379BC355665444D513AA4300E3CB3C67EF43B0
SHA-512:	F22D557EA01798B32ECA6FF36E1EE5F9CC9976FFD791BB0E7ACF75DF4640435088A2BA5FE92EFCF2F7CFC02036E8B4AC67772597ABCBB5CB71DA136360EB5796
Malicious:	false
Preview:	.PNG........IHDR.......F.......:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\ElitechLogWin\Images\Icons\is-0L966.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	470
Entropy (8bit):	7.465680157838254
Encrypted:	false
SSDEEP:	12:6v/7c/KtBnW4l6uSjSQRz9QW3po6isKv83s6Dygog7hsAoPLsc:j/KtR/l6uYSO9/pJ3Kk3LnoAqPLsc
MD5:	AF1FC4F7DBEAE8B8CD5223ACCA2A4182
SHA1:	FE95521CEDF4CD517DCC2E25720D326183D86C1C
SHA-256:	30D98169B7883C831BD9AD4A1B5643B4BB61049A9FC8BB41C55E74A44774677C
SHA-512:	3534E19B49B64164B7D7FB38FEC767CD2CFED0AFC6B876E03FC2C408C9D1B6665CD838ECD8A852CA6BED490387F562AC271FAC576F06544A5173ECBC182119C2
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.SMv.A..................0.aC..p.................d.!...K.....~....>.t..>...^.&4.1OI...z.....W'...>..YP.^\}.c.@.;.5.;?.e.2.4........q.. .R.d..]T.y..~$.<..!.I...+..-0.jB.A..).knE,3sJ<m..9.....)a..Y.d.R..;04...7.z............~..\|.........b..\|wmw.....\....)...rt.......W.c......b..~R..nb3F....U.>:Fij..A\|......B...,.<...R'....?..g..AH..F...B.R..a%&K9,e.K(2..?]/.,..). .g....3...QP.......s*....P....D......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-0OHC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262
Entropy (8bit):	6.704253992728635
Encrypted:	false
SSDEEP:	6:6v/lhPKDP1YYPXWNx3kxLH4tCBSuc1VUyHnM0Qjp:6v/7ir1JPkCxLH4tiSLUyHeN
MD5:	51872103A21ABB62845FEC55A8B1C751
SHA1:	230726F93D462D98A235200229674EAE58CCC866
SHA-256:	66F1A3CA82A0EFF3D29D5AF938F71927E47337C2B8583FA73CEAF65270DA85F9
SHA-512:	E37F0CF0F415DF4AA695F856A3A6787D477ECCC719B493B0AA1141F2F63D1D6008D9FAD3CE5F5576748178D42B94351E4D160151FA8EEF8595E2964E4C445EDA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.... .......<5.+E.....2..,.}X..{u.....SJ.2L)...7....R6.!.....T.....AP.V....H....L8...J8.h.z.QD.0".A..F.G.....-D.....[....:0.F...ve..0:........".AD.>..p}.......X..N.P..N."....j.%\...qz.'._}.{....!.C.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-0OK4C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	2.9642721625564956
Encrypted:	false
SSDEEP:	96:9dP380aCET0PQZjoW7p01/wjgpqX9JnPcbOv/O/1D7FN:juLiM6E9JnPcb97F
MD5:	3D689127F19830D828B3BAFE0E44CB73
SHA1:	0B81546785D2841FCA3F9EA56ACD3E271AD05ED0
SHA-256:	C7A83C3348DFBE67AC7C59DAB1FC51A63269CA510334DFD7123F53191770873A
SHA-512:	96B59F729AE2C8A89D02DF1B8FDB767B1C5F6FB12D1B0BEA25C75C90FEE1A2F5071A19C6496A38F0BF00DF2BF60317C71FC43BE0BECD43D97B097DE4B4988F7B
Malicious:	false
Preview:	......00.... ..%......(...0...`..... ......$.................................................................................................................................................................................................................................~.............................................................................................................................................................~.....................................................................c...A..V...M..S..U.......p..X.......-...}...............\|4..?.........................................................................~.....................................................@..Z...J.....G...Y...;..N.......F.........x..............:.............................................................~..................................................................<..^...\|3.....L...a.....E.......b...r......^...t..}5..e..F...........................................

C:\ElitechLogWin\Images\Icons\is-17HB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.352453414659275
Encrypted:	false
SSDEEP:	12:6v/7itxpwV2EVzK9MYW7m80lGzIZPjbTF+4upngD7jABNVN:HwVvOMYW7z0lRZPnTF+NpngMXr
MD5:	FBEE6E4349846542F7C7E109ADF47FEF
SHA1:	52B3AF9146EBFC66C39055D5012274E07924CEDB
SHA-256:	D88AC212F26EC336782FE1F4E0F6BB9D953DD0B20475305A74A9D9D9A568DCD7
SHA-512:	B0C52BDDFB5DA9C2EB09D59497673B3CC35AF8CEDB5EFF3FDA93554CE01012E96E9CE31C89C3318FE3B46DB1D9A9C37740B3DD8BFC1D75583840E9A47C673E75
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..m.@...!.@.q.....$.......!.$..t.t.t`_..v...2,$...,..}...Y.Zx...[7..<.....Br........l.q.-..N.(....y.m.w..@o.."....$I.8........(.(..Cn^..].4M_$.....!.D.. ........D......@n.......B....j..n!Bbc...(.$......rA. X......p.4.. ....3.n....=..3...2..U^.%.}...2....>..9.......{'<...R..$.......y;Ni....R.Zqz......}.5.fK.`.O..x%.&.Z.>\..........n7S.A.rNF..c7.Ce.u..X..k>..f...@.B.f&..3...gB...7f.d.Te...ZF..9@o.W../...0........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-1L8PR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.590889183860746
Encrypted:	false
SSDEEP:	12:6v/7iRuHLA8VRRhQS8VziIuRllX1DXof7UvEMqdLboo8wA4TUkAhzxd2k67:/GA8VZQNVWvh10ffMqdpVAhPO
MD5:	3D68C719F9EA87EBAEF486BF379C59FA
SHA1:	A7F2A4545CC339C8B9D095D9F743ADCFE4AD896A
SHA-256:	B391C94C6E8B5AF925D314C24A9B49DC561402DB6678C4F8F537B1982D86751D
SHA-512:	F37A19C158145F0FE21B436B100A4EE72317299432DF8FDE0BE8CDAAEE98C23A08EBEC6B755464AB2E1794AAEBAAB602BA224B082C7BACA3261DD86C6BD93E37
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....YIDATXG.MR.P..SQ....U.v.....O ..6p...8..r...7PO`...d. ........./.....U._......?.p}....g..~.....@..].o.....FO...:..na...z..F.HJ!....z.......[m)...>....]23...z........;...I..G!.Gg.[S..`g.^.q=7%........S.....xhJ...6..6..b.....6..S.l.[.?....S.h.<?.p....e...Q.ye....$u..p..fJ.......V.%M..@._...P..Q[.E......].G.`..i.......]}....p)..1"..C.}YaJK.G...w?~O.9.vX.\|X...._.8...).H....L...x..:p.......6....@\|J..Eq\|... ...C.........+..u..W....j...\7i..x...V;...H...xa..._-.z.....k....$..]...@%.%X...._k....l...<.z..4n...v....m.U.D.^..k..>t@?....*DR......b..I+.C. $.......4.JY.gE...:kI......#.0........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-1NEES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	7.875031842325401
Encrypted:	false
SSDEEP:	48:79nTHOZ4THENxTPJmq07qlVaNELhCl6hZXR67Yxlo87nZAw:FOZHTPJY7qDPhCl6hZuYrH7ZAw
MD5:	6D30D151C3C44D3B8FA98184810C9B53
SHA1:	82FB708082CC4CD5595FBEFE43CA829EC7C6BA1A
SHA-256:	44F3B6EB9B54ACF2B2AFD15D4555D941579C9E4A7D969203BD89FD82F0333BEC
SHA-512:	0B4F07C061516CD650832EC93317C63320DC108C7A82AE1846BE1C1B2945AC9B7AF830AD425AB0CCCBB7CE12394FFECEB6E83FA70600F723AEFA53F680FA61F3
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.[]r.9..&....XS..J8...dO..HBU.'...S...8'.9....WL.......Q...h23......TQ.2......nIq..Y.....uA...uOR].E.'!....b.B.1.N..........j...0.^>..m...p..%.}.H...6>..J!...o...$hGB..C..<..x.>.F....N..[.....\....w.P.YB....``4.3..k..Z..$.u.A.....lK).N.."...:.G'.@8...'.`!~t".Xk...S...}.............;....`.c.....L..F$M?D..Z.-Iv.P."&X.$..k..........$k/.X.B.x.h...:..?mq^.V.iWP.e.2.pK....A..)g...'qJ.........w.](.y..W{2....p.x.)4{.o...mW....G.6.........Y..@p.}..<....Y.0y..4.YK.Q.d.+.. ....]`.......L...5.n.U.............PR<..l..,bUc... ,.X...i...z.a\.5...G.4......P.l...b..>.....R..K.@c..[.....e.m..........zl.E.@Tuj..k...\|.%.\..,..h7.........<<....D.@.....C...B.....F..S.....N:`.I.2...."........cO.&)f.......u.yh.Q:....fz..[.8:Lr..8.&\.y.k.b.....T[..O...=.....I~.2..._QR.."....Y....../..K. .H.!AkH.b.....].or..~>.H.........YZcKAj......{.i.`....Q..b..V.T..\|:yB........>p+.....g)..u&C&..T.....Z.I.{..O..E..EY....w..}.r+.......

C:\ElitechLogWin\Images\Icons\is-2D35S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.604801986926686
Encrypted:	false
SSDEEP:	12:6v/7Gi/6rfuDHjnqhTDc7Ip3ywb9pWf+aTe8g7iVX+0ogkl946WOBz/kc:k/6r/+RuTWma68g7oCgj9OBz8c
MD5:	308F31E523108DBE4267F5A386EC3AE4
SHA1:	3F4FEFB77301EF3B5F8747081EBD77C8B00F52D1
SHA-256:	4873493C05444C4904BEA5030A0BA2EC1BE4D065FB0F930C2C23EE285BFA47EA
SHA-512:	AD904CEC668CF2ABD8A5D6B5520FD8F88F811841B2CFDF6ED69D36FEA1DCF2B4416B3FEE2EEBFE4A2BE3D788E1347B9BE66B803E36CAC18E65703DB77E8C1F4E
Malicious:	false
Preview:	.PNG........IHDR..............JL....XIDATHK.V.Q.0....* T.T@R...L..C...N.$.........0.@.\.eW#{..,@3.d.'..}.$..`...F.\.BX.O.....7.3..v.~..iZJ.>.g\|o.%../.x......FSL...H....i....s.@...^........`.Z.v.y...#..&3.c=.../Y.K....f.. .\...e.6.....y.v...#U....R ...]g..... R:.Y.I..Pk.8........X...M.D..2......tqd%..!.&9AtL...`s...I..v.NY...4R.C$...l.8.V........&...=t:.G...a.$#..g..}..L`..V....>..,..... ..x<n.....[ ..\|.~..n..../....t........L"S':...V .ZA.....?w...f.....r....=m.Z.......G6,.4d..n.T...0.J.....M..8#.dmJ .. ...S..."....h..Hl...OU...c".,8.,....!YtRg.r...Bu..-..}.j...........EvVw..-Qx.W.x&t$........;..V..x..........,@x........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-2M3KM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.642050986844882
Encrypted:	false
SSDEEP:	12:6v/7iVrhoQ78OPc9czoH/hiNmS1MfNcOCVEh0k7Xe+8FLABZS4Df/yBfQHmv0PQ4:nnor9fHJiNmGMlpx6Qu+8FcFCfkPz+E
MD5:	8DEAD4B7D72EB28310C560EF20F3412D
SHA1:	33DF6ADEC2DE031020D8D9E89A7CC1846D4432DC
SHA-256:	7B80F55B6FA1FD7BF4BB8B73E424870DD3D45D4E3663D6D7AE3BDAF31EA52EDD
SHA-512:	0893FCA57781E3321B911F1DFF26A2E22BB8BC6B1106D17096FD941C4AF203A14F6E5557DCBEA8DB8BA85F5908186C78A521EF20AB8CEAF7F4F82A69C456220B
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATX..?H[Q.......V.H.[..K.A..G....n..b'AA...f.(".. ....C...S+.U....;XQ.$..1)..(...{....{.w>.;....B.@....p.p.xP]e./J......Z..B.s.SC...@..(.>...Z+ .<lnn..tb..jF"1s...d.\|>/.z..zc...q;..0....6..G.@n+..svvF&..l..R.R/.........@.`.F....<..........r..#..K..444X.STcc.\I........'..dXJ...........hss...Q....z.j.,.nuu....\|>......e2...............?P".`ff....A...+.;....q..0...LLL000P...:8803s}}m..`0X1....]3#.......C9........aii......PN.R..'''x....$.....h4.....-p.D.H.@ `v...Y.......$+....X,...$.......C.B!......K..e@E.....Hk...H.S.j@...>....f.......c-..........fzz...-k.D...&TWWW..$..}...koo.&._.....Sy...x.J$@.eKk.J.'..~+....o....u.P...B....D~....J........fJb.\]...)1h/.{*....iCv.r.Q+.e.2...\|.....9.o..i...3 ..ar.<.+..x'......."(...%....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-37EIA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	696
Entropy (8bit):	7.593329488150688
Encrypted:	false
SSDEEP:	12:6v/7ndQZ2uibdyiE1aAEFSN+75a5NxkJZCHflqG0hIkQqYxQOYgOfJRMtaL7D/kS:56bAiEEAd+FaTxkKtqG0hHhYx7PIUElN
MD5:	6E1E29E79723B21613C61A8F461BE0BB
SHA1:	95CFC87FE0D20D8454342F193247DC63A3884BEB
SHA-256:	4C74BB9A36592F2C571F56F7109583ED291713F08E94659096F9422340377230
SHA-512:	9CDE1CDF748E9FBC8208418576CB1A5FE8EADC692981016516A32D37636EA45F06C5C76DC018DC959F9535C336CAAC80BAC7273AAD6DA48DEAC9B84533CECF06
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK.U.q.A..Y.... ...."...E ...O..~X.'20D`..q...X....3..Q....a0R.........e:.vP!.sn..Y..qSM.$.f.=Oc........uI....~x.P....Nv.......w.&.%".0.u/D.f~_.....\|..Ab.f..]P!....~...N........t..4q(.y9..69p..B$...r..w.d....8....D.....r.g.....E..r....Ey\|....x...^SyV..t.p.c.(.k.4}..D..B.........]d..)-..!.:.l.C..d....G(`..%............]r..%..18..=..Q..B.^..l...2-.3..p....y.6._.,2A....D~0..'-...5.h.W.pw..{...l...-.".....x...=.r.n~l.GaT...ic.....6..H.....-..I<...H......D+.#.......N:.[..F:.).P.TD+[b..K+W1...L..F9..fm.......Q......$...D..?&........./...%^Nu...W=....=C........W.T....Xg$. 4P..-..7/.......7}L.=...;.[7=.5..5..k.^f....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-3BCDH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 21 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	319
Entropy (8bit):	7.118775518578914
Encrypted:	false
SSDEEP:	6:6v/lhP8znNa1CgaIHrSvxkvLfqnSUP8GRvlCNM3etnmd6ySbNN68bMwbTp:6v/7onI5aSSvxsLfqnmGRcN7Vm4ySbvh
MD5:	63C5DF96616B604A61D61770AA82B334
SHA1:	F9B0BE5F072D1453A0C12DF4387D406DE6E5D2BF
SHA-256:	4EAC39FB304C5EAF9EF4A45DCD6D52B178F3B86AD962FF2DA191590D78D219A3
SHA-512:	9DDB85B52D41BFC1C6EE82E392F30216D3DD28F61444F4BA659BDBA2741B71020FBA6FBE548D5E781C160D08DF2C006C3952BD75E6608068FA46FE11379230C4
Malicious:	false
Preview:	.PNG........IHDR...............4%....IDAT8O.....@.E.....&...@.....J."...h.i.....u....qg.............`... .R&.m.!.........P .)7..@g..P.I..)5.#..6...>.vf.[[K .f6...Zt.^.+=.....6.c....`....K%}>.@....\.zu.U@%..)(.C.H._)........h...Db.k.{.:6..L.%~.....;B.$.x...!.=.C.\=*.w.............l...OO..O../.........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-3Q32J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.534493054653098
Encrypted:	false
SSDEEP:	12:6v/7ici61TwPouw2zH41dfHYNhOJlesZnWbVTPaiqHaEFVf:MyzzGKhOGsZWbVTii5ED
MD5:	1791307ACEC64D7D3FBEEDBBDCD15642
SHA1:	1A2E23DCD199E45EC39C77D72FA57D6C8BDF6DAD
SHA-256:	9998515B0F4C3F45AFCECD863C7E37E005F85745431F91D4E6CD895A97AD897E
SHA-512:	B0CEE49040B3C843D1BBA4EC46D9B4C9AADA0267F28DD4F884858FDFBAA071430C05EFB0CC0D085B8ED87F25599432A143837EF895D7D1CA27795DA3DB395280
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....4IDATXG.KN.A....u...0.......'..2........%x...x.q......XVM2..abwO.;.Q...WOW#l.......nZE.kn.......-..uz~...%&..ne....x..)..`o....."..-w.9...q.J..Nb.9@...".)w>.xC..X...M..x..N.A...9...4...e!....8p+.U.5.b;.a.f.2w.v..@.m....\|5...w...\|\|o.k6..{..R ..$1.e.l.......{.^^\f...G...r+..S.Lr.F...D\.$..8...L.E0....r..F9`.....5.......s@.I_.s.<.8.......1...Au..(z...dm..~U!t........_.!!6.sk,.\|.J.>.i....8...{....z..N.a.dR7h....D.w...+....C.k[.@....PVn....p..D[Q.t.N4..&..wN*...(M..K.9.\|.F..D...4..4..G.@..>U....a._KM...>..;.K.;.&....._N\|.:.Uq.b:.6.:...^.0..M....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-3TJHS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.431091159634797
Encrypted:	false
SSDEEP:	12:6v/7itBXnNxUK0sMIsG0lHmVrWc/unX9XQywnhk9bPFRjp2Afs7yrLpium:D17UK0sMMdhWOmXpQrnhk9Pwyfpi1
MD5:	A17E9E22E63E3A83682DBD9E2112BA6A
SHA1:	99CF1E38E46F68F3DCBB05A1A44F7C93B6EEC839
SHA-256:	85C1F43D474C032EDE5FC23880C43D5233AD20D7E4D7729AEFDA1CEE3236BBC6
SHA-512:	4DA41B6D8FF1B2AA31244820648C47EF97A8BC26E83D81C2CF2289462C358AF1F77592198182B43BB53C098DB8EB67BB24C616D55FEE2EE267F9BA97E6F3166F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....*IDATXGcd..~..........`b..&...?>~d.?g.%b.3..u.Kn`dd.'F.>5V%..j~~.o.Z.i]S.yp..HH.'...y..,.....C.#h...c.q.M..r.={.).....=.;.d.....(9:.bs.]....Tw.aJ..Ss#....\|....CdI.;.GZ.!..)....esu..S`......j.!...&....8.d....5......:$e....4s..B...Q....h........=........D...v..0h..1..h3\|z..A.....c..{..j..ax\|.8..<...@$.$...2(.l......1..V`.f.H..+`."..JQ...}.u`.....6&%3..8..2.i)..)dH=}....p.a!..1D.....+W...........(.T<<....3........O`...Q.......9....!l.j...E`.......A..T<.......9...@..9=.Kx........%.....juN......o,}.......A..?....C.....,?.'.~.......j=0........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-4ASCA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.508694365561838
Encrypted:	false
SSDEEP:	12:6v/7N/aAFOrdLzWD2nIg3e1dECAr/J/NIArCKq6RBhj5UJBRNlw4AuNp5rxyiOzy:yFO5qD253evRI/rJCeThlqNlw45pnXOO
MD5:	E703666544D75EBBB90359485F0317C2
SHA1:	C7202278D62CCAAC3FE66281DC51AEDCA7959F5E
SHA-256:	F8EBF3DC497ECD403F25358CC72A7E43A46DAF889B789267E2C9711D611B977C
SHA-512:	8D251BE74C77F5B36E3417B89DD418CB5B309E125D2DE69F69602CDDC7B4731AE6F993F9FADBE1E085C8562433620F6326679DCEA6399A00AC90CC283B189EA5
Malicious:	false
Preview:	.PNG........IHDR...$...$.............sRGB.........gAMA......a.....pHYs..........o.d....IDATXG.k.A...,..I.J.!A$U.. "h.)..l$`.He.TF.+."6^g!.X.H.I.".b...C..J....v.z..w3s.`...s.v......\._..v$EQL.G'.Iy#8@...n..K'.......(.=...z.4...f.Mt.-.S.<..M.9t.m...E+.....=..[c.<.h..u.a.H.j.V6.s...(.l.........3J..[.a......`.kH\....t7......q$..B/...O.+w..~...P.[...gmU`L.C.j+.j.0wl.........4.,....0...q..cI.A.C.W.I.#.S.Ww+l...S....j5...#n.q.....x&....@M....s...0".....n".H...Ms..n^R..s....q.>.\.z.C...FC..B.;h....9T..Q...@hE.L.P].?......d.u......i...n4...!..b.Q.....S.&.2._.U....0n...z`."..._.b`?z.~F.m...W.......a....0.~.......tjU..X.....i.(.~.).Tue.E.IP.e..`]3._t..1.j.w.]A....e....J..k.v A...L.HGJ...<..s....zO.k.\|.....Z?..}g..v.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-4DPRG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.72016995562674
Encrypted:	false
SSDEEP:	6:6v/lhPN2mLwMb+QCVtppIIHlZXQ6IzTV29AOTjm/ljp:6v/7gmLtCQ4PpvNQTUG/lN
MD5:	BBA7ABA6DAC37E0D3A54AD778B0ACD83
SHA1:	04DB4F3FC71A843C37AC9ECB6169B8D33780FC1A
SHA-256:	03149CA247BD92A1ADB43DE73E32E46E25B1ADF77B54D698A2A2A8C61CD67795
SHA-512:	D58ABF73906669BCD7A4A255AC63B873FD6EFB3CA506ACD2ADB37D2EF3673D760BF84749642B079CD56F194134AA4664AB72351273187CA97D72D79EF098A662
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8Ocd..0R...,.4..(....d9..h,.N`b`...._...H2......L.....$A&........\"....!..y..........P.0.c.......b.>..@.^*j.....tC@........u6...a.i........... ..PG..J,`q.X=..X...!..3,...:.W.`M...#..oJ.X,.p#...By.....0......k..3k(....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-4II1N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.439757121295215
Encrypted:	false
SSDEEP:	12:6v/7aO162gVYM1+lx6npIZngKO9lPzG0z2XuVDRR:qvgV5Y6npOngVvzLzAI
MD5:	D1D318D8ACEEF77B86CB73C62C6F0BD0
SHA1:	5420CC810049F4E6FC65532DD333D7ADAC3CF43D
SHA-256:	406FB75614BB712182154FEB4667B2E4C30EE39F506A6C146068B38BE3564ACC
SHA-512:	8F60BD9FAC3A85963292DA0834774E476C2D42AE042B77580B5086356E3EF2F8AE4C9F69BF11CBC940C4F56C62866AABD0C659FDCB0F6EB6D4DD7EB86770D7E7
Malicious:	false
Preview:	.PNG........IHDR..............w=.....IDATHK.AR.@.E.S.K.....[..x...l..........n.'.O@............ .q..J........Y..,o.A@....p..#.(0N.V..R.j.t....Q.....Y.D@49..q`?@..I........2q.........,....dA...X.;..M..l.......l.a._.v...(.N<..U.-b.Y....5.>,.M. ...@.g...u..=V....n9?...,m...8RkW..D.;e.nZ..Z.-...J.rp^:..,......8...P......3.cSn..LV..b......>..61x....nD...o..DM.e.....}.. .A@t...I_W.T.....U&/..l......;.<..i.G.LW.t.v)}......z.y..W@8=.<"tB.!9..\|....I.@...f.`T..?.+.I..K....../(wP.j....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-4JIC8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4058
Entropy (8bit):	6.818352708030445
Encrypted:	false
SSDEEP:	96:DSsYkknmWq2Y2u7y/uuYrNNfsTGrcyHnp8ZyHgkUH7giUH5orzr8os7wxFTW+YWA:DSdkknTrYZlIyHXAQyflsXpWtJcFz
MD5:	E6FE53A151086344C9E25755B0F77B99
SHA1:	6A9452ACD33EF9694CC3BFD1A72D2155C0F44818
SHA-256:	86AF808468D9F63CD1582B9002BB749B8A95620A7EDB91AEEEB186E402A61B7F
SHA-512:	6F2ED2B44A7BA85CF718603A4BB337798AD0D2C96E04F12C5A05220C892EFB4FDA3F7BD7DBFB3C65A3F79DDC0E8116F2EFCB838FF56059DE74D307F72304556A
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....pHYs................viTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-06-13T09:47:48+08:00" xmp:ModifyDate="2019-06-13T15:32:14+08:00" xmp:MetadataDate="2019-06-13T15:32:14+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:18debc0a-8586-0e49-9cc0-03ff51f17d1d" xmpMM:Document

C:\ElitechLogWin\Images\Icons\is-4LO7C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	650
Entropy (8bit):	7.454678678722653
Encrypted:	false
SSDEEP:	12:6v/7ihY5Yux2K5t4X/XY+ricdZsxSM8jEAm8G/MS16NyMNRXA3G4BR5bAqlEL9:wGux2K5t4xriUhpEAm1MSuNNQG4BR1m
MD5:	3D088AC292002116CB889BA6952EBCCE
SHA1:	989D2D0361C892C16AF59BBAC88E0585C413FA53
SHA-256:	D539EEF6A08B56EC4000EDCF2C8EB359CC4BBC020D4B0038E8C45B7E8C7F1658
SHA-512:	3A1946FCF81280797E79C4FC2DE82584B44F77F696B63C71E757E9BDF0A1DC8DC6F889B936C402216F146279AE8934273B3D82D2D5F9E455FA4D5D2C1BA98D8F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....QIDATXG._..A..9.7.^...b...{.. ..r.....D<[.......E........VR..]....{fyi...`.%...`>..j..\|....8i...N..\|$...A.7N..G.q[....zy-....u.!t.^N..n<.....lgB...C%..u..g...d..2..i!-..-.T...$ ...).D..:5ZG.bC...l..e.,.d%.". ......'....}.A.OA..[.&..w.O9+.z... P..g.....V7.. ....T.J0fZ.P.Ay_..&].8{.....Yn.l@...l...2..7....\|.]`cvtr...LV.k. .{Y......R~ .0.p\|..d.%....YJ.b...[w..`.d..,...BLu..L5....`.&.?..<.:Q].u.6.j).X.C..[~!..F,..h.h.7.7..C...fC...M.%....M.....T.Q.A.A..].M.....).{;..-6..r.=o.....~...CO..u.#^R.J..X....9.4.\|%.9...y..VXN...u.o....OB Frz....y...dR;.<..$2..\|....5.......!...B....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-4SBMD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 188 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7952
Entropy (8bit):	7.939319145856382
Encrypted:	false
SSDEEP:	192:hIIHUCD4wa2LaG5bisgJuTTlgiK9TtT36G:X0w4GN3oqTQTtTX
MD5:	1523B8A502622C2D0C6A6E53060285C2
SHA1:	AFC47D05AC745C977C9E153755BD985EE6D8A9FA
SHA-256:	E0D715BD24362D34D3FD6483E9D68A201AB7A0626C28C0E3F0FAACE3D0CF3000
SHA-512:	B7AA11FBCD839167F036C0D219DDC52D1112EF4C0B6E7443B5B210CD5CC0173F14274E9A9E10E6EC5B72F84320F4E79E63A5E11639F81C796B6AE199530ED35A
Malicious:	false
Preview:	.PNG........IHDR.......<........s....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\ElitechLogWin\Images\Icons\is-55LT5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	710
Entropy (8bit):	7.60144390271197
Encrypted:	false
SSDEEP:	12:6v/7LQFePeyEgyKTeSivWIYudRcGB05bUyr3DQbUAFxVvVJt3p35kBtCOz/V5oN:8Qk7NDC0unsnr3jAFxVdJt95kBtC0IN
MD5:	A3A9CCDCB7962C0F5BB20A42FD4C80F9
SHA1:	9B994825AC961302CC74C5C2746A3239F400B751
SHA-256:	25ED3EA81152240CA1EC7B2E8867B43BECC17035388A1F4D3F87DCA73EEC476E
SHA-512:	59EB134BD5E71D5F730BE8DB29B0DAE11CA09056861C756D83CF82BDF4BEC75E5933F1D4EAF0242A6C760860C703E76AA0B16C0A7EBA3DD94C4B6859C751BF1E
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK.UAr.1....LU..c...d8......../.~A...../.yA....r2.K.`r..a'-i.^..LU..h5j.zfZL;.}.....9S.B.J.T3.BC&.....l.e.~.<......D\..~.9.Zg.....6,...........bC.....G..<.1Q....T.B.!..V..D....7.F.&..f\|....=....3..z....A}...{.6....:.ep..yo..7..F..j.V6..bm...W.k.\..."r]..].$......S...p.s:!.......C.f..2.L.2.N.&3.2d.>.......^.=.L.w..jCWT..e}.....2.>Nz.Y2..%.O1r#~.g.@H.)=.<...6......k......IB..`.>.(r.p{..&..8}[0..$..M.....[..o..~..p5..M.0+ta..........Uk.....[.h.2..w..I..bj_.T..%...-.N..vlY...........aB..N...Ja..h.z...$<..o.V4O...5...pc...}..m.X%...Q.J.m.. r.g...4.*..M'n...H..3.>.....-...F...D.}.....mm..<l}.\.....).%.d.+...g..cz6[.w....I.........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-5BFUI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	841
Entropy (8bit):	7.676663184223963
Encrypted:	false
SSDEEP:	12:6v/7iojIyQWnV1wr738VDJGMrdYYkozs0ZAQSUVYPgUni5OZgTRdvKrlTzOD7v7Q:mI5Wnkr7MpnWeAR7i5kOIl/e7dzwl7
MD5:	45B1E10946A741D3EACE8BA0211C735D
SHA1:	7AE827ACC0EE5737C5C9E51C4E1B8659813E1364
SHA-256:	88E888EDF07A325AD3FCECCB646E163F52289173004CAC5B071CCCB3558967F3
SHA-512:	EDFDECF1A2DA357CDDCBEA6282FC9983A12BE538DCD8CC50878105613FB1C17208DC22DC41B889763CF85BCCB97CC0DF3D345370A9AF030FD67DBBE95B26FCA3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WMRZA.....p.....O . x...`.p.....l....Bn.[.JN..%H..=.......YQ.....C.pJ.v....@TB.\'.9 ..0W.f.y...Y.c?...R...$.SD(..w. d.Z..._.mw..*...[{..P......Y}.."..X...-.l.X.a#f..N....@i.h.7&...}..O....e....@[^x..RN@..X..\|....&.{b.@y.....G..X1.2.6.........7.B8@..Q.2..b.^.....'.<u.W.S..~.hc.....4.MP.Ph.........+.....qY]..F...~....c/H...W.r..Z.m..z..J.x....".........@...a.NeD!.5K...../..O4Q.\|_.x. ..>......r.QxV[.2....,......_.=Q.-..5....u...:be.dy..[..r....."3.]..!X..[..v>O]a....?1q=.HO.&a...i....B.I.Y....pt.l$.ICW!.../..X..4.x.Z..Z.R...X..{Z......{I.....0..r.t...H...5..Q4...j7W.;n.{.0.........A<#V.........n..PT%n.^...@b....Yxq(.....~(-.r....Y.H.u..:...6....B+...:..."RN3.X.w..\.m..$..^.<.4.&}...$...0....[D.b....ZN...M.d0...z..5.B$.+..../A......\|W......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-5DRR4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	466
Entropy (8bit):	7.26750530654124
Encrypted:	false
SSDEEP:	12:6v/7in9mVE05KRNg/U6O0uyUENhAl1uIbCK4r9w/cWJSxyZrysl7:Z9mVPeFbsr9MyxKDl7
MD5:	C7FF13C2977C82CD8070D8FE6E15A103
SHA1:	6888542CB4E59C16B57D274415441DA8F0C1988E
SHA-256:	6DAB1F775E089F06B65E7BFE0118855257B96199AFB1DFCA56AC5BD7951A7C6F
SHA-512:	36BEDF9C043DA3C8354E074D34746EA3819170904605EB095622060A56AA5C1DBDB0E4B6C97FEE3AB07898FF17AC59D9A0C3DE14C913A84335CA7D4141FA0DDB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..M.0.....2..P&.&.l..P&.........A..&....d..#...'...{...;.m..[...h4......d2c..?5.....V\|i..+1.`O...3..../........G........`..O.7...../r r.\q....... R.GJ.(.2e..w.... N.?..-.>.h....X.g..2J..B.}........B..v.C...U.p...E.G.=..p.^....H.M....Kj.N......}6.J..=..;?_..v..J...m.]............G....z...3.....d..\....}kp5.f...`+.h..R.......B....]...<..x...!..Y..nE.W{.0"...S'...\.......a..y...Rt!.-=4....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-5M73O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1030 x 249, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20013
Entropy (8bit):	7.902461362168988
Encrypted:	false
SSDEEP:	384:7UWPbcxojN0X2qj2pLEoWY0DFF2aIDoekuWajU/6oMMH6:7TPwop05j2piDHetxoMMa
MD5:	9046D3D05C5F2CDDE8C3B102279BFC27
SHA1:	D5D1273FFAA18A2E93A260C6644B6E40C681585D
SHA-256:	92D4C3678A11A3969E065A5D653CD2CB9AEEA33AB822CBFB96C08AF8394AB5D0
SHA-512:	6EEFE0221314BF131DADD5BB693369A6A15766C47A6966DA17A267C8FD69AC655BD24DB6F5031D8D5CBE2DA8BBCA9808F7B54E3E7BF6053F0ADBF7DE39765349
Malicious:	false
Preview:	.PNG........IHDR...............7... .IDATx....x../......a..`...P......s."...^..z..j...r...r.r.uh.[.#..\i9jAP$.....C.0...BH..nLv.......=.....N..o...2...........L..........s.....................C`........c.........x...........!0........1.........<................................C`........c.........x...........!0........f.........`...cQ.. .............x...5b..cbcE..\yR<.....a....m..+....G;.9.mvF.E.............g.Ge..U{...=..m....1.s............oPy...{.}..?.3.y.xX7.............Q@..............Z. @`........E..^Z.5....hwE....R....U.E.3..g..A...;&.............p..............t.?np..k.N.).a..S......F.....=D....s..........8g..21.."....J...\|i..);a.....U.c.]...9e`..).............?.M.4..5...4.r..g.0^Z.........8.F.......(C..I...E......*1..Q..(8...A.[..............`o.Sb...Q7.&...k.H}....e,8............\|.6....%.M....fx.1F...........[..&O.#...`..@..g.........R.#..h.m[P..zh]...G..^.n..........(5.....>m..../..mZ.XUbbe...w....d........;4.......l...X......

C:\ElitechLogWin\Images\Icons\is-5UET9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.837272920124565
Encrypted:	false
SSDEEP:	6:6v/lhPKyQEk9Qz+IfnnSnKy2t2x8wTTssYuhbRpf1bA9K9Esto0Hlp:6v/7iHnQKcnLBtuQK9EGo0HL
MD5:	840557465A1CA133EBE26C3FEF085315
SHA1:	26D1A35ECAC449912368B2E343CB020143D13361
SHA-256:	B94A0D1072846FF2246A174022C95D05C522EDD56B399145BD66A639C541EEF9
SHA-512:	CB62B0F3A4EABFB9C3BDD9806D17D07FB5C705CE01E4FE818D936773ED7FB0B32B5D7AC13653EF2DE6488868A228294199378E05E2BEF660C4B582CED0D6BD73
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..A.. ..a.B..K..4...d..+.L ...y..B7....b...u.?&..._.Y...../.O.O..,........3 .oA...8...H.A@.K.P.L...Z.(....G.Y@....\..!..=....;0v..v .8y..O..+.4.................R....{ jq......E q.`E.q..EX.f....)@...i......B....r....E.!7.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-5V8GJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	890
Entropy (8bit):	7.676773138293751
Encrypted:	false
SSDEEP:	24:nJ8lwMb/aiKpEg6DmAZafSHkys1P5GNXp4:ylwa7KpLynsMs16XW
MD5:	58FC884C974D2AA42F5BA900EDAC4114
SHA1:	B0C2DDDA32E72DED12DE78A9EC1AF3AABE2AC2A7
SHA-256:	E7E4A89FDD5BAB821FFAEC4B203BE0B7B0388E7AAC0993551A063072B95DB514
SHA-512:	F4DE6ED3EB860A8045DD95D972A17F7C3DCEA8E6789E64EF692F5090730A1CEDA821D765BF1C55E3286D4D171CE982487A61ECAB965230EE4C59B19FB7913B33
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....AIDATXG.VKR"A....3.i...!l.9......Ka!.@<.........`..m.....Jt......$Z.p#.D....../.......'...n..LGL.y....@.......@.y. .C...,=..,....PD....tX....=..82...r.Z.k..r..wsOn]^...o..l...&Hv[^.!:.....l.=..{....CrAB..J.n...^..pd..g^...`.....[...D.,......b.1...'..o.J.F.v..GX_..w.TTv....Xf L.....\'..TS..n3s...D.%........z.YW.....Z=..Q./g.q./.0Q..XA..6....V........J`.?......$.......r.f.B.FhL.t.....`.R..U.(.Q....y..b\ha...y..u}..).%...3...2L$..;t-...-...U.~0..]5.1...@..&J........i].Rxo...tyU0Q.....}......9..@d..dU\|V..B\|U..jz.md.r.4.>..<.....4.voT...@...-.'q........<......4.y,.\.Z..D....nH...TR1Z/......?.......s.'.a..i]....k..+,...<...F'.....\.AL..KU.Z-Z..b.....T..Y..Q.....{.p.p2....f..T....m.,....+...a.......?..a.cy.u..m.kX....\.Y6.. ...].+t..X13@I..2.....T.6g&..:...gQ.nL...H,.,.........7U.m\d....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-5VU5O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.351790659789098
Encrypted:	false
SSDEEP:	12:6v/76W5TIMHH6v+Vuf+9w1QR7vig8EVQP19LHa1:fW5TPLEW9vFig9VQP19LHa1
MD5:	9EC3C6B9E2E1CB52B406C3DABD27E8FF
SHA1:	C95CB1CC18336631FAF28EBBCFE50DA27AA5C8DF
SHA-256:	38F30513F51A7EE5E9D7AC3024E187047E625A04A0D0F361562637A8B4E99138
SHA-512:	E818C6375570DDFC6B5EF7013D6ACC798AF7B6CC6E75C5C8A0DEBAE8A04202D412E7DA06D7E8D7E8DCEE7F931783F25D7DE3D80F03BC1AE0B0C78492AC224698
Malicious:	false
Preview:	.PNG........IHDR................a...aIDAT8O.S.q.@.......SA...+.]A....^y2..tbw@....../.....\...ZI+i.c..K.teY.1....z..j..2I....T#....^'Um..q..Kl"@....t ....Ld..@.#.'.+#..u]..:"}...(`4.m..Je....&p#I...L.N..y..?R2.3..eY..>.nJ.G.....;..i......;la.....h...$.B.`.{.$.I.9...<!p..?..UO..F0.Nk..j.....g.~.un...7k......q.0.+....KY...tH...z.S..].I..l...<"...z..........C@.8........U......U.....L....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-62MHI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	7.651241143946083
Encrypted:	false
SSDEEP:	24:V5+3hizvVrImwOf+GYyoONhxSnQoVR9izlWH7MRxQbgginineROKTcx1:CoRsMfDYyoONhxPoVRABeMKgvbK
MD5:	3883B1B16F0EA17F84FAD118AEE282CC
SHA1:	7BC4263ACC48827D415C1DBE0905B93BD01705D3
SHA-256:	3B5C84A0A37BC3956FF24C2E8C77BA5DB09C2BC7532A14A0285F6F43A8DA89F1
SHA-512:	2A398006AF30912B0329D2F8FF3EB0558DCAAB39BDB7721F2D2956D25004C201C0A094AB62095E8A935925DAE69CD91BC2F7E37C38D6E9211DA9056DE18A0FFE
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^..q.1..........H....T.......R.P.I.@.0........g....X....H\|.C../"7E.8..h?.....o.....upGD....D.Hw..,"_D.b...{f.x".&......".q..Y...FD.y..'..j.k.0..;.O.....Cm........... xv......MD....b.?...^./D.............'..B.. .M..........(^.....m.......j..._..6.u'..P.@...Hu...n.M.{...R..\.P.@.o.9...Hv Vx..)._7:.X.N.i9...@......xB..k..'.M.....]Q.... C..B).awX_(....{[2..z.~).XB(..xm......O.J.E .9....%.:....4.........^.f.....f...[C.-..........h..`!>hd.\...<.3...x.,uL....K.k.,......q..o......<.o...,^zF!x.....f.....[<6...5>..,....B<z..0+.... p_n.......s...V..3.C...........B...]K!43.... x._l..@..E...........X....].O..^A.5.)B/.nY.......^...9.`.ZE..z.,.:.B....}..[...R.[.......V1ay.b1.bhfk.}i....n.....I.F.{{.....z#\+...)./. (.......agQ4...i0[.5...f./.-.{..xK.[.c.Df..z....[@....[6H.....K.l.K....m.k. w>.gZ.....M................&'D8).m.#2...x.x..M..j.m..J.\|.....r+ r...=xMA.q/.E.n.....f...l.9u.a.\.... .Z7.D...N.D..'.j..n

C:\ElitechLogWin\Images\Icons\is-6IK7Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	7.815751368541433
Encrypted:	false
SSDEEP:	48:R4vONDdOZIVbdSRqjmqg7kiVBYgGDdQiCsX/lUi0RqgZatRc7nVz:jND4ZIV4qjmfkoBWdQuvGHz7Vz
MD5:	EEC9ABE37ACEA108219B920F8314C27F
SHA1:	50CD3A0F1D9E654A8FD20BB0B49BE476DB27B15D
SHA-256:	F756D6EC8516BF90CDED07CB5D23493C0556B97F265CB56AF1F1AE6D48E8828D
SHA-512:	B87C96BFEE8CDFC9F011449427AE13A8B61CD7E7316F187BEA4F23E42DFC47DEF956EF3A0E0C8D0A32419583329137441E7533A174D8B1006C2C92B939930162
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB........YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y...]IDATh..{p......f7.l^<...!..[.Ly..[[.....PdZj. .Nce.V.h;2...t..V.(.8...(Z...L..S.R.`..&m.....$...~..d7..fwC:.393...~..{...s....`0h.f._......\i.Nx`...9.I...^..^..C.b......u..A2..:....$..1....Sjw~...S;.........<...}.....aT...R.....X..0..y.<...x.~..0L..).`-....%./..j..L.p...a...Ji........N.:L h.:m.s.......<.../MB.RB...Y...5K..@:.O.w.....X.=...7.q..U.......?.tt4..+......,......p....F@.m.A...X....JY..tbx.t..K<..oJ..nNj.s...9...{w...)]....\.'....6b......=Jy4...e..R....x/..+..2.f.O?w.#.-.\|..8..{R........=...[<..`.O.7.n-1..(r....\|6.N...S..4D...TVB./..E.l....

C:\ElitechLogWin\Images\Icons\is-7KMTT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	7.563304778908065
Encrypted:	false
SSDEEP:	24:fonSynYtnUhjxYlbyX3ej016jQP7KE6K6CM0n//mM6lSIG:gnQsjxYgXM01OQP/60p6lSJ
MD5:	F55BF6DDA2B1ECF41CD6555E5D78EBD7
SHA1:	FB27B0F8617406AA5F3AF66BE61F14368B8277F2
SHA-256:	BD225E0450F17FF2A29335B201AD2FC35572198FB6498591F581560DEE5C0645
SHA-512:	557334820EBC65AFB3742548371F65DD7E2C89A0930F225CA2A4138A75AB38339179F93B7C0F953206989996CD047641191FE26099629653601DA654F0FD983C
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.q.0..7....T@R...H.@.@.....T...T@..R.P..g...X.eI6.v.39dI....{R^..c.9T..?T.9.....%"..R....^..Q....+.s...K..P...u..%...(.z.KM...+0`J.,....R..s.Ay.x.."..`q&RKq.\..q.G...@...\|<i.._"F.TA4.....).[Y. l...1...p.(.3F...Ac.../B;n..b.w...\|....%..N\|...`K....2....D..P+.'e..(......&..........."......_VT.,.......).Hu...B.f.g.+H.B.D`..........%..),.a^I........;.y[r...V.0..... &....-......\Y..5.-.`.. j....}._.i..;K.[.....Z.........P..]..C............#. ...........h..Y......j.?&.k....X&>.Q....jr..j.Z.p..9.....H".}.E0N.D9.....2cG.)Kft..j......]`.....}.......9....6..ai. 7=..B...}1...a.'.<%.'...5...D.}KL.p.7E.!. .u...p......a:..,..k..-..[Y.....j....F.b...qAbj......B....Q...P%R.....g#..$EuX# .....a.. .h...(F......t.O.c..m.\|QR...>...!...o.UY.t..\....k.-1!H.X.h...0..1Y.....lX[.$...E?..p...j...B...w./...AW?..[.b.V......)m.?...b..$xj..........h@..F.D.Q..x..4..R\..$......G.n3..,.P:..r..R.......9....m.`]..y._.........l...

C:\ElitechLogWin\Images\Icons\is-88K76.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.69382344574231
Encrypted:	false
SSDEEP:	12:6v/7i538P91lvWeqtEjzV/uI7FGZgVVLrTBcV81hY32q3dBOTvajHVIvBL3Zin6V:nKHW+mIh9rTBcVsqKveV6Bgnm9B
MD5:	13BEF9E5A1192875EC8150F9FE044D0E
SHA1:	00410CBBA25AFC46B3A98C3EC38CCA865D0E2AC2
SHA-256:	D866DBE9BD1CC1345C4D16B854F1A41185807DEE095F91BC89A19CFEBE3947D1
SHA-512:	3831499E800A914BF7AA94303A30B39351D03536F8A9EE10A093DB6C1F70026FAA5DA3556F03F17895E8B85B6CD7D35E6DEF450BC0049159AD33895ABA7FCCF4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WKr.@..V.g...@U`k\|......d.,BN`8...........o..H. ..N.Q$....Hf.ri....L?.N.......`}]W..^#b.....!.DX._....Z.9..N.."..T...21 ...o..H...`.`.N....eM.Z..=.-6..z...<~...pV.z..%..j...~.....t...S..g..j.L...n-..`.-\|#.n.<#..3..>.A......R.....d....WsD..?B..Rj.z....e.y.....33.Q.ifw.....P.<..7......R[ ...U.n.Wz..q...F...'+...,.gz1+Yi.t.jG.....c.)B. \=7~h.j...s.....V.`....w".C..S{.(k......a...k._.c../T.7...Z.............d...g.X..&?l......#x..."$Znz.."....:.1....6..j:...c\Dq.t..@....6..1..".Q.....].A.G.;..fx...D.....f.....-.....8....?....Nh.....#...f.......^y..=.......Ca.%.s.h...!...\|...Xo..z1S.HSj....x.5..>../v.]?.}..D..x.;Rl..AVM...r]L&.*X.0!....\...0."!......g.J.=.V..s1p........Il0........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-894UP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.736198150587555
Encrypted:	false
SSDEEP:	24:JP3gNyb5MvYp33eWRfRGee1hnVkpYl9N8:JfgN/vU01RVkpYl9N8
MD5:	F9D9324AD3182CCF7DE1D306CCF964C9
SHA1:	2A601DEBB5857BEA366A389D67D0A6BD628FD19C
SHA-256:	EA78BA46CE8C9621FD61FE51C44370E1E0AA298CA42E0ADBC09F8768C6EFC792
SHA-512:	CFE7A9A5487A20F705ABF38F2F7446E3A1E2691A9AEF0C4CB34DABF4DA56789483845C12306DE61C808222605CEDBE9E5407CAB63A292A814DD07B86FC35D465
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....`IDATXG._h.U....i..vg.TAZ..T.V../!.fk........Zm_...R}(}.d."E.E.b....6..j.`.dv......Ze...d...f&;...!.8....s.~..q........V{....... Z...D.q.R.q.Wy.......`.>.A....0.....X.m.....l..+.2...P...8... .........x.U.....O.;@..5G`<...N..... ^.Z,"...m..d.......2.....$`z.....z.f.....R.e...5(8.&...+..?N.L...e.d4,.<..K+...@>..BDN..No}...fdz.M..J+H1.p.k.q.ZE..-.L..DOu:g.,.T/..:>..i..S....f.X0?\~ZAo..DT......L...U.Q...)..*...ju.\|..u.....".!.k.n.$.&.......V{9..pw..\.<....".C.Wr<[.qK{4.G..X........n.X..M.._[..9..........&..e....\|..=.....K..."....P.z....L8a[.'`.)X....+..(4..^u.&.......J..n..S...F...Oj..s<E...........L.V.....E.i.:/.......O...l].o ..Mo...}.......&#bX..C ^...........-C>...".A..A...@..ME.F.m.k.H......x+......+]?...^i.E.......</".........E....M=..Z.Ay-..b.IX7.....Kv.r:..p (8...9ft.Rg....^0..E......U.A..3mj.....OT.U..X............0W.:_....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-8GAGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	695
Entropy (8bit):	7.641116702192887
Encrypted:	false
SSDEEP:	12:6v/7t5esRZRLKvynfL7piV802MmTBXZ8X0uusxS0JZq1FO5m6f9:KdL+UfLIX2Mv1bDZU4mQ9
MD5:	5DD24D4DEE71B2021EA8C9521264F2BC
SHA1:	4DDFE0DAD545E368DCE7703A9B9DD234DC3D31CD
SHA-256:	FBCAC8CEFDC9A047BA9D68C247E0EE65D6B912796DB67F430C283443EB50B925
SHA-512:	086C1156C8D9E084534474FFD88D02EDA22AAA9917BAB7CD8759A5292968DE93E7B6136B04779DB015BFF4703D5CEFB58C58C232DF81C80873BB3800A9E399B7
Malicious:	false
Preview:	.PNG........IHDR...$... .....z.....~IDATXG..k.`..O...K.....2.A..2..d2aNo..6. .....w..EE<..d..C.v..?0..Y.f...k..L..?.4.....}>...y.....`O...yHD....'X.d......o..x7Z...a.;.q..O..T\.:.i-C..,....s.....MQQ3vI...%..BY..u]...>...\v....2..gN....o%...._....A........N$B.hy.1.%...Iq.)sa.......J....\P..T..Y.y.+......:.T{..L.?...nI<+......)j....L..,S.t...@A.....F..8..('...\|;.d.\.SLk..- ....T.ed..`....K...n.Oy...z...(.q.c.H.z..dP.~.G..]'...BUY..6k..U..y%.)rc.=.....o......5..B.h<.u7@.`..o.#TF.k..^....).4... ].MH...21.<.F....y.n...#...n.p.@.JL.t.."...*...L").0w..D.S.).~{S..+.....p}.....&.C..voC\.F.....G.\|.z8..+........!...2&R...w..'...#..F_.......?67......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-8QL4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	780
Entropy (8bit):	7.649232897330324
Encrypted:	false
SSDEEP:	24:50P6hj2HMC7yvOIF5Dg2ufJebGjSxsBnykWr5DXd:o6hj2Tm3yOmBnrsLd
MD5:	285AE9EF7B55D0EC4C1EC3CC7846D40B
SHA1:	075B6339435B667E4BA4D6E96FF7A43FAA578479
SHA-256:	1EA6ED3EF7BEA93BD0B789347F7A92E3211901A81B43560081D8C0954991A8A9
SHA-512:	C467D7670F15FDA09D0439E50FB272E25657F7668698BAC12E7496CE291DD79EB31816C3A3CDD68A19EC95139163F4134C376D41DD8A60B7BEDB5EF23D7D771F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAv.0..Q....@.^....... t....BN.Y@.!'(=A.....^...YRx...m.1...c.o.d..?.....G~.....p:....5tJ.N`...8.w9..P...e...=O..Jh.k+.p.....z.w...$......u6....d....^..3.5A..p...X. .....%..................y.`.`.....# ..l:....;..@.f8..lwL...W...C..x......d:c..Y.}.w........h.3n..%B.r..u.d..!.jG.l{..E<.......Y"...........V>".t.p8~..rT3..-....y..Z:..O.........!."C...._=.Wc.;......4C...".S.f.E....U5v.is4... x.D.8."._y....,P....!...X..R..D.1.'.:(.%...d1..@3u...6..9.p..u.......QA.^....]b.+-<..\z......S...lTq...@QL._.<.E.i.mh...,........W.;,8.Q!.M..2..(.....33@WG..B*.7..d......!.......d;.m)../EwgAp..ch.-p.6..Zz.I.D.T3..gt....x....Ob.6...y..........!j..%8(.....7.!....-.$p.n..l/}..CK\.fG......0C.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-8RDFG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 188 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7952
Entropy (8bit):	7.939319145856382
Encrypted:	false
SSDEEP:	192:hIIHUCD4wa2LaG5bisgJuTTlgiK9TtT36G:X0w4GN3oqTQTtTX
MD5:	1523B8A502622C2D0C6A6E53060285C2
SHA1:	AFC47D05AC745C977C9E153755BD985EE6D8A9FA
SHA-256:	E0D715BD24362D34D3FD6483E9D68A201AB7A0626C28C0E3F0FAACE3D0CF3000
SHA-512:	B7AA11FBCD839167F036C0D219DDC52D1112EF4C0B6E7443B5B210CD5CC0173F14274E9A9E10E6EC5B72F84320F4E79E63A5E11639F81C796B6AE199530ED35A
Malicious:	false
Preview:	.PNG........IHDR.......<........s....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\ElitechLogWin\Images\Icons\is-94DQM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	503
Entropy (8bit):	7.257423485506751
Encrypted:	false
SSDEEP:	12:6v/7igHAfg8nsV3sZX209YAY2c+sVeH5fqZ8jHOsutayhkSb9C:mSgF3+G095Y29jfqZ/v1h9C
MD5:	82116962FC77734535642345E6B80883
SHA1:	7A8E715C8CE68F1546EC2C8B710B1A028304CCAF
SHA-256:	598982BE1255D0D937017F0A3C4BEC5EFBD37F383FC6FB1797618A8D99CD7F27
SHA-512:	07A4E8F265F75F664850E8A6B6D7011CD658762703E782D4F02C8CB84ECA61D7F568B3A24498B2B06BD0DFB65E9EE105F310592F74A41D8702C5662E35862618
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXGcd.`.8..3.:..!`..e...>...N7..,gdd.?....N.....]......&Z.........S...d9.j.y.....7.Z...@...Zn.SO.....N`dd.[....!.`..............q8.!`.......>'+..A...7.....?0.....!).0..P....L%..,....p...\.7..9.....!.......:..@t.....,.W=E....AT.......C@A~.Y...;.B.!.P+..A..8B.................x^.b`...A........x...+..r2......A....j0b.r.O....._-.!.w..=^...BD$5....?lL.wl..^j.`2.J.9.<n...lC..D+#.....E.6D.L.BB.`.s.%..i,..F.0...?..O.TQIt..*.a1d......!.as.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-9CUUN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	7.023181535859194
Encrypted:	false
SSDEEP:	6:6v/lhPWvfKdffb1T8QHERqObt6Q36DSLwsz/SytuQP1xYIEtVp:6v/70fYTJHERqOMQa+zz6UjP1xY/
MD5:	18F7099E8F53AE6E6FFEAC54246D773D
SHA1:	8446705D79B56B6E30B05727986C3752ECC3211F
SHA-256:	88F8FBB7B64EB056A18AC2B3C085050B0F57F7CD77E2E4334134F9B739F9DCD1
SHA-512:	9A89CFFCE8FF7D34FC44F4502681427B8603F65EDE9BED412EB5034915D0D029D9B93E7F319878BBE1085E5262475B01A974171A651095EF014BCF3154A872B7
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O..A..0.E.................'.o.+...$.............3.>.F>d..4........"..\|YAe..s...t..$.p..:..;.".N....R.i.3z...U.?.F...............%..m..-.M.<w7...\|.Dug...N8b..U6....a.n........>D.\|...I.mc...A......Y....a.K.j....K....3..$.e...e.Q.. .y.3.....u..7..o;....5.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-9D3SR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.743624362063275
Encrypted:	false
SSDEEP:	24:M1CQBrcoBuAoJaqLnrFBLZlY10+BeeNDciqPsfGZzRxPpTA2q04Rm71IpOKcX:wc3nHLnH80UPoiMsfGZV7K0SOPX
MD5:	F17879B0C2A44C07CF8623F43E7371C8
SHA1:	00D56425410DCEB6FD23A7D6A68921FF78DC9828
SHA-256:	C562B3C7F5A56D0149B42ABC9DA31F0767A477F4F119967ADDE0FBA7F67979F1
SHA-512:	2619D87EA80FC4467FE44B39D44977A8614582DFAFCFD4BBA3C9A9571A77B5CA048E88D61DF2EBED09E028B7E4C13EB210E8458661FCA08380B65DEB98BB360F
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.[l.U......J...z.M.D.....T. m.Da..JS.qM.F..5....mb.a!..-.6([$...P....^....F....-.[;.....lwv...,.$..s...;...E..mq...$.M.......+.\|.}u~...XO2..4P..$.5..Z....}........r.....$Q..A'j.....o.4g...:..^l.$i9.E...<;..h...rC.s..:....2..y..p-4H;....:_..c~.....!...._*..LS..l..'......./..:.%[JjNZ..[.........(zw..n+.l..J...v....3.....BH...@H...p.....tn.ks5_1k.I..J..8.\|"........x..9{...Ig.L..m.,.^X...-.4.n....t.]..?.1......T6..`@...-.LN.}.[....-.@...+....-C..... m.`T...S.iM.+.....M?....`.Z........A9....4r.;;&.P..5E.T[.`...(4<...tn_yh....b.8l@.F. )\..%.... b...".j..: <.$.1.).h.H."..4(.H."..$ ..Q.........)i...?..4,...ed.._.9............O}W.M..61.J....f<O.....\|O.. xZo.......S...rV=...r...Y.m....?}.M.q.s...$.2yO.7fw......K?./..4(.4..qD!.e9...uj..}..ygM.W...=..j;...W.!p...`.....X............m.....s.;.m....f.g<:\.`!...`..../.Or./.P..u:9..........e.A...3.X...N....7.....e@q..D...[...i.-.F.;.t~......F..WQ.b.h..7..;..UL

C:\ElitechLogWin\Images\Icons\is-AQ0PE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	474
Entropy (8bit):	7.392245123665088
Encrypted:	false
SSDEEP:	12:6v/7ivAh+s4LoLaaosm3v2hEvwA839udp8OGc5I/HONmH2Xsc:BA1IouCGz8tudIPvAI2Xsc
MD5:	B8DA427255BBF1016F9B18C3A30C477E
SHA1:	359E029583A101B77E667D78AD1164CF6AF68FDD
SHA-256:	318C954225F12C665E285DD4A5D92930C5F3EA461810E65C1EA5290B57BFF544
SHA-512:	D64CF08B063FA19C2440854AED5107A6B60A9DBFC34DD30CC1510FDE5853D60727F030907AFA1B113331D98ED3DEF20804C7B2E1ADE0AA7875208C8054E64B0E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.M.0.E........e...2.0.... .......t.`...%.jb'...a.+Ml....&w...c>...6.."u#\........$\|.6C.8\|...F`.fG.../l@..^Z..O....]...7DP.@8sJ..j=..P!.sG....(...+K...0...M....C.=k......B.......$....x.. pnU(I..^s.HP..$;.J..X.7...j.....C`.#+.Y.........:......G0.Al.?.d.H...G..W1.5.[vP....%+.7...b.#-r.8.;.;EC..(......w.,L..}.NS.E)....&.Q#...o..:$@Y...v.M... z.lkL\.......6'7...9.kFWkF....9...M@$....@...6&.....!...x....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-BI9G8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.659876966836795
Encrypted:	false
SSDEEP:	12:6v/7iRQD4oFdv9XM/3X5tYOK/ZEN3r0HMjrCLPqdJqp4cny7stONjTLekYk2:73C98/3ptGg3rJWLPqM4cny7sYNjXekE
MD5:	2323DD1EDD0465AB0DEECF2FEF4F8297
SHA1:	7FAAE464D9020848A29C6BBD68B025EC16B5209A
SHA-256:	839810D830EA3B572EE05E57A62E93D48399E8DEB81E589197B5ED5C786484C2
SHA-512:	B0667FA13FC63840EDB89B84085046474945F3FC6EA93DF9D80683AFDE2AEFA45090093FA61E44C80D326CCAD0BB31C5CB5CC6216731A3E2D6B8AC741011756F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Kr.@......!.@..59.p......T....x.YF9A.... dk....yD..DQ .@..X...f........?x.....U..s_0.....@G.l8..}.....w.r-.y.h.... ...`0..s......E....o....OHh..9....8+.>V...d..#......15{...qvUHM..X..R.......L.... &..m.......A4W.15.e..8`....@.o...@..I.<.`9Fu.TW....p.........mX... .yh....B..ac~.b.@6... ....s.k.QP...l....m.Q....'M....f...PF...h{..g.ff..r.B. ...6AG...t....?NdY..c.\.a.B..3..Vv........0w.X...%..S.bLx.....c.6.u.....X.. r....J.d)j^.u.%H..:l.....&<..nL#..}.n....<..ap[.(H>..F.\|'......P=>..[.....!]...$..?...4/y'.t!..#D..j.pv..m.[w..[.3_.w.h`1.jX,.Z...q.G=~S9..........0jl6...D=}..}n...m....H.......O.."....eE..7.e...t.*5......^.b+1I..>....!.w..J..7.N.._,..W.X..............S..q.G;.Z.t....^.....0..W....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-BP4RH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	231
Entropy (8bit):	6.275216877597046
Encrypted:	false
SSDEEP:	6:6v/lhPck3tFrCyU6bc1BsCuVE5aDz4jnr4bDBVOpyAuKdp:6v/7JbCy4BkvDz4iVGz
MD5:	43163DCF3E558DD7A68C575CFF8065F0
SHA1:	EE7D7A0BC8FE86017CDEC29A2CDBB2E3F6A5FFFA
SHA-256:	EF24B54A0454F1330EDFCCA6F66DECCB1974AA97263AB74491CADC80E96C81B2
SHA-512:	EBBCC3EC0E8159C289B12220812A191352A4582F18379F665056D1F2DDCE51BB631DD2232D011EC93693FC9E20EEE0D71CB0FA4DAFEDCDA3F225F12C3C3B525B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8Ocd..0R...d.. .'.. .......f.D {.....\.3@...@.. ..a.8.9..8.J;...h.* .-..Aj...h.r.H4.....f.F ..'.....v.c@..... :.f.H."..\...G.FR.R...=.Bd.@N.9..d\4. .b.!MX.)M......r:L....)&........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-BSJ6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	7.6306628995991295
Encrypted:	false
SSDEEP:	12:6v/7iHHRhomN8KnaLP7rcJu1aNJH0Rl/77zcfPzNp2YOFHVSGK/8durU6PhFCVlV:JHRhhba7IukHRpGn82n65FkP
MD5:	7ED8E819EAF45FA3F8D4C69E37EF752A
SHA1:	321908EB98B1219A9CB8D60D14E6868B84AF2473
SHA-256:	F4F114F3548674AE0B2B4BC5EC6B37C1D7BC17FFAAF80B7DCBA3A21835B876D6
SHA-512:	B8F75B5129FBC954EA647D1622F919FFDB95525073B3C130311539EFEC8E4D08EDC2587D5F9065F298076A30250DA90EC1A018686A410522ABEB16C29F9CCFC2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.W.m.@.. .........:.T.x....B..:.......B.t@. ...9....;.$.a.wfw...F...1~&...tj.N..a.........w}>..xf.z..n`Z.&.I.._..........".>...+p...V..q....r.........i..&...A...[e.$....".....v.......F.)D.c.Pkr9\|..=).!..._...D....v<....P...s'9#QZ..L`...i....P(...~..O.'mQ...#.j..&8.:...'...\........I...C.3.yE..d#.p..1...p..........l6.F...b......fX...~.(.Y....-.. . .@J]p.m..n........m.HH.....r...i@I.Zp.S. J."..N.B.#..a..E....l6+v:...T...; O..O......5..^.N...cy0.l<..(..UDA...X....R.......Z.-.....y J.I.y..e.n..p.....(..SV.x.}.H.......j8..J..L.d.Ll..4.........F....JN..K...!^.=.WP.P5..h../.feRJq.Q[...`....d..dt......67'..!.O0.s......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-C9AQO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPCM), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop CS3 Windows, datetime=2019:02:14 13:19:29], progressive, precision 8, 500x300, components 3
Category:	dropped
Size (bytes):	36368
Entropy (8bit):	7.540958381336001
Encrypted:	false
SSDEEP:	384:hP+p7eXE+p7eynWr1H7d7WdYNg7YEoQTUxtJ8BZ5EJeXNhU8XnA+a8p93jYc5YO0:hFWZbhIYyfTyX8BEeX/FpdjlYbFF5
MD5:	0AD6A78915B347D37BECD7564807CBC1
SHA1:	AC3313C4DFE5924EC79780E1C9F1B591217D2743
SHA-256:	6796C0CF798AC2BEFE76ED9FEDEDABB167BDB3557F4D03EE91349D2F329E4B0C
SHA-512:	3A5E8AB7C5959FD878EB5DD7718DB4C57BE913B7656E674AD38923AB521F7111766C016D05AABB7D5A1E9552091C53EF7BD13690ADDE252D2F971B16BD50BD3A
Malicious:	false
Preview:	......JFIF.....`.`......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2019:02:14 13:19:29........................................,...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................`...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....I%)E....;...........................L5..;W4{......n9.i$.....r/<0..0;...".$..R.wN\|s. .....nII..k...+`?..w.$T.....IJI$

C:\ElitechLogWin\Images\Icons\is-CFSS1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.649037439253414
Encrypted:	false
SSDEEP:	12:6v/7itrdnTCenjIwFGbwu7FJdS9J/0F4raPr8534rtzbMgV4gFy01jR7ChovImYc:v1Tb8bbdMxrNIrBbxVjFB1lGhaOQ9N
MD5:	1167646F8E6943AE344EC19A8204C21C
SHA1:	01F46961E51B31B6E5F1EF569F12C1A8AEAF50A1
SHA-256:	12849AD15EDDFB44933ACCE9E74DEBAACF4715FFCA6DA0327CF9DCA0F7AC5DBD
SHA-512:	1FE46AF9F37F1DC47C8FE98A885EAB95C7F1A39674E815C8B762E787299C648FD2848744B4BB4DF660E309BB3D75044DB9CDA6CFB349DF0D61FAEFA61B7D820A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..Q.@..Q...b.. ...T...SA....DT.i.r...SAH.....i..2....p37.Z.{.vo......G.....H.....=.e!.Y.........r]..K.$3.c..8..\|...;..E....Y.O2...k...p 1....'.......>..m.k(...cae..7.>..Q.n.<.....K>......x.P..)..F...d.....p9..P.7r.oB@.]..uW.....6R......V..S..H]=....jlM.?MN.?....^......&......K.....w......'.o.....[.y.X.g"5..eG..M.U.f.:.^S....w.b'D....Z...85b...&...p].R..$}'...~'..DtD.H...u..\@...D....."PW.63j....jP\|.p...u...t.F&.t.9...v..t..V.X..#....'... .m..Q.r.?zAYW!.;IhLs#....4...V9hz.w9#.5.q&..`0...../.L.........T.F.9...sHA..+...R.}G....._.8v8..+$../\.9.gB..N{rD..f..8..-.`Ktb.....{=.Z=.K...K..).....p.k....&".^1...R..0...g..b.Lr.-<...Fr....x>..\..5...,=k.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-CLPJP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.623633476425489
Encrypted:	false
SSDEEP:	12:6v/7iLH3n2EguVtLNAddaeGB4PPfby+apTiIE8Uy5fKOnJFu4K6LOCgNwVBr+mEH:dH32xkLWdIB4PPfypTf5iOn8SEp4ZZ8D
MD5:	EDB94A9617DCB24A2803CA3CF06C7665
SHA1:	92C6F62CE6CA01DED3747CDA1812B670D624CDF1
SHA-256:	EDE00958AB686FDC8B8CBAF073FA5E1B8DE498FA93B407811CDD149776CA7E5A
SHA-512:	8B7261B194E5EC119BE566803D6ED604B7E8F0FFD090686CF01FBF59BE8CDFBA13AA6F03A853B24F3653889A59D89F06A6393F7ABF9CC2C43EB26AF64EEA90B6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.W]r.0.^..3..N@xc...p...p.Nhs..'H .{o.r...0)<...N.[d..Z.?.-...m....O.....3;.......uq..O...@...ouv..tYV....vl>A....h... ....G0.....gGc....8..Dp.t9._.........KB......N.....\.........O~.......(r;..:.BD.Kn.'.H.@..h.W.F._.GO...[..p.......D...b.....n/g....3~.0./(...J...k9.0.h.....M^...=2.S...\|X.....O.b..."!.x?..'....XS..2X..?cT^1...@..9.8......).....Q.X....{.....O.....}b.9#o....6x...."..r(=..9......KX-.<.G.."VB...$.M..fkH4..]...#4A...\n..G.4a.@...%A......i..mX].....uGp.....?..XO..8.x"v..Fi.......(.....".c. ...m...l)...b.....q....?5$1....._.o...R'..!..T.j.~...M)...... ...5(o.U$t.s..V.,e..}..IR.S69.............r.........zc..]N...l.`}&.K-.J.I.u5..as#<t9y.h......K..o....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-COSPP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.405433171083131
Encrypted:	false
SSDEEP:	6:6v/lhPKqvq+eInbi12ZDfiCfm6zrQXaIy3LxAUYuf6jJQacpu2mwlNPyTp:6v/7iF+w12DKCfhrQXpy33/faNcpu0y9
MD5:	F235037D27749B7001467ED61CDAC18E
SHA1:	D2A33608326368A745ABBF288ED0A29B1EDF46ED
SHA-256:	27305F1BCBAFB9CA0D0CE5A8E24C1D40A25FB24D8D74B65DA25F86FA9604D586
SHA-512:	C96BBF7B480FE342231BB3E86AB4A1882D5B73C1FE2DA4BEFFBDDB58B046FFDA1D3D38FC2E0FF65AC53825625DACBB1E7BBF0BF50A436DCF5AB61CA89CE95952
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.M.0.....!L.L@..6 l......P&`.............'./.)'=.u.{..>;..c.c...p&.Ka...!.."}.>..."..0.'.g.A$b..q.....V..p..w.p....<.....<!..... "9D....G^.....MHj.(.H....g.].%2....S.g.H Q.r.5..A.....W..!g.x...q."..k%...%O.`IZ...c.I.d5}../B.....c..H..D...r..T,`.F...Ta.....a....\.L.g)P.[.....6K....-..L.....%.B@...O.....M.W.k..Mf4......Z....o......9.........t.`...T..#..tC.l..u...r.....'..1..E5.Y...o...9u.!!Wy.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-CPN5K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	7.735253982698676
Encrypted:	false
SSDEEP:	24:tkr9Kq+cgZlCBPofEQlRKxvY5ipYFZg2atKFz1H:+rCfWdoMQmv+VFZPeKFF
MD5:	1CDA9D1637E589BB1CCFE2CB32B9240D
SHA1:	5D9EAB2BE93D6E6A26C0F89B64B38ACEE203F530
SHA-256:	4F0CEA61314D5E4084F6CC2EF0B8825F035BD9171F2250C8B75AF2EAF231B59F
SHA-512:	686EEFB9DFB9D1670D1419BBF93EC187C5002D3A9D745BCFE887BF0832A0FB72308A291CC49EFDC95679A20E8D3909B3A569BCBF06B53912A8CA30046DC7B301
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAR"A..jQ.........@\|....*....@....../X\|..W1B..:.U........u'..b....3...2>..M...S......0KHN........k.V....e.."."ph.t...E...ta.<<...3...t..u.J4k..;..c..0.bn..m......G.`....n.,....B.....>.p.\z.2q...b.k._.&......_$...`.........Z..d.........P/V\|.g..r..2I...Y...p.....}..fAX.....@B%..NV9.../.....@n...:.^...1 ../.C.....0...u-s.%...8.....s....c..p.T...S....'Se......T......yd.O.}..C...x....@$.l...5p..tP.::r..... .?8.+......2..B.... ...B....(.y$..>.,.. ...v....W!..5#.F.s.h..h..#_.....\|..Z.7...H..A..b.#RT....;..o.x.......j`t.W...B!...1w=..Q....R`..&R....\...^lyq@.@,CM.kP......'....#k..~.. .dE}..Y...O...$..Y....>..i......\|...mM+$...>{3bn..s.......5#...$....P.W..:...q....C.5-.z..2.....T.b.&.U....U0(...Y.P...\|.....!...O..&.@.. F.^_e8..x.`..dI...+.....W.7...)]...(....D..z..O......Rmy.^P..F..L..........mb..(..z1......hHj....}.,.y../...O...zE.`C-..ky].&..\|!..[...h..5..~p....I.....i...........t?.(.....IEN

C:\ElitechLogWin\Images\Icons\is-DBHJ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	703
Entropy (8bit):	7.672023987976782
Encrypted:	false
SSDEEP:	12:6v/7ZqhECJOXWFsRHkYjmZojoyj6o/AeQEduwsc7F2i7L8gZai8XdyZKkEemXkez:hXz+RTStoCNinWy8p0k6L0
MD5:	FF214497D997DA68FBEAB5B30F293BE5
SHA1:	063668A35F5160DCEDDDA7F75A5CDBD03CF04A20
SHA-256:	6DE46E044C5FBC415A67D34A824B1A5FF9FEAC20D687FBDBC62E4452D0D4A77E
SHA-512:	ABE231CFCEFB37F2B2B05B04802CC7B9A6073D1530B563BE104BE0D3E54AF0D6F808DA06623BA93B0805B92F07348A8081C947A7BE0362188E08A0122DF89F47
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK.UKr.@.}=.&........n.O`...p.;'0..e..!'..l!U...eg@V.[.....gV............f.".......(.[.cb..L..c...x..v.-b\..=........x.....Y.....E...?%U/.e.@.6.1.s.....X<.A..#Yw.........@..,o.........1.2U.'.>.N.6.....^.%.o$.,ky. A.`.i..g...8...b5...... ...h...x......0..0_z.R."....J./\.}.........1e..."..%......!.........=.X.]4K.s..k......s.u'=a.". .`....?=.4..h...a...q.N.S!.g.[...`...(.m...#.."n0..Vr.\|>o..T.....:).f.=R.....o.s..jI.j...Em..H....WN...M.v..b.[.j.....V....X..A.f1.+.=...<T)..J:..m...N....L..J.b.(...qZ.....m.....v*....&.~h.b..`......6...:.mjP..@......(6z...y.0...5.4....w.uF...k...:.}......Ii....<.0.y...../...S^.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-DQK1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	691
Entropy (8bit):	7.552614817850465
Encrypted:	false
SSDEEP:	12:6v/75TsmOCC4on8G1KxFZUZM9Sq0V3H9udsAKQ+3UCNMGQ7UvGMB1FnCfL3ReL:+9ox1sUqA3FdudsO+3UmNQuh19KU
MD5:	A1AA4B043C583A2F15A78DE3CBB5F656
SHA1:	F0E8CBD141BFF11392ED6F60EA8CB1155289A914
SHA-256:	38E4A1791C21BCBB8489EC494033C7382AA204BCAEE154DB11B3157C6F9ACB8D
SHA-512:	84D15BFB3EC22ED3771A1C098D4CEED04FDB42D476306BAA2E6EB7BB2A156CD91C8E0EF7A43FBC0E3A9CE5F96C700940860BC5147117A868C9D145986EAECF9B
Malicious:	false
Preview:	.PNG........IHDR...$...$............zIDATXG.k.Q..._a..,D\|5..Zhl........R..AQPl.....@E..E...B,,.....J.D...2.....l.$.Y..;.~.s.s..j..Y@E...!.;...."'-....H..{...m..w..-nX.\|..-.Ij.i..~.<.#.Y..v.mo...C.F.>..]..I.mg....~.\|.4P..).\....Yg;........=.X).].........c.0....0....$}....P.Hc..Y..O.8....x........,...UhU.B..#.m/...1.[..9.-`../)t,.....v.I.J..T_...}..Ig..u.P.p.8...t2.....G$........h.w......,.[.%....t(.....".........[.{.rI.3..\.K.Z.z.X#L..uI.f.!.}..G%..0.F...$E..ZWs..a..0(.b.3....I:5cI.)....%07..@..H.&.....&....&R.{....Jz.ma..q...[....%...@..vHz=]....(....h....u.`0.cqn.....%..f..;q)8#.w...g..P........V.C.;.7.A[$E_..2EP\|.J.W..b.r.s..<F-8...SDV.......4..e.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-E3UUA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	714
Entropy (8bit):	7.5643971318787475
Encrypted:	false
SSDEEP:	12:6v/7ih0nNtrHACVArGO6MsJAoDGM6j8oo57xGsMWlhad1ysado8m1:MjgCVArGOGjGHQvxGsejyfSb
MD5:	083D684760A548BB3FF1A1671CE756BC
SHA1:	FADEF4DD58B48A64CD3091B77828FA6AF79E1200
SHA-256:	7B861BB29824C3B3EA08AE1D6F031E5DACB55586F02DD5E7F840FAE140D9C20C
SHA-512:	2518E83FD08F59D60F63164A850848C6D9D83B4DCAB1D9425333A980DFE1607235162B13828B227D9981E3F0B2FE671471C5725808226279061E289445B00433
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Ar.@.E.....@..6p..... xi..>.........!'.9A....\|.4[l.N..Q.%1.,.X+A._...=.G~.....`/.......G .'%D...y..U.kIw.p......p.vf .A.N..Uu&.....s....k..z.r.i .?.+..!t.X......I D.I.......N+OjS.,.......S.. D..~8.$M.....+....U..p.....c..$#..}....'..=.m.V.8.!g_.l.u..)..1.b.u..a.A.M..;.0v........N.q.@)....nw..O......,)..O.p.9...R=..A.$=.T.I....6...e....V.......1..\.i)..1....8....`.&...}.!...)...&.....8!"......L.K...]c..Kf..`.\.1..!4....]........].%.H..".....6...^Y"x..c..3.kB..._T.c(..W...RNw}.&.'&...l..=.r...'.dm;N.}^.&.n./6.....e..)....j^C...........U+i..~.d'.a.......&..W.<G.L.R_6HD...,...Z.^osO&..w.<.ms!..m@.%.X.......v$2"I.}...]....O0.Qm.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-ECK1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1030 x 249, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11435
Entropy (8bit):	7.837482650219245
Encrypted:	false
SSDEEP:	192:80+8JW4ls+RrYZ9vBhjfrL6XCDzjPqGcDGRrQi7CUDZdplp17XgQ3Xj:NzPriNq4zjHcDGJZviIj
MD5:	DF5983FEF86D41E19726F764F9F706AD
SHA1:	4847FB5BE5C1078333A3306424623845845B5DBC
SHA-256:	3BBBCD21C9C76008967BC85E920252210D372E14C1189281F85DD7FAB69F1C8D
SHA-512:	781C5337666726261D61479A562B9029641EBE0EBD5027A77407B73BE328D3DEAFE63A6519B9699D20A8765AFC3C713DDBA3C5C2EFAF215783E01FFABA6CB73D
Malicious:	false
Preview:	.PNG........IHDR...............7...,rIDATx......u.q..=.<.&4.{..QCf..e..h.:.0...A..@.H...M.. ..q!cS.Q\.t*... .m..\...T%K.].tus...~.w..>.. ...{.....k=...........z.!.....@..............@..............@..............@..............@..............@..............@..............@...... .?\|.'.7A........O.....~......;........... ~.w.]........!........G?..............C...?7.H`@.....Z.......C.................i..I..........P.?....h...}....?~F....?..!..-........$a.......7..7....;..!...........,H$..uH..}w.Q`...y.s... .......@..]e.k....i...............Ax.(.7.........}..3........a......3...m..-...2@..{Kq........m..C..U..T.D5.V.A.....(+.l]..Le.V........ -7......8.EZ.......HI...T).F.Y=..n}0................k........ ............"..w...G......`.?\|.'{.....;......0...{K........".....w.?..\|.;...!...y...3.........M.....G...V-.R...........H.-pJ?.R.@.......>[...............j........?.o..j`..........}&}..........;......~..U......I......0.....h...a.....q.?.g....D.S.......&....

C:\ElitechLogWin\Images\Icons\is-EFCL8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.608114171662278
Encrypted:	false
SSDEEP:	12:6v/7iLedqEU6PO6Gma23Bg0Eia5oULswSf3h3pLEzrsqQ3Q061e7o/KMdV:9edqWDr8itnwSfR0sqQvmT
MD5:	3B1ADC4D52116ADFE997951F790ECED9
SHA1:	368BA1DF8C646EEACC5774DED46ECACF71C8826F
SHA-256:	395B45097B0022DCC0D8A6439FB65574F4A3BC78E746B591BBE5871F059583E8
SHA-512:	E75F2523C016BA4295158913D6AEC5C78A32E4179BB5BC0D11F101FD35360342FA3485EB68B5FC6DB7244DF89D78E42FE7C517C92C787B82C42EE7F0EFD1A7CF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....WIDATXG.Ar.@.E.Ue......,.!'...9.x.ia8A......r.8'07..E......)O.[AX&...M.E..hf.t...B..{..^..;....;..."2.4'.Oi......z8....r'.H.^...<..4.!.<.......x.I......O"...$....(..`...Tqa..t....~........._.S[......F.).......@.&R...tp...X...X[\!bK..R...N.q.....5....CX.4&.c>.".P..Z.....D"....o.....\..\|.$..B8)..@#.E.......I<.:I.f/.....qV..LDJ...e....L...HwZ.....:...q..........(+B..E.3..]...m5....V.2.F.X....../}.F@fgR.f1.N.=.a...L.e.T...r.......Ik..Sp.f........Y........... _.oMP/.cn..}..1.W.W xx...`.De.m9-.. 4.d\|..l.U.<.. v.....@..s..S.-W.7..\..?../..M...$..V%..\|S..Ms...)Z...5.r..v....6..0.D\....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-F5BKD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	593
Entropy (8bit):	7.570693847348377
Encrypted:	false
SSDEEP:	12:6v/7itm+Xx/7tSHtIlL4my+wzBmBAUwRGutkxmz/XZUaP7GlFIHcrd7xc:mutHumVuBWjJwk4zxUaPgI8c
MD5:	DB5BD47102307DD93A5790E269BE6EEA
SHA1:	BE417E3AD48FED998CF29B1E8F2516F7554AB159
SHA-256:	9CAB598A9A89D5ACD197BD5E08CE7A5C829E243B339EB07478AFFA336B79C594
SHA-512:	970AAB5C2A0CCD9FC2D7DC5A842D9A2F1ABD59B87017244F55CB9B6614926E66E6A91066B24CA84173EFA0308E6069A9F249DC768ABAFD565C18E5BC1219EB51
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.VAN.@..i..(..X.(.7.7....`....P.k.........K....C..iK.23.`...#.......-/.e\|.....q}:.......%.{.X.-.EU/X..N....`...5.r....a{..v...d"....ap.{....\|..EQ."...K..<.......B6. L..H.....<........~0+.(sbS....~.......P...3.@..H...V`.ydh.....~.+..S...@.._..S#:)}_..!o...t...B....:........8....qeP...= .Wwf.&.".d..u.4b........mN.E}.c.......[..:.H1...H.hda.........x......G......>..i.I8{..,..!...{.....B$0....3..3-..wY.B..BB..K+....).R].&%MB..D#....)...(..w.Djp..7H..x~..c$!..[.B ....Xn.."..>.7..&.\....%S2.z....&.=..../zv.0.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-F7I58.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.430074309419948
Encrypted:	false
SSDEEP:	12:6v/7i538/wRppAcA96y7OradFfT7s9gAcR90swZ97z2NROc:M4pmUy7gWFfPs9gB3s7z2NRD
MD5:	71A63B5615F515E6915E8A907CAC1026
SHA1:	0D3CB45045CA867B4E1A86D6221C8925A3CB9C3C
SHA-256:	B1C53DDC71084E97C5F8C5517D339F9BA511E93925033E6E6CFB79BC8FFC69A3
SHA-512:	78C5FCD96A97B53096DA2F5DD2A5A858AE5433DD221A768DE49FFEDCB832B960D5C6D43F275A979A552C6E7DB821D3AB700CA1F796ADB690330AAB6C9207B96E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG...Q.0.@..N......FN..0...@......@.T@......>.d.8!B.`c...di&3.G.{Z.vG@.x.H.....}..>..{...=.#.ns.....8\|.....^.d.g..O.A'<......$...J.A.......`t.8T...."........g.9......N.#{.1dI8]...`....B.....".3.HFO.X8g..."a......K.\%\.J.[.W.V.+!.)W...T.vUU-%.l..t....5..S..h-..y.2F.['ry..1..#.#..n&.zKZ1.y[..=^.ta/......6..V...h..<...J..n+a.0.....E..&8o.._...0.,.MuB..R..8.N.$...:.%.:pW.\...EB....Jh.....E.....N`...$h..N.T*.'..uP.=a..^.Zz...mWV....H..N.. &..........^.m.$.7._....F.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-G2G5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	475
Entropy (8bit):	7.370137291098814
Encrypted:	false
SSDEEP:	12:6v/7y7jGJBMei1OGG1gmb8JRiV7QtqqwAde:t7jeHR8JRac6Ade
MD5:	AAF818727E1F51710D74848592143616
SHA1:	512B4533C3129CE7CDA507B1324E35631217C1E1
SHA-256:	560DA7FEF60BC5C6F295A9FBF1F9253FCC386E5FDA76BD2C36B9C01D1E51D04F
SHA-512:	6769EC6E84D49750F7DFEA48D48B1A09DEE2C8CBA165799737DF35E17B209A67DC816A5E4742E78989DAD25C81352C9410CFB042449B5952B7DB5A4D01310630
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.SKR.@...8)v...2..........'.N`8.p.o`8.q.;)p.2...'?~J)S5.$.....k..5<.S.....y.E..3$...O./.....H.`.q.}...T=..%..j?s.......q.3F.9D..8`.M...p..z.Sug.S.22......ac...<..:BC.-....h....f.~7.......,..e"......L(...N.......6...[....R.aU..x..I.<pz[9....i..\..G.6.....<o..g.N.A.G...3.pr..J...k;._..xv'q...x.X..R..I.3.>...h$%~EH@!..eB....f\|n.]..O.\/.T.-I9B......I...7.lP&e.dR..f).../.Kxc.......G<..3.8#o.R..8..D..l.7&.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-GIPNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	343
Entropy (8bit):	7.006839353189143
Encrypted:	false
SSDEEP:	6:6v/lhPW5J8A5Sc7KZ9Dbsi99ckRaU1HRLJM6d6ilFFNqBCrXxCMTRW06Tp:6v/7W8AF7KZ9fsfkRHHFC6kBCrtA
MD5:	BD5CFCA91FC002244BBBA427C0CC94E7
SHA1:	8DDA0013E4A12761220BE0B39FCB52A7B0EDDD0E
SHA-256:	1781A4CAFF0D60C000E95C9190F5895FFF4F8FEAACDD161337C98EE6CA12C46C
SHA-512:	A3FBA92944C75D71DD545E85C1B940603A61A15FF176BCF17B68EBC05A80A4559438F3066260867A2A99D0602CFDB691B3F226FC6CB453F182FD79FD85112E3B
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.....@.E.7.H.....:..`!^...v...v.v@.........v3$....c#,Fz.......M...<.. .+...w...=..-t...P.X#" .c.?......~...H*.H.!. .....6k..E.r.P].F$.D.&&..q.Q.v.l.Z3G<.&...d.....8..h.:.n.O...+....._...H^..Q"........e........y..q$.D5...8:.y.'r.%..N..6.%.XN!..(^kx=V.R..."...4 .^.A...4..........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-GL5IN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 70 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2999
Entropy (8bit):	7.906131705173593
Encrypted:	false
SSDEEP:	48:RSmZMzvLUne7hEZu00qZzSeoSKTFQXabCXRtAOJGtoojQu3FlAwqnE1/YidEmh:Am/n/aqZmYKTQQeOUKx3FlAwqnERdEu
MD5:	8ABAAD7CCD86A0A9DE6BA42A3E9B9D42
SHA1:	0635A623ECA23D5A4BB5993A3273B4F1A6C10A8F
SHA-256:	AC61DAA74872396F8A848C4431517E0993915EFF78612D3B6D7E2CFEB907375D
SHA-512:	0319E265F1E4B4C2E90B03606E7E03AF441A4BABBDEFB7B222B061EB7B05606BF1D12237F45EF2F656575C5E1DF90D4E6C79339F26DE4F1968B15C982908DCDD
Malicious:	false
Preview:	.PNG........IHDR...F...@......w.....~IDATx..\{LT.............6]..T..5J1ZM.T.Q4.#Dc4E.PCaI.->.B[.&......hT.&b...O.4.C\|.&J.........o..w...._.$......9.o.<..............`....`...\|...+...o.....II.oL..ztZuFZ.k<.$.......N^..:_Y .d0........J......6.....Zm..H.1^...VG.A4....N/.$5..".W.._.FQm4.F7.:.....1z:.f....7..{..o.f/..-...M...c.H.."]..L03..Q... .6....Q.s.B...+A....t..p..].7.....R..E.j...]0H..Y.cj..S2.....p..<%..}..=X..+...y.2T).`Q.N.]~k%-f..4...;.....oR..%......L$tj...1..=B....;.:.w..v<.p...8....`.....3h\|"I.bbb`.............{....88.N.<s.L....^.......h.0$.`0.i.....?~L.1""...d.1*...u..F:..<...q......GA.ID4.........?.cL.J.a..K..d2..o...c...F.$qyYY.b]j2"".c.bbb.......y.....E....q..]\.\|........7..b...).....Ckk+. 66.W.\........Ws.3..p..&M.....[.........<~.8b.a.!66.QQQhmm.W_}...F.O..\....X,.......V.........'....s......r....?~..$i....,w.........L&z..7...............2+V. .......<..^z..{............7.......Z.........1.e.....G...&..I.O.t.}...'x...$I...6.p..

C:\ElitechLogWin\Images\Icons\is-GRGHP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.687854038756322
Encrypted:	false
SSDEEP:	12:6v/7iZaKyWvnfK3RZDb7eWGzgSoORqBCkj3ygRUgEZxYmonSCGVUPOSEajwN0+wy:XrriZDb7bGSOMEk9egKYH83O8N0E5BgI
MD5:	76ADD155A9F2C3A7BBAECD230EDA5F16
SHA1:	358D48EDF5FB11F55162D4470DE40E9C56F43D6E
SHA-256:	DD75ACEEF58323EB6CA631312D8961A2CB43686AEE1E7E5641D2DF36CE59AA85
SHA-512:	876DD8C9226DF08556B56FF8D3EB79CF9C2DA8BB3C26BC1A576763E862AA56D4A7E2B05E4284155855500F09874F9A3D3E6523D401B53DE9CCBFF98B65CA3FB9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.]HSa.....mz.Tjf..Vh..R)u...5.j9..`.HDQ!..MP .. .!..0oJ...5".../.....3k...yN..6.in......=...?...vv.6G.V...BH.4.(...8Iv..i....&..j.a.3PI..N_...W..7....,....6t=.......l^"B...p..^;.:........."t.c.j.6 .....5d...T......f...E........m.d E..p....^.....xs...FDX.#....1.gQ...P]C.......<L&..z}T....}~.A..&.fl....k..w...O:. .0...... .&.v`6..U$Un[.@...U..l..E...c._ta..... ...\|6..P..g~..Z=ti9bp..{.....OS.B4...$b..!Ymu?..n.T..0.F0cW........3..x.p5.a.B....Qu...~e...:.m..c.+...(%..X...........<.c.q,f.....kW5.p./<....N...ihl....+B..]%.0t.<.O.......e...#.].<2Br..E..[\|...U.G..~XB....<.m.......R,....cHgk..~4f.......";'wNp!.d.J....L.H@V..Q..'.../.o.XE'.............[..I..._...r..I.4h-B..8...\y...=.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-HAAP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	718
Entropy (8bit):	7.646727724138583
Encrypted:	false
SSDEEP:	12:6v/7LnZLYkVQr7s8AOc453z0uXaefJRj6DuH1SMYosXMcggVkZyw2kGE/BuVFux:KZLdi+ObD0uKe/uyH1SrrECCLGEZuVA
MD5:	58145130D8C2EC4F77B2A90C9B095C7F
SHA1:	BF515A9C6332E1381C18F06E2B9E2F5051A3413A
SHA-256:	A69616F59DBAED47C86BDC4E31B2EF5126DDB835AC3CA8B63AFA8F72061BB71D
SHA-512:	41DD77EF4884D72B3AE728E28DEC9E1DF39DD708DEA3254D46518114D4AEF7F654B0C3FEC540587D9654BF03449FFE3E260620F6B5C855D414C59E109D1EA3AB
Malicious:	false
Preview:	.PNG........IHDR..............w=.....IDATHK.VAn.P...@......m...... .2.(9A.A....s...pOP.......k...7..a.1Q.%d...?o.<..\...7.c"....j.....4nT.o.../]..9^..\......,N.',5<...D.Bz,...T\......H.Y"+..GH..y..aj.q.. n\|.'_=.x.c...".........j.g...m.b..._sv........YmkT.@...4.g...7..(.... .[.E5z..?...q..`...F$.a.I..S..6.-R3."%..1.........T....... IJ........[.%.....i..^{i...oP.f.HN.t...]...\|0.2. ...t.0W.P....X)O.L.R...er@T.......P..f...X'Z.6X....>b......yy'..-..p.,..N4....6.D.ZU....H..B.N.....2..m&.8...l..M\|Q...^.......OH.Mq6...L&.....N..5..\{o.3.L..Ay..=...C1L..dG.7.cU.{'..w.Z..3.....En...\..!:{...K.$.a..._wu6g.D....2-3)f.ObI2..%...p.T.p-.=&...LH.j..Z...iI..8.c.......(..\.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-HI7K9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 35 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	7.784836156153588
Encrypted:	false
SSDEEP:	24:JuMsrS/PwMelqvkV0kdhCLVoyN0i5fZQQmuGTF89uWgNjkTXWvnxqb9aqJj7u:JuMs2hMV0kd+Hx5ROq97N6fxqrS
MD5:	5EAC833E254B08BE5703AA743C0C5CBE
SHA1:	492DE7E03E70E9FDCA2A61B61DD4709113686A94
SHA-256:	78BDA2C4730EBE256F21FED473A26FD10D386385F13D10C2A535C64B31954586
SHA-512:	5CD8EBEB52FB15A07B955D1DE6F6A5302D68E2855C23C4E6F5D3669448594332A4E1A3171D51498D5EFABFE6FEBDBB64B8475520F9DDAECD0BAECA5117679B5E
Malicious:	false
Preview:	.PNG........IHDR...#... ......M....."IDATX..Kh.]...3.m..RS.-...\|.,>..XRua.R7RR..T.f...I...,VHQ.BE.........E..Pu....&.5$1.f....L.....{.w..y..E.4Q...a...(..;.<.WH+.T@....73.jx"R....mP.Y...R<#.Y*.J9......u..f2.(._r.......Z....6)\|../...\...D.\...r...DR..a.32wE.m.._B.,UX......TC...C..........x.^>\|...........s....P..uaa...Y...I.R..d2...,...l.....iy@fff....[....N......#.L.:..gn...oW....f6m.D8......F...CQ..................7.p...@..._..n.).......VSS#.`P\........4Mn.-....K{{..r..]9x...../_D.4Y&M....O...e[,....I.w..r..=.a...S...].V.o....?.744H$..UU..t..iy...).N.L&.&"d.Y~..Mmm-.d...Ncc#...LMM.q.FB........tuu......\.z...N0....LLL....7ox..Y~.(g...nq:..p8..;..w.t.4M...~.$....\...... ._.l6+....UU...R__/---...u....u.V<.O..........m...yam.Z.t...N........TUett...6\|>.CCC\.r......p.......,...b)....,.H...F.....x<....N....:...Vz{{.....v.k..FFF.w.g~.......X,/.,--..v<.......?....G..e..w.......s......8...^/CCCz..........7v......f....7R.........O.>1>>.k....Bttt

C:\ElitechLogWin\Images\Icons\is-HNEOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.194151772074488
Encrypted:	false
SSDEEP:	6:6v/lhPYo5cuPD+KxHknKBLlMWHLzTXBm3y+V86ex7ZEVbUd3VSNQp:6v/7t5c4qrKBLltTB7q86ex7ZqUSM
MD5:	224AE765515023AC953DB9D02F67D49B
SHA1:	8E1C57C1CF0B58851E4905BE45951081AD386AB5
SHA-256:	31C1646DDCE44DB519B990CFADEEE771B140B7B15647E98954DE43F4F33D7D1E
SHA-512:	DD1831DDA01381D69B330694CA46C78571E83FB8C14AC39A198F8A20D2464132A832AEB7380F5BF1B4DCA9F9768430131D48777633D71A4A5FECC37E95B64D1F
Malicious:	false
Preview:	.PNG........IHDR..............l;...'IDATHK....@....%...H.t@.:@.t :............:L...3o.....e....!n...:[..2.RO....R).>..'.D...ykcd.P.q)m..)....t....6.xh..1A>y..3..t+H.]ar.l....\|.`.{.E\|.....,.(@.l....s...6V`6".c..b(...z.B..n.qc`.R.g..?..P..q....a.9z{x...YZH.....x.f.w......<...`...E=..X.s.=.7.4.zM..\.^.N...F....U..k....F....e....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-I70EL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1491
Entropy (8bit):	7.748008058803004
Encrypted:	false
SSDEEP:	24:z3WyIJO1jFISqBdhSamh++bNgA+ALUB9uOll8t4shCLErMT6mmVvGWfmE3/:zmXsynB0bRleUOlC1hCQrMT6mmVv93/
MD5:	16DA74EC8F1482B09EE8E547D79602C7
SHA1:	C4AB25D816D61483C684814FAB46CB8C7F769085
SHA-256:	B7BC1FDB5C979414C0B5536C35373ADDC5129267A3FB16335AEA6CC801810478
SHA-512:	BDA0CC80D2413220800444835F2EAA21186718A735D7129A689AF0B49E19B97E91DB4E66A70D0121B804DE3373F97D93ACB69030D6B2862BADB25F4FA11D13E0
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx..kh\E...B.E$..B.......R.T..(R. ...&m.l..-&...4.6M.D........+..A...j..I.c........?.....6...{..rw....9gf....d.f...M.h.i.i.._{kJ...I.......I.H.H.!.....6$$Y...@O.....`.(..o.!.[....tQ. ../$.....x..9......A.e..)...9...5{G............ii..9.@........H.W......9.J...........3.::.......!k..r$.!.8.....7...?b..80..'..... ......YU..`;.{E2.....;..dt.z...!,M..,~0..8..d,t]=....)........ ..Y+.......... .....J....0...... ...Ho.....x ......Y..a...!x.@0..1..t....q..CX~'....\|..t...!.V1.b.B.`.<..@..Q9...0C(c........^H%#G...ae.A.....=..tR.x...P.....u.S......F..8y...y8.....TM....P@}..t\.....R.3.;....mBU...[..../X.X...X..!,.A..x.2..g"..x.P.q ..<.q`9..2....G9.f$.g,..]....@F.x..<u...\..........p........k.........wQ...?..M.g.C.X.#.a.o+......AU.:.Q6.\|.Qm..C.{.u}.I.........q^mx.g.......?....;..Fatu..I6t....l;C..7.....?l..#$....G_...i....m...h8T.i.....W.ro_..{.<.Z.xJ.....L.e.@..[.R..7.h.A..Q7..j.V.0..1]PW.......6.oK...s....

C:\ElitechLogWin\Images\Icons\is-ICR6H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	256
Entropy (8bit):	6.767458306200851
Encrypted:	false
SSDEEP:	6:6v/lhPKVwcxGNnp6u1NfKOFHZl9Q9I7Dnx2t+p:6v/7iiEoYurF5l9Q2PWs
MD5:	69F06E224954CF456FF9F6A2872E1032
SHA1:	F581732768F4F37108C43BC5CBC0973AB4561785
SHA-256:	4203DA69A6B16255DA9F97D7B636A64D0C32AAB222073744AA5F441AA2D7B1C5
SHA-512:	78D1957E4C15ABA236DC25714FAACB36BFEDF6B78394F9E2F231CF31D5F55BD3E0488D1D30534AD75A5405733DD30CEBEAFF53BF73F309A00B1C5C7599107233
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXGcd.`.8..3.:`p......i.?z.....!H......i.}..#......v..r.....`.L...S...T...:`4.PC`...l......p"..'..0[.n...F..h....5.8.f`.DL...?.......O<..`S..S.q.:.......F)F..6J.........F.......1........GC..]..!{.F.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-IHJDM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.598988990039078
Encrypted:	false
SSDEEP:	12:6v/7iNtteLt+vIEOiTC/ZVQqAbL4ndoWvf2otRpFXluE+q7ijZX2KwTl8wvSVfiH:DhvIEO3/ZVpAbq1GoNXAq7oZ48DCBN
MD5:	0E2DBE170A8FA57C1471E822DB666818
SHA1:	78828A1457656B26F3479EDEB6A18A8DCAEE27B9
SHA-256:	C4AE7440D34809875327CD287BB0FF7AEB7332889F21BB2A84BE110BD2A94B2D
SHA-512:	1F976C896F318423C9FDA8131A9C319EAF511DF086C754C007008A95AFD24E1641421BFB816FD2705CB03E89AEF110DF0D8BEA976FCE24F6C59411D1F4559C62
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.]r.0..W..uOPr.B.....4..JOPr.2.....=..{...JOP......=...13x&3....].w.bt.].?5...>IvC.z.X..{:.E$H....@\|Z......m.wD.;^.....T31\<.....N{$..3.......\|g...xo....S..Hl...#Gb..T.S...3._NuZ....Z.....@..u..K.3.9 ..Q..w...sF..RJ.b......h.....+.....kO....r..+.......p.x.H.../i.P.b....gRn..\......\.8.'ZH3.m&s.... ...\.Fi> .3...`.".....8?..W../....0..,bAQL.2S..]...H{A.e....2........#.B..Z.3..q.Jr...~..U.q.L.. r..&...-g...V.$.[.8.M.GE.. ..H.]........U..X.2...X.5o.<...e..`;....+.l+=.......s.M...}...Up..,.`.c.....yq...[wD.`V..;U.....fr.]1q....;...Z...j:_.%.\.:..j8...f".....#..M.uc.....z.8j]n..UL{....p"..n.Zl.EgUSp1.'..#h..e..qfP.Xf.f.0.3.{...&M.%k..\.6}.......a0._......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-IM7JN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	594
Entropy (8bit):	7.518731384433625
Encrypted:	false
SSDEEP:	12:6v/7iJenx/r7xkm4ZtwbCtvg1xHH01o/y3fOOV0TSKHnVmU7PSNbXOb8jOx/7:+Vem6twbCRSHhCfOOV1cnV9PFDx/7
MD5:	DEB34329BAD868A843BBB58789A70DBC
SHA1:	C85854917F8E6E090428CB786F18899FCFF0C25E
SHA-256:	01F68853D5D1D106EEC2F6A4A9F77A9D6037C4A77524984AFF59181CD6072100
SHA-512:	DCCC977176498E18AF8FB37560FF064AB996524AA3AE5AD873CE54412E500476C19BCDECC79A918E50B0D0C6ACDA39E51B4256EEE03A9C9D56D90CC564D81541
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WMV.@.Nx"KGN .Y.z.......B9.x...\.7....tm}.z.R..6f.B..........K2..AX./..q.@U..E.-.N@...@D=x...Rhj.M.E....5c.izD.2.z.;&....[O. ......u..\|.......Z..:6.......n..A./..-...D....X6.....@(.....G.16B7.].....w..h..e9..J.;..0k..X\|..'Y2]...6.^/Ni...I.o....h.;....UI.R.(.=.......%..Tw.`.....q.U.t.7....`..VZ.bi..wI.I.F.W.......rr...cN..(... .gu`..d.L.$.1........E.X....../.g.L.Yz\...i.K.o.`......{...X#....]n...v.. ":._..W%...............MW.\a....,.....D..\|=....8r.>8.y...4....F..X.`....h.G......._.... ..Tu....n<...'l.f0).......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-INPQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.672863914480044
Encrypted:	false
SSDEEP:	24:xFPLRsCi5zUkDCoqduOQpI0crwWoamV+PM7:xVRhkzqd9sfc7o6M7
MD5:	F9BE9A64B2D443D78EE3BD137BF8291C
SHA1:	9EC3BE8660F8BEA3128AD59CC7544D8061E3BEB2
SHA-256:	DBB40F8B775BC37221E2C86C1ED703A819B9F63B22FBF4F21A05D0872C72DF0E
SHA-512:	D71CB240A28A06CD79C7A19EB1290DCD0CFC76638F1960D7F399E979A506EDA9B4900DE8E88F5880ADA077BF1EF2F7B6628A667EF7C450D05360B8BE00FAF877
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATX...K[Q..?yQc.Kp.pS.P.J..!...=.t.DAA.........c...B....,.n..5...A.!.D.....R.....y.....=..s.-..r].i..C.u.Ei...(......2M....x../#LN).=.PJ}..d.....<v:.TWWc...F"k^]]....d2b..J...tpp`.>......p..$_.L......@.(.../O....S..a...........n.#[.C.USS#+.L.t....J-09UUU.H..@...#.. ....o..HB6....P....az{{...\^^...x<..~VVV...!...............M...9<<...Sgg'cccD.Q.nkkK/.......).....buuU/..\|jvv.:..b.PH/...v377Gcc.......$..yzz...6........$.:............)eLkk.^...m+........_i..p....j..#..[.\...,,,0??OCC........5_.@..%.,--......8...E...tqq....kkk.\|>.....(......1::....===tuu..e.5....{{{.TGGG.@..jnnfyy.d[....\0.:S.B..+W...J../...z.....l.....m6.MK8.......o.R.C)..x.H$8==.SK....2....../.'...H$....r.Q...JO..w...F)e.S7..L...Ra....L...}....'[e}.......b..\|....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-IP3O8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	551
Entropy (8bit):	7.559793879225985
Encrypted:	false
SSDEEP:	12:6v/7iwHAPeWsdk+oLF8rK5pfITcXqKbwI1i0k5nMxgpkLSZqu:2g7/L1V6Mqq1i0k5nMxAQSZx
MD5:	06E9912D08322BA10FAB9BED7FA4A0D1
SHA1:	4F66D61DD581A40971BC4A458EC858A78E96F620
SHA-256:	F4FB8B6182BF4A304186BCA43271E8C5A83CEAF21E704B214DED83351870706C
SHA-512:	E78AEA59AC8F38E1F923BE5014DBF9BAF4A13042598B1763F20A67DEB1B4CAC6C2269E93063871775B00CA1174597868D62763BA4D35941BE26D7F6A4D79EEFF
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.;R.0..W....1...0....p..A8........MB.f(..x.....Zim.P..#..i..JV..6...... ...}..o.......~.......^m.=.J.pL.......1.^.]9N......E...p.."...M.Kq..i...+.P.T.5..\.....b6{......n.....&.K...B"n...Eb.lp&.a.vy..!$.9...5!...E.4.O..p..Y.i....k...e.N.y&.Bqiwz..N.........>.L.[.<..B.....v.).l..USv......^....@d.p.D.`......C..2q3O...m...T.z{.Gu..g#....Jkt...}..<k... :jM..1..~.Ys...;q7.....b.t.3k.p..:....@T....m.. .1...81....w\|...._%..y.+.H_.Y`23h=....1q\|S.?`.....:_.&.....m.MD.......G0.+[.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-J5631.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2608
Entropy (8bit):	7.716978679981293
Encrypted:	false
SSDEEP:	48:h/6Wl9dFWdV5alzzKfSGYwuiv2UwvjbZi0Rs9E2UxZ0Kyf4piHpcEBQ4sZLngBRb:hSWl9idXGKowuiv25Xxr2XR4piHbNkna
MD5:	130D595BAFCFF2C1A7BB72D8391A202F
SHA1:	71E702D3B04FF567375C5FC1EBEE8888C92B46F7
SHA-256:	43CE185FD2F29BA7338235A763B0D844D61933D01CF5B72C30DC449396993C86
SHA-512:	238CA601DEF2764B90EBA382242A4916AB9BA5F0BDC1A0140D6EEF32474DE7BF9B945135D97A60535A6F528B080A3D4D1A7797DC394FD5BA8D4A41B75BC8F8D8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z%..............u0...`..:....o._.F....bKGD..............pHYs.................tIME........U......IDATX..kpU......s.%.I...bHBx.....^..<m1.X-jlmE.J.R.3.[m.K..:HQ.Q@...%<l.Oi...I....$.....&..s.9.....i....5...........o..d........zu=..M...g..P..$f..a.+....t.S.....w>...w...&7.e.hA..y.Z<P<..r......e.s.....r...Q.k....nw;...q...X].....I.o....$.v..m...@....Ys...KO..R.U.).3n.CBN6..(-............ .e2\|x..i...<..^@.$...b..L.:MT.qUr...Xn..N...9l(..Q4....)]......V.Oe..<rr\.........B.(..MU..ph...H.C.........F.]...=d 3...:s...#.o.//.3....[.>w..tm.B..8C........gaYa\|..~...o`.a..;......A.@...0.....BX.f......H:...H..N...r.X.[.T..?A ...3.(.k..l.fS3)3.r..1$%.k......v..@Jd0..`...G.......Z...3{b6.....N.(.C.[1.1.?>EYY-...G.mA..n>.q..q.....8..o$..%L..Gjj<[.Tq..9.P...`.;.. .: 1Ba.. #..3w. 2OVby:./....Et...x....4^o...h.i....F......(.{&. ...5$.?.....0`..}L.....v.?....)..a....L".....G..Jq...L...6Vr.....eIL.B.1b..A3.....C._!g.x.

C:\ElitechLogWin\Images\Icons\is-JBPST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	909
Entropy (8bit):	7.692122420294677
Encrypted:	false
SSDEEP:	24:X9iKDGDDW0SASp/IdMsPW0VI5cpiAvGxm4Y7nY23m:XsKCDDWZASpxsPWsI5cc0GxkN2
MD5:	AE33E500AA31F84D6615A3D8E918EA1C
SHA1:	DD99A745522D0C721D2568417716E6B9DA2FFF99
SHA-256:	4C4B3B45A63BBDB946C229AA0C9F70463B840E617959BB52E11DA185ED8A3754
SHA-512:	94A8DA2E3101F38DFB21B27516D2CCC1C4E18ABE4674C68D62ED85EABE61809D78D53A99EBE7775397A4A879CE5A00DA6997DFECE268CD50926BC3BD5598898F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....TIDATXG.Oh.w...7........B#4..R.k....."E......J....b.IP.'.(.......(.JO.).i{(m...%.xH.gv.J.l..d.7$.S72....f........{?..5a53.D.....bF...P..t7f..'..Z....W.h...E.......j......SzP.[....?}...IX'....Z.B.s.MAwv....=.o..u..-..m}......./.`B.r....T....N.....8/!Z2F.......,...V@5..&\|.E..se.'.....3R...{.oW...._."...c .............K..7........x?.]..rSH....)M.\|{9....M..7.....T.>..C4+.,5i..,'.R....G....l...A\|j.c...j&w..Gf\%._.n..0e...Y..1.zs.t.Z.....u.......?....:..o&\I..W...4......Bl..4.V..B3..=........p.........j.:......\|.....P(....{.....cCLX3..y^..9v..-3.Z.~../AD.S.B..X.t.../...^.\..N.B.Z....b..5..`.&.7.....7,:?.....F...]..$...~.<-..`Nr.:J..s.B..i....fR.d.TP5.[F.1k%.0:.@j.3.Ld...'..Mk.BXT...9/.=.<U~r....TZ}aB..<~..v;...EfA.L},H^.............:..J..c;..:....K..d.q".T...\0...,....E....X...@....E......Fnx..(...(..}O....1.uO..p#?C.U.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-JKO8D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.710936747231506
Encrypted:	false
SSDEEP:	24:yzDB0zu2csxUnO3pt7c4KfJbWWa89SgaqtZMuK:yz8uH54KfZ9Sd+MuK
MD5:	095C9F6AB4987C07C604848BA9743092
SHA1:	40C2AA3371E0C157E10437517A6BB4F2545D6253
SHA-256:	D72784255491BCFE0127C13524ED0ECDC8D813D1218E5C523AF3519572C9F809
SHA-512:	B458F569970A2DFC74146D676D388383979802B91A4D3542D56CF05DDC162DC45346552C715F92E9FD1C6D4A4A172A514E53C21B519D2FEB8E758BE7E8BF849C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.]h[e.....]7.&a-..Q.9.:.....9...^..A...M./..Rw.."k..5..P..Z.S6.!......+.....].6.9.?..OO.7...\|...<..}>.....d..>.cT.Z/........i_....1.k=.>.WC....g..'.y....`..B.s..l.N.u.S:0..\|:......\...;w..:.........u...s.....w.J.\|%.e..........;.;..p.............Gotu\)g....!...l.+x...@...x..OY.rAI.Cp..K$.....{...S..@B+......3.........Tx53i\|\..?.....o......H.3...u..j.&...IGs...A...rg...>5..y.tM..H.....^....B...lX..r,.j.xZ..6.........G....D$i.Q...Z.x".0.]...v(.B5...$..j.....b.5.I..t.\|q...h..[8E..B....xs....Z...}.."..'&.=....k.E..g..E.Y:`4.K..k.oA.......n........$:GW......J.l.9.c....o...Pq.....m...!.Y..\|iU..o.yGz....F..~.....V-..?.1.i5........P....A`".4.qp..:...*.kz.J..$...~..%.S..l.8U."<pic.....~...!.0.ym}S....P.}..f...QB}..oK{.ZD.>!.....o.H_j...(@T..+h,...8x.n.(....A.. [. .N../..M.+<pU\.0...."....: $..r0.c\|YM.=...S!w....x.6...u......Z.......-89...w.\.........k.s.:4.)....M...0........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-K16VS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	580
Entropy (8bit):	7.41967298197041
Encrypted:	false
SSDEEP:	12:6v/7ivwmHiVvt19oDC0i8RO1wCLOOnaut/6c2fSvM6J4fnCb:hwmCRtDoDC0FRO1w77MPci4A
MD5:	9FFD8AD1027E6B683EFCD501646170DE
SHA1:	51757AD78C9522DF631D246DDA084611B5F9C05E
SHA-256:	23DBCF5F78C5883B0CF131BB38FA23E267EB627BD499BFDF29E187E1DE5D63C8
SHA-512:	B65B4D23070313B77D5459764A6EA3F18CDDB951FD4A9587DB3B1F35F34C20EBB5472427B236F801FB00DC9CD8E14D6216D68E9194E7281D0F83FA61F7DB4601
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.MN.P..g.....H.n...'.O.,....# .....7.o.[J.'..5!.g...E.k)..o.^..7?of.p.'........@...\...(<'1&.@.......D)...v..B+.Dl..7;7h9s.jN.A.....;..{..m..g....O....:.yG..g.q.\l..n.zq.......H...."..K........}.$.1 8o..1{.....@..\....0..z.(Fz-g.. ..I0Z4...XP.....;.B.. ^..........Q...X...\.k........$.Q.t.G}.+..!...U....5....?...........<........9..<..\w.D.V...r.....sD>....J.d.!..!.x...ej...;`9...R.....z...2..t.....5..@...g..n...s........ iEL-...@..&.:...#Y.k.....Pz ..A.u.P.J.-..A`z=P=..0......*.{_..(.`....X.0s.BP....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-KDI48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	547
Entropy (8bit):	7.529624444226664
Encrypted:	false
SSDEEP:	12:6v/7d5lyujWB7f4n1CzZy/cuQtt0dihd4xZjbO3PHwQV:CtnOKcOIhIjgPQc
MD5:	F2D6DBCFBFF24860A23A9970AAA8173C
SHA1:	AFABF047AA058E5405DE17E5D90A13A356BFEBE5
SHA-256:	46291B9D50B7AAC3D618FE71AA184766256AEAEBF383E5FDB5A78C9586B3C153
SHA-512:	3420E17BD50D9C3BBBFA994FBA658DD3C6C6FC3EBAAAF13A335D0185BE3137F6FAB85C72ADFDA726C0B8B91FB698EDE536BA7B6011529328AB528525CBE297A2
Malicious:	false
Preview:	.PNG........IHDR..............l;....IDATHK..Q.P..w#.5....W..B......... \..P......... .....!...18......{...p.......j.^U...P.".@..abCfd=.W....,..S.Ny.....RU.;.E.....[P....1m3-.[...b.H.M.\...J&zG../. ".8.-t....".....=....%.6@,...ME.&j..0....d..... Vc..9.a#..O.{.#.n....M..'...,\....?{l....=./v,..l....L..K.cm..............sn.Z?..E.!.V.T6.......4/.Lg..$.)t..Bf].....}._B-....1S.....d.0....e.n....;%s..3.....#.!.aT.0....N...E\l......3o_....=\s>6s...G /.L..9.F...8%=K..F.j....*..<.+$...M.4.....O.%G.\......lG......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-KEN8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	561
Entropy (8bit):	7.502991107969295
Encrypted:	false
SSDEEP:	12:6v/7ibiR+xn8R199AuYFQHVIKmWk/PM7QXcBODOXPXLHTin6HVUWhQ:pkoe1YFQH8WkMXeOrTindWW
MD5:	6A65D02A325EE5237F3EBD141691EC9E
SHA1:	96B58BB21F0E9130F33E9D4AC219CBB3FC3C7D61
SHA-256:	7815EDC91F7D1141D53AFF385D83A4033ACC57DA5A5F2A3DAE1C762383B0DE74
SHA-512:	56ACC6164C39738BECD0E0F6B78C910FC351EA25B81876205B7147F508C44A36E6475543132B56A74246F8D7CDCECDA3FE32C57868A8D3696F836619B9696F36
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.VKN.A.}.k...........4~..@=......5........C..{..3`z...X...]U._U......p~......@:..7...B..,.s. ._.....up.5..u.v....`.:8....jG.y...&x....3..$s;.A...Y...a#Z.J.(.....sZ...k..L%QT}o....d5a........e...0..5....D........._.v.oB.<..T....<?.~...]DQ.[...@...!..x%.. ...bV.......n..2.$ul..JX.a...m.YY{W{.........(.P...w...l.v}... .'{.{n..Y..XR>.(.Rb9fE3..yjVJ.~/.9..q....7j.M..@..X....%V....%.J..m.v......n......}p.!.,.NG..\|......c......zFt2...5,..h...S"...r?.^...os.......z.3Q../3g.....OD...k......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-KII30.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.613713129298825
Encrypted:	false
SSDEEP:	12:6v/7csFYaM1c+HIylrRoRE2sjshKsYVtyrWMes/Eb/O6W6+8yvxPmoWAPy8qCP/D:kFYz5vQi29KtIWMee4O6F+xPbPB3D
MD5:	36C2F806FCE4810A55ECA2497D0FCCE4
SHA1:	C393081F04CFC33C11C86EC34FAFA31B5EFC836C
SHA-256:	A606B9FB6783E498113C286B35E59F1AEB49011EEF4A054920ABC6EBD4D428C2
SHA-512:	6FF4156932B57766A93DA4AD80EFB67E2CCAED3DCA20C9B05C6EA91A5663A2CA6EF8DD1E7C4230BB73D454B89DEC15C893B391A4F95E07E5FF150EF4C398F058
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATXG.M..a........aA&....Y("Y.WLaJ.....f.....e4YXL..J.....Q&...+6b...3.u....{.{.y.v.........#...8.& ..U......L..2C.g...P..w...^..M.o.- ..][...=.W..J...>......@.._.....8....I...Ze.l..N&...V.g..D...M..lo.n..%.X.....rg...\|.9pQR..e..B..pP..J...hZ.L3U.....!`......=.....\.SM2.Q`..wy..=.=.x.<....(.w.3$..;....k....T.k....@...$...ra(....JIOF\|.v.........[`...,.H......@..\|..I....H.).5rv..h.vk...j)P...I...@..H...c...."._.S..L..B.L..L2o.Q.j@Q.G.ZwQf;..x.f3e..3.O.nI}...e@t.u...I..;"r...,P.K....EE.v.k&##..9S$...-.^..$E.Uu....7b..`.....v.W.%...r.@........lw.7.....Z...nIg.T..\|..=6,.\...D...)..,...TIK..Tj......Iz.L.T...K.u~.Vz.{...B.6:.Q.3...J.(w.a..\|I.....$E.........E..d}.T@.8.v;p...L...<..w..o4UZ.@%9#.fC1#.e>.....=..W.e...E`.=..%.4C.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-KLPDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 1030 x 249, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11435
Entropy (8bit):	7.837482650219245
Encrypted:	false
SSDEEP:	192:80+8JW4ls+RrYZ9vBhjfrL6XCDzjPqGcDGRrQi7CUDZdplp17XgQ3Xj:NzPriNq4zjHcDGJZviIj
MD5:	DF5983FEF86D41E19726F764F9F706AD
SHA1:	4847FB5BE5C1078333A3306424623845845B5DBC
SHA-256:	3BBBCD21C9C76008967BC85E920252210D372E14C1189281F85DD7FAB69F1C8D
SHA-512:	781C5337666726261D61479A562B9029641EBE0EBD5027A77407B73BE328D3DEAFE63A6519B9699D20A8765AFC3C713DDBA3C5C2EFAF215783E01FFABA6CB73D
Malicious:	false
Preview:	.PNG........IHDR...............7...,rIDATx......u.q..=.<.&4.{..QCf..e..h.:.0...A..@.H...M.. ..q!cS.Q\.t*... .m..\...T%K.].tus...~.w..>.. ...{.....k=...........z.!.....@..............@..............@..............@..............@..............@..............@..............@...... .?\|.'.7A........O.....~......;........... ~.w.]........!........G?..............C...?7.H`@.....Z.......C.................i..I..........P.?....h...}....?~F....?..!..-........$a.......7..7....;..!...........,H$..uH..}w.Q`...y.s... .......@..]e.k....i...............Ax.(.7.........}..3........a......3...m..-...2@..{Kq........m..C..U..T.D5.V.A.....(+.l]..Le.V........ -7......8.EZ.......HI...T).F.Y=..n}0................k........ ............"..w...G......`.?\|.'{.....;......0...{K........".....w.?..\|.;...!...y...3.........M.....G...V-.R...........H.-pJ?.R.@.......>[...............j........?.o..j`..........}&}..........;......~..U......I......0.....h...a.....q.?.g....D.S.......&....

C:\ElitechLogWin\Images\Icons\is-LN857.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.303378946908962
Encrypted:	false
SSDEEP:	12:6v/7ipayhibeQ6ktOeVpm4VydvdUQFbOA2eFd4wsc:3Di/6ktVVcJh5bO/u
MD5:	F71B0E10E3F03F959BDF5F3D3B7B064D
SHA1:	14027F7059097E0D2842E2CE3141DA6641D2FAE4
SHA-256:	E7557769B502484465094154DB6BCF96DF7BA43AACD407B19BCA2401CCCFD96B
SHA-512:	BF629B3C440940C53A9553CCD94E093ADDA9B8F78A0AD7F21CCF245B82F9523C4D646FACABE40A8D874F00634962F33B3E99DA7E137E083DF28DE40619641833
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..1.A...E@......2 ."@......!......].Skvg.nowk.\Wm...t...ofg...4.-3t(i[.."N....H:[......bh.E.c.h.1..,.1.4...@S....@i.....f`...T...R{.......~.W.5y....$.J..m'5n?.1.gIW...^..O.K...5.....h..oI..lK.u$wb~).{.tT...@U7'...O.>H....`..>........}B7.0.....8.gTF....0.....(.u6X.Us.. )nN=.[3U...O.55.,F.7.:'B.X......0 .. .qC..V.V9...v.'.../...U..-...k.X..[..J.xm;=938?03....V.X...b..@o.....S-.?..v81{.....:^Q......vAo.r.&.9.......\|.\|.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-M1L31.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	518
Entropy (8bit):	7.393790436359761
Encrypted:	false
SSDEEP:	12:6v/7p4MeYXrSlzuLjiyX8ogbbGkynsG5GIE:lMh7Czm7X+bL2E
MD5:	AB326C004A44F7E768D54C8171B92FE9
SHA1:	3A893F875BE3F778C6F1709D1A848E783A044707
SHA-256:	8759BFE59C9535BDD1B4DE2AC3EFCACB3EE9247C4FAECCBECAE0F15317ADD54A
SHA-512:	351DC6E1A1B659AF749BA2936AE52CB77DC4BF9D8BDFD2F7047C7F7EAB6BC3BCA485ED0FD2B89FACF86B97C6F57F11E1EC50D66594007B973B3C05091485947E
Malicious:	false
Preview:	.PNG........IHDR..............w=.....IDATHK..MN.@...k..t..BB.'PN.....p....e).@o G.[J.^....Xhk;.Pg......9E....kv..{f.Q=W....J...vS..`...^....e{. .Y...9k.qq4.b.}@.o....+....H=([...N...\w....._.$.sQ......`.1ru.!.$8...;.h[.YK....F.z.y...z...Q..P....>S..qe....0.. ,OB....P...U$.K1.....[_".C._p.MWmc....@........9..b.^i....=...L.....$.<kZ..J....E..".h?....Uhz\|..b..j./T....k..`..?. 4..1......j.aE.z...(MNUtl..<(.ZU. 3D.ra._2.DU(...'m.j4].}....L....p.}...(..$..m.w.w...Q@^..@.$.1..#...ig......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-MD6KE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.667306984860578
Encrypted:	false
SSDEEP:	24:msWl45B3EXSOkzkcS+Vl/T7IfvV8uf8v6jlV:3Wl45aXEgcT/f2f8v6j
MD5:	1A7848FA224BB6C426DAD9B55E090791
SHA1:	C7BE71918A8089C14C12E6F32FF77F0D9ACE556A
SHA-256:	A8D3BF1E879A3B32136001DC61713716AAAD0F50545E1C78EA6244FB3E1D2BE9
SHA-512:	8C2712A9360BA56F5B2BF8732F2A0B948C0E15FE490F8951DA5BB9C7BCC14E3C612FEAA19A9472FCA4BDFE90803B09B6777746ED7739D08E50A53CC435894BAB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Kr.@..........TEl.'0>..A.......p..e....LN...... ......$.,...X.......p....>...Q.......&.!......V.;..-......i...#...Q........._...`J.L..H(......t..y.........%@.;...;.K..~..N..1@.;.{.........R_...[\.ss....x.W...!..Q..nH.@.3~.)q........p.;.)...}.e.t....b5@..&.<.~..N..q..u......]azR.y.v.q.........5#...w..S..Q..:.>..m.;../,HM.....XK.....m%...$u.{.Y......B.&Zf...@.m....uGC."..k..U...Z..4...p...v..r.]U.dZF'].7...t...#.2..@..`5\@.....>@.QMQ.@.....\|pH..F..].^d...IZ..\|...+........\...Pv..+.dwpa...l.:....W......!..G.`.D..@p.D...Q........T..6...)..)@.x<..\+..@...........=o..*`.......Y........h..f..\........?M.....,...A.9.I..n....l..U.p.~'....!..X%..&x...7.3.tb.{..brrF...,.y........J..........0[0.0......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-MREJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	491
Entropy (8bit):	7.388359908709326
Encrypted:	false
SSDEEP:	12:6v/7isHAPsi8iT5zyvXKrIropWC0yf7SvMWt7uNvynDBMYAxu1Ft:5si8ihyvarNp50yfGYN0BRAqt
MD5:	046EEC8CC220822470BD1422977810A0
SHA1:	A87F24B1CCC118C7DB55367F4D1059D826E8B94E
SHA-256:	8C64652D581623953ABEE622FB3E01C357DF118EA38B6C0FF69640977086F9A8
SHA-512:	89A7D242632B67461875092D92F0F48B871ED19270354C3AE03BAE9D0EFC785016E4A7C0F684FEA18B4B292D7209EA598C7F5AF84C140123480C2587542FB83D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.KR.@..{......f'...7...R..N`8.VY.Ro.7.N .@.....(..'$..$..,2+(....LO7.5/...k.e.r.iqm}.....0,..`..Sx......>..N\ .+...$......s.^Ck...l..k.e.6nr....Jp.\|...7..`.......W..[... @}_7...VA........0.}X.."...u....s>V...n.gT..c-...o.....t.JB^nAS\..b.B..X.......k.q0.....D.".....f......D...d..8.N..z/Iw...=....W..'..C..]....2.2.2.6K.1.......J..pX87;..I.v<j....-.de......E.o.......Bg...g....1iQG\u.E.#...d.Z...O.E...........0m.......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-N0PCF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	7.40901387361443
Encrypted:	false
SSDEEP:	12:6v/7i1zLf6LUk+djtXsCZiVsKKC9dJ/lUuOLrOVryVgM:zzLiQk+djtXsCZ/arUuaWrm/
MD5:	2E7987285940F71F849B21B44CD09204
SHA1:	AE0CEF89B6E2E937C61346C3C7D745CD83ECBAB3
SHA-256:	DB4674E8CD42D8D5241CAD5B27497B501F2EEB67A8BA08D1663B08EE075BA3A7
SHA-512:	A371096575B0F4345AE044CE425D9036E2893B1E50914E49168362D59EEB1AA572F38E3DEDB4BFE675789387F4E4AB80B93AEB032CF81BBE62B57651859F11B5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.AV.0..g.[..p...z...z..`.X.+^..<.x.8...O 7.5.v\|..j,.JA.tE........=....~....$..w.pG.O.p...]...J!v.P....B.}.l..'@.D..D..gQ;V.P..>........2.W=....:...m..m..7.3GA..$.#.\|..;...f..\|fn..}"..1.....p...f@.v..gc...ct8..33....(.....^.%.13.)........@;..+..n..J)5.Z....6x.m...Qg0.4k..k....@..oc.5.<x.. y..H.1."...Ak=..`"%...k..`.J..T..Em.I......,..s6NO...8I.SD......Z'..C..D...^.D..8.oz.....\k.D.8.[Y#7.)kR..T+G.3"....\|.:E[.6.}l...q....X)..m(~D+...T...........g.....!}g.)"...V....t..H........s....wl....n......IEND.B`.

C:\ElitechLogWin\Images\Icons\is-N2IDQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	602
Entropy (8bit):	7.549829661442623
Encrypted:	false
SSDEEP:	12:6v/7imzIHDi0fbzlXChFF/JcstXMuJ1CXp9atsmOtichnfHil:KIPzqxh1CuOzignPil
MD5:	F16654704153C1231BDED7D39549A17B
SHA1:	6D771D6801D1F55AFAF14F353A39481D5AFF7D89
SHA-256:	961A1D8DDA52384FA04ECE9930DA163525CE1A6E521D389FF3AC8392AA589818
SHA-512:	F4614ADB31B3759C2DE570B924F832B1F9ADE686FBF98D08C93D7AB584C0E9681CB0EE8ACBB6DC386582BF9903B4B2994C7B600B7B04ACBF4DAC4B355AA121FA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....!IDATXG.AR.1.E.G.\:p...x...z.u)l....d........f.B/.9...#.B....-......N#..._.... ... i7.0.UO.>.n..Y.d.).@-.....7.=O.......o....^....v.,D...!...VR].......f..m&.m.h.U.....}...8K....4;g.}.d.."...`...!......).%...L......R78.L&..f...Pf%.C"j.....a.9y].h.4/...k...E.....RS\.B.U.<.i&..m...9).....u.4..W/...-G..J....O..f...k...Z.......]S..Tb.G.oAQ.P.y..16+..FL..'.{j.'j.)c~.#sM)..P.\..2-.r..v0.1........l>.H.......t...]...w.$.;...o9..l.....X....&c.._..&...%...![.0..........J=..w^..1.PN:.+b..ev.....Kh.~^&\&.k...U..+.R..VR.?........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-NRMDA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 53 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	7.861534567565303
Encrypted:	false
SSDEEP:	48:A18cZ8w963YY1dTWaXARjM602g0zqXFgghiGU:M/J63YwdCaXARj702IFg2TU
MD5:	96FAA1C30804D1E5DF8936AFCD07EE2A
SHA1:	564CA6BAA0F6726FCB38C18DF3BC5F4C5B353A8B
SHA-256:	3C92DA83202A9A06E51EDB67CF696254F79DD22E0F073B707547E57A63B27C3B
SHA-512:	09822EE0BB0ECCE1F9A9EDCF047E99162D3630FE2CB9E4854D128C7702AEAAA984133357620B0427BF9DB958C2D39FC7CBEE093F5B95C08C6439509A08F1D2FF
Malicious:	false
Preview:	.PNG........IHDR...5...0......+2.....IDATh..YkHTM.~.Y[,o-^.%ZJ..).. .....B.....J..BA.Y...$....0...vC.U+..R..t.......iw={vW.......33.;...3....'D...`.X.Ng..f1..j.i.Z.u`J.......1...6.~..j..)g...M.k.V.?n....E.D..HYbk.~Y.g<.Bes.D.`.VbP...&.G...$Y.H...5.}.}..OD&..l-ic..No..c.....C.".Y..K....B......B__..;.....;...,Z....Z..V.5.u.T.{{{..ttt...8..M.6Qnn.}....Z-KD.....f.8..PVV........d4<<L.b.OW.[..O...222...../.....H....Z.n....../..y.@)))&..'....BCC..7n.@``..off.}}}hjjBCC......AAAx.................T.q.BBBPYY..7o..8477#&&F\|G..T[[..=...........{..Att4...P__.....@{{;.]..H..?.r94.."##.....\...@...a.-....\.Ggg'.R.....l...........z~~~...J.....>\|..2......_....Lf{......b.W.Z....6.....o........=R?~..J......`.5x....]....:..J.BTT............@zz:...1??.....@ww7v....n........q.y......"Av2f/SL..jivv....I.......?......C...F.!___.@...4::J....F;''..>}........2..)U,).J.GYY..8q.........3......[....N!!!..lll..7..........00......Z...G.Rbb".}...G...t......"c....m.....

C:\ElitechLogWin\Images\Icons\is-OSUF1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	685
Entropy (8bit):	7.581384275172213
Encrypted:	false
SSDEEP:	12:6v/7iU7Ig2jHh9jFObb41o9gkQW2Dr3mq8A7uTu5h6LrZ4xQlyRCWSMg4z3j1:CIgELoXC9W2eq8A7cu5Crl8RCWSMf3j1
MD5:	E8ED5766C8B27DFF5F4417F9F5109D10
SHA1:	7ED5E02EDF0801D7696A52FED1AE3B0358FCB959
SHA-256:	78276588DAF68A1DDE15A05A0FB4E147DFA44E7F58786238773652F00EB88EDD
SHA-512:	E5EDA9C65FD7789138FC123ABA56D592F5F15B24B5C752CA3071C87C0A2A91AEA5D2B952B706F34F5703F30D156B7F28595D658E90F5A8D5BD0968CAD49CF172
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....tIDATx^..=.$E...zzv..}.C013R0.Nc...DL....\|....b,F"..'0P1...Pg.v.wf... ......=.t....S.t..7.q..$L0..n....<\|..y.4.I..9..q.Z..K...\|...$.o.M{7.^/.oZ.k...3...E)....TD....O..{(....g\|...^..9>._.....J..}....2..4......[...........d..s........ ..Df.mUO..J.d...0..Y.n.;s..A....v....@..k..D-y.P.z.p.Eor...V....g..Aj.{..5......P..v..\.X{......Xf.p....u_..\|.....@.......D..OH..4...&..CA !...9...T...."gu...5...,.{.:\|o..G.TD.{ ..\n.r&....n!..&._x. D.....3.l.A.:...'..\.....p...Z......cc.U)j.w ..5....:..9\.TC.....V;.!.~..9.F....\..3mK..HI...P+......@.EJ....Z.......Z...4..v...-J.NNO.R.%.E...v....0.!fvk...........w...;.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-PFILU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.873772094374294
Encrypted:	false
SSDEEP:	6:6v/lhPKNQEk9AroCp2vR/6fE89FywRqDZ/m0hN/7BxjQj2U/bp:6v/7i6nAkqRnMkqDZ/m+ns9
MD5:	DC8E90A99670B7C52FA4FB9AC9338122
SHA1:	04C5EDBE7E890C21C36EF77BDED6BEBF30740307
SHA-256:	B231448C2AC9CF3AC36BA688EEECF3B731EC2DFC59AC79AD3E0839F541580B10
SHA-512:	939352268694FDD2751A3BDE275C2C3D7D99DDC1B94BD823F8E24A4C32ED256ED8041269AAAE8068411814110BD1191188D9285F6EBE1FB6AB6AF6630F671FF5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..A.. ..a.B..K..4...d..+.L ...y..B7...?M.x.0b..L.!.Wfxf.....).)..EP.}\|[..0.r....P...............-.*.%."...q....k......B.....7.c........iQ..Z.Grn.._.....\...e..W..Q.W.....W...-..X....V..7.P.%n.h.k....L....l...!.z>^-G.....!.Q7p....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-PQ4RQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 51 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	7.8512021042817235
Encrypted:	false
SSDEEP:	48:GZZUbQnzWCwYgOe4232+znv9akMr57GvzCbxIrqN1dv6NCIJ6Tu76:XbWWRYgN4826nY97Gvunmk
MD5:	A1991CBFBBB4DBD7A6CDE1563B7A6F88
SHA1:	F9DB5A4297492093DEE27F4A74B8CBD55FA50F3C
SHA-256:	74697ADAD8D87D0B3D459E59A75041B8FC214279994CEC09CBF7A7F5218C427A
SHA-512:	5717BA71A40BC96E97F9F7AC5307D20FE3057C3223CC314B8B3DF5C0C069C94C091424D3707B36AA4E7881EEF5448F1C2C7486D3A0C05774DEBFF5CE207FD7F4
Malicious:	false
Preview:	.PNG........IHDR...3... .......@....$IDATXG.X{pT.........c.......-..p....ma.1..-CA.d7.`A.."O.@ d.q.Z.iy.....:..%ul.. (...n.;.....lHH.Bz....~.....<........i..MB&.0.`.........`Mk....3.. .cxj.<.m7A...Q..9..$......0.&j..;....`.n.~'....@...M..s...>2".......35J5.._].8.5L....#...\.....B."..&C..;1....j.......R..j...2.F.kFk......3.\|....-..9......>S.n..h..._...d.....%...1..l....c.H....V..~68..........J..rr.](.....=.?..W.29......d}... g.mLn.2.9.sD. ...#RK`v&..4......l...eN..&.4.......B.T..}.q..J...$...R`.....8..W=..^0.../8U../....Z(....}.......K.;.p...Y.As..,B_$^f.y.J.U'...x....w..BF....F.d<fl....x9.4.85._.........V00..f.d\|f..&.k.m......../.=(.x+d.9..Lml..%.4p. .%..2'`...b.4..@.....)...s..5..B*D.FZ......;.+..$FB.j..%..}}.e....)...&...4..m..)....q...1.O.....$.%...a.6G1.5c..lP.../.y..T..R~..x9ll$.'.V..p#..=..yt..t.......+............SF ....m.qkU...{../..&.7...M......m...B;Bp.....'.F...."..5.[@..A.i<q....X.]..C...... .A...&9.mU.Mu.)4....

C:\ElitechLogWin\Images\Icons\is-Q0VSV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.595898861148111
Encrypted:	false
SSDEEP:	24:qSdYqWXFvv9y9UdIOAhpb4oBD0sWJHG29S8:qm7WX5FSjnLFGHJm29S8
MD5:	2886897DC6FF2D28D01E7FD5E8E141F9
SHA1:	0577969272997A626A1A8D171478AC438AC73848
SHA-256:	3EC8E03A710EF6FAE168BCB154BA647D1AC7371811DC971F7709032BAE728DC2
SHA-512:	EC7EE35748F7E528012F7ADDB4DE306A4E6AD01C4662CDBCA17E3FCA90523A0E6CD5BD062A234A7620E7CB53EF4B913CC7A4B7A05CB81AC72316A70E2E40231E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..q.0..1...x+XRAB....X. p..S......BX.....T.PA../#1.H.=Y.xd.....+;...].........lV.,w.....o..w...v..W..'.P...Q8NP....X?C.K.......i.Z.......m.F_.^..{.....z....^..I..X.(..B...\c....6...n.....$..el..0G.....T.:Z...........(..3..e....B.B..P..{<t..i...n].1..0]^5.... .....aZ...SxF.. .v...* ..6O&..F.A'=i......h.8.su...D...(....\=...........s.#h.v...Xa....L.Z..O....".O....1...:.s...t:M..j...X..O.L..(..g.+.7.rB...Ir.D.x.pVQ.)A...R.?YAS..=.^(.@....'......p.K5...`....n7.J.^.qT)...:..).u...LE'..w.+....:....t.#.....pY%".3.@........^..L...X3WK...D.....zH...y.k..@..#4R6..?.MG......... ".Z{Q.OH.......N.1[.)...!./T..,.....V...Ba.Y....lv./^..X...c5............u......E.-x.........'..c).XNl....=...>. ...C.....z@.LU.+W...T,._....!...0......K......y.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-QPUAA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	7.732042945432951
Encrypted:	false
SSDEEP:	24:jpZ0SARuJRj3AvXvjFTnZdqbgV0jEQj1+NujwIC1yf:30nRIe7FTnZdqbgbQjo2w1A
MD5:	9A996D34FFF0F95B4000DC5C11B3058B
SHA1:	82040CE12A720D73A769045D9CAE754E07809556
SHA-256:	0626DC9D2A01B486FEAA75603296DC9861DFB9C17AE2951C5998BCEF305C81A9
SHA-512:	722BF6DBB758564280409A89B6F5C6C8EB9965D9A79A4E9D33DA1E553934831DB51AA9B865141412F89D3DA903CBB3F827E845C3D228000E58021B9372D130A8
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx^.{HSQ....Q...G6.Q....X...V...Q...4.AY.....R...e.T...+.!... [....r..w{....7...v....:.....;....\|.w...vD&.b8f.0.r.>.../..f....1..V.d.9.P.........t^lh..6O...?./........(.}.........Ht.e...J..0L...D..../ x....."......P..S....e.......\..k.[.j#.@$.4Z............._mUU.9....l.........=.iSg.....BL...B..@......./......'...4.EK............q\vVP.............._..`.......w...'H..y....M.!....D...II..AGX..A ...1iU.,;V.6......B.....'.T..?....A.m6.8y.`nii..0Q.p._~.......7.R...o^..........9y..^...Bm.....N...j.....-...[ \O..@....4.. .F....t.....My..h..i..A..i..i./.Z..:@@..BA~$58>..&+<.Y...nc..0_}M....<... .'..zC@.>..5..<..u.k2AS..0......k5....3`.].kN}.LP/.5.21....km.U.^Q.<3.2.wA.B..........oB....rPh4.#.Z..m..A..} 6.......,.......i......?m...W...I,.4j].-`Mfh....W..E.9...w....k.w.....@.r.+v....w..l#..=. .....R.......b..\...\|.....D...zxK(AB.. ..5...u.^W.....r...!..,.=`H\<..u.............7..~H.=.V9....- L.b....3f`a........

C:\ElitechLogWin\Images\Icons\is-QU4P7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.688963947606658
Encrypted:	false
SSDEEP:	24:04kbEidDRLgaHLrK787GyQanPCR0bh+ua3PQH93P:L96xNfM8qyQaa6OiNP
MD5:	B6B35F7ADBEE59C227E0A5EE6BB8092B
SHA1:	B0A6B1439F08F347560F6F52649C99CB1148347C
SHA-256:	0727FCFE3D312E7FF946525D0ABCA9762EF3E278F6F80C6DF8D2BFBC07AEF3D0
SHA-512:	0A62C2FBE79FA560575BF5DE2AD2786A4F4A9710ADA18FEB82D2846D7902CDCEEBDC170B2E8FF175B2EE96A3B569737A93D56ECF11A0531B5D0C5C430A142815
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....&IDATXG.WAr.@...In.\|.Peq5..............@..c..Dy........@..j'..8BHZ..\...............W......fQ..#b..L..)..h..... ..9..eVf31`...Hp.A..dK....$.&.........\|.....k....P....R....1t.+NZPs.0E..1......X.i....@........K.M..w..\..>.~"..x>a...N...1...xvK....;.. .]6../..\|.L ..{..........hS. .{E..M@...N.:...).u..s..O=.\|....F..@...k)..$9"P..Dh&).4....Y..;....i.....Q...\6K..../.F-............r.T...w.v..f.\|w.t.....aE?..ky.Wx.h.f#..V..,.3..0K...).......7J.'..N..N...\.`..c.(..$...r?y..C...g..C."\.......F.F.\...(.....7.Z>..,V.x.....".fQ..Vt"43.a....W...Y.(.~(..$.... a...H].Yq.E..sIT.Hr.......h.....Z._...M.. ..qh.}...L.x.((.-V..$..w..ZI.R......=.5......;...tm.^....R...m\|........ZJ.K..a..8.P.-...r..w<.8..4~...;...r......\...u...........ZJ..........8.C.6.....\...c.....,A.0...l....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-QVSJ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.707217714654351
Encrypted:	false
SSDEEP:	12:6v/7XcQacDtiHNl08bNYn5Di583iwV7xp5ItO0PwRb871vtjQHVQ+vObe7:gcQalgKNYnZi58rV7x4tO0P7gHVrvu8
MD5:	BD5B204ABB9043A6ADE35242FDCAA4E1
SHA1:	51C18D3BACD99E1C8C249F8856F22988DB25BEB5
SHA-256:	FC5A4418922F3288B67DE8346CB3FFF5972CF28228DA0AC0244F40245C6A744B
SHA-512:	D29DDF531D4D57581AED553F292511C4708AA4AA8B15EB34B071733CDBE50A45540E79A266E0F1ACBCCE63B38D11ACF3F95D763339A2D3A8EC9E00A5EFC7B45C
Malicious:	false
Preview:	.PNG........IHDR.............r......IDATHK..]HSa.....<.t.x..kf%...K,..h. ....PI..]DEXA.Q.yQ..Y..-.C(Q..tADB..Lv...m..M=.s.f.S..:....y..}I.z.Q......i....$G....\.i.}~.Y.......x.6U.3..O.b...D.wgqA.y..f.[&.}.o^...".C.>.G...@..S.v!SU.!.Gg..&..,...m..x..s%.3......(\(..H.J.D".L.8...<.(b...Z..Gq..M:..S...Q"Q...d:.cy\....-~U,.I.......;...d1y..VmCS.....`..q.v9...".7..X4.._y.0"b...m(.......P0.Y.,Jo....$6e..E....q+.z...%!...+._.(.l.:...%.av..U.F\|.pC}a\|.\|..(........g..D..b...\..`..F9.w.q}..yB] ...../.#z.F..r.0.Zfl4...J......W..m...HQ.`.QP.ub.j.RR7p.........b.owP....\5.W.6h...T*]0...&..HGs!.%....`..~....vd.5.....Zn..@.[.e2.0........1:&.c...>LZ.`E.....[..".6m:..7.o...!$.e......%a!".../l.....eZ../.[!.R....]........~...s5V....B?4~..\.i....2....?.HM...b....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-R3MK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	7.750752700425879
Encrypted:	false
SSDEEP:	24:aCKKx0dAzuqlhYVSE14dq6PLrOmWqd3bX/ZojVy3D/aWejXI:aCKZKzblhTo6PHxBopy3jaWeLI
MD5:	C09CDC57CACCD16725246852EA1F93FC
SHA1:	BA25C0B52599CA6E520A155FF7D9D08955E9DF07
SHA-256:	72BD5797EE6AB106EC6CAB7A599F05F362E47B197A5CF266F98E3E104C33EFD6
SHA-512:	B88EF9A9B9B3ACDDE8255A9ED30607AD171D92C249913861A61CBA3888022D81D48F901B111328FB2E423FE8CA94442E6051842DA467AC9DF08036F2E9A84F91
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAV.A............JN.<A...Ka.<A....d.. .......=..`\.yS........Y(.]U.....2...s}..@x6.ygv...>._...d?.dS........}..!...$j.;..@wK...5a........}.7...{....q.\|..B.%.....Vr.0To?...&d./1.}....U....H.'.HC.....L...@x....f.0..x...3...Yi.T...k0SK..q.@x..{...,i.P...{[...xZ...F...v..v...... .<..B7O.T..T..X......f.....l.AAAr..d.e.k.9&.. #.T.......t3...h.*.}.51...."..O7q.S.../...@r...r.0t...;...R.t.t....^........>...d.NJ`..3{m...;f#....n.S..<t....Uy.9..i ...(ZI..8........r..H..[..c..}..t..q.........pv!=O...5a.G...4.5.@}.:.F.4.u......,.._.b..A.,t.W.......}s.z..0..&.~.J..@.H.e.w...0w.e...z...< 1.k........!b.-S..s'..;fzi.b.`..4.o.1.t..L.K..4_#....9!.....%.c!...a.../w.........=...dZ+f.D.W.j.OI9.4+f....@..<..%.{g.MG9.r........l...\..4$~.2...... ............z.]k.8...{.......1_.#U"....yZ..(.. .v\R\|........av...9P/.?..R.W...L..&l.so..2 ........n....SV._......K:...._z....p.n...I.1S.....V..@.X/.v....9...X.....K.......k?

C:\ElitechLogWin\Images\Icons\is-RVVEA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 600 x 542, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	31566
Entropy (8bit):	7.949245203415111
Encrypted:	false
SSDEEP:	384:idbj2fmZxqJf5V9j3DW36HKFBrQvgz8AXdjlNx48jykfRs8typBYwakZIzqhBic/:idbjgmZ4hLqFBEg9Nx48Fs8o0aZPn/
MD5:	9862349CCBBD010AAE9B4D7CEED22F9A
SHA1:	9D8C7D3E6A95BA269F7C1B2BCD5F6744F17D85AF
SHA-256:	A46346B49714FF5C918EA0AE35EF458892CCCC44140A9B70885D8A3137586657
SHA-512:	F8003A63135DF52922A4942FFF6681EDBE86C57319E4800E1A61EA73634F1DE4B788DF70410063AE89F9C5A709FC31CA8D33E618E1C0AD4F00DB7B1D6C65E6FD
Malicious:	false
Preview:	.PNG........IHDR...X............... .IDATx..w\|.....gv7....".kh.AP."..tP...QzO...@.H....- .T@....]ZhB(....Rwg............d....!,{....{.=...RJ..A.D...... ..8..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. ....A...4(... ..A!D..A4..!. ..iP...A.M.B. ..h..B.A.D..".. .

C:\ElitechLogWin\Images\Icons\is-S3JU1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	7.705362782732972
Encrypted:	false
SSDEEP:	24:0iAKjumoI8CQdXUdLUwtY/79Ux1P+PXywfTxQDtEw6bANy/:kOJDQORi9SPWzWDeNb3/
MD5:	5FDF2ADF0C3A8285107FCC73C63221F8
SHA1:	D729489E24CB2837E0CBDA5417E697575576DA4A
SHA-256:	7F24ACD181BC69972276998CAAD418BA920815485FD65861FF43BC37ACEE093C
SHA-512:	6F3338BD2890E7356A59A5DA47C3773C3A52A65AC7F5C072084D2C85B9701238AC6B3B445B41009CEF6137D7458AF318C246FDBF7DDAB7A869E11EAD02158299
Malicious:	false
Preview:	.PNG........IHDR...$...$.............IDATX..[(.Y...^g2Neh..M..H....+...r....hHB..L9...4.r..S.\.\|..drH.!.PrJ{;.=....07l....{...~=.....l6.t]..\|......%..J)..U?..........K+.....o...RK..t]...;.o............p.......L&Z+G)5,@.......4...\]]...T&..GGG...$T.Rj...=.w>>>6..4M...i.7n.9........!Byxxp.4]......]`...........K.@..@..}Q..W.1.766..Z...........F[[....>=[YYAQQ.ZZZp}}m....N...@)...)........Hdffbzz....`........D.knn..........(.YVV....,//....u..95......^.[.....gee...........j]........ ........~9.......!..q.M.(___qaJJ....QWW...(1...'G.-.g6....RPP...9.%.,88X.F.......lNN.X....9==........Q......^....T...ckkKf.W....x{{.Y.8.......n...XDEE.<...mM\|\|.m.X..................jkkqqq!U.qeu.......f.......QDD...haa.MMMr..\|........... $$D...._..E@......A@@.Z[[.....gll............`.pS....K........'...."--.UUUpr....z+)).CCC...........l}Ysjjj.....Gnn.P..,,DPP.l...#..677....u..l...-.....X.,u.E....r..T...<....?{...R....yL..WWW....W{....@....[..=D...s...R.)......=^

C:\ElitechLogWin\Images\Icons\is-SGLV2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	2.6137809854184813
Encrypted:	false
SSDEEP:	48:9OUMfMQoo8Hl29utsIvXv/+TQgW6kX3FMt1Le0otP:9cX8F29umYvvRVUBeTP
MD5:	C7289EE7D185C1D8E535E2E3DC7162C3
SHA1:	92FA40B8036F0D78582565695ECCDAE9EBD8BE76
SHA-256:	8BB97D0A3226702D409D8D399499993CC0E6B73C0D398046E8E5A526013C468B
SHA-512:	AF4C7FE927655639EBF7CC05FCBBB61DA3F3B9A7657028A274735F052A4BC5FE22B725D4FC211AB1286BBB3C76D987D84A91CA53398A31100BFAA44CBD570045
Malicious:	false
Preview:	......00.... ..%......(...0...`..... ......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\Images\Icons\is-SJ364.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.484530310368009
Encrypted:	false
SSDEEP:	12:6v/7iLOZRikIXjJ2x0RIbhif1x+a+g7DGTV+bBz2/l:IZMkIXng9TUVza
MD5:	A4490677CB0D4B1281E17C31BFEFA023
SHA1:	879C51111C5140B3660A1F3C3C4F90633970CDA9
SHA-256:	009C7E52D698C913ED7328B417393A19EF1F460B53798791C03DED6F4D93BC6D
SHA-512:	08EB935C681106BF3C42C749B862BFF14A19708207EDE8B30EA4C63F793D5E5756578A66DCAE752CE89B189434E0A82563076978F8A04A48C482BF3A45E1D889
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.;R.A....T.....r...p.5..O.7..H........U..t.U...j.e....!cf....F...=...`..........ws61.f.P....Y.7y.l.........H!.ya..v=W`..Z..=..lK/.4.......)...Ks.O..u ,T.w>L..N.8.t5.8...s..N.(...3.hya!.D.~z..DP...Ad.......;..H...\|.D&.5p;H.:.)H...@N...#/6.pI@A.T.....(...T...[.4.8m].+.....Y...F...v..d[.6.i.-u!......W..+...\V.f..>.V_T2.$......X...{.q.u..2..p..B_.N.\|<.......7.A0. .V.x....,..q..>....-k$-[.....Ox...JjH8b...ZG.qm(.....\|..`..14y&..K.j@..<....~..9B0-x.f....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-SNJN0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	7.805120493437256
Encrypted:	false
SSDEEP:	24:aDqdDBF0QZ8AfqenWYcwcmSlbq0KXzg3h2y52lptw2PQAgrOwjX:aDq5BfFfs4vSlm00zgwy+P1gP
MD5:	3974D3DC43E1C1F34C90CF1D93CFA580
SHA1:	7C079EE22871B8C67D98229B5AA6C89034416C97
SHA-256:	7859DA6A1E06C268C963DF055E1A82DCBDB5DD85A2452E2EE3936F6DD0110308
SHA-512:	895891E8CCE6D55F04C58E747F993E72D9B942A1F13C456948F16DC66925164FB270B66307EFFD8C1600FD69E288EC5B40C0E0B9BC532A487D87CC70A99B7C40
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Wkl.U....V..tw1.P........P.c4jb@P.....;Sj.1$..D@c..2.....(..E..%.. ....................E....;.\|.s.=.p.?...Q9..\...S..A.&..N..@.0..@'..g(......n.V.s.........PW.Sf..q.T....K..5.D.dW.0... ...8a3.D<....h./...P..s...Q.HQ.Q.....z...6n..:..'r~....7XO.C.s...DW;..$.<%..o.l...V.......k.X.Uh.....r.:..?:..e;....^<......o.@...C.......q.&z"..7V....2.pT....V..3.m..>.............\|..A..Y.........=5G!Z..t...IE.DV...mw.2.....Wn..?.at..3.6c............]d.q.....(.5.}....?.+....3..Bg5...&.W....0...b5...........2pT&.c@....@ms..P..Pw.&U.2.........L.8..e..t.!4).....,-1.o.... ...l..lCb..@DO.....,.m..$e.0O....OR.S........`F...k0.:.........8...,5.@...R.C.H....i.)3.!..".:......,..#.5.......RML..0R.....v....r.5...T.....R.._....~,-.6.>i0R_.4........8..H..IU<.. ..{f....@/.....f.b.. jdp.T.W\..5.kb.s'.....,.4.j..J.`.I-Q.] ....&.).@LOO.....X...g..=.lc.....N...>.. .......t]V.....M.......q..."U1.C...........hs.......h.L.{.....C.W--......

C:\ElitechLogWin\Images\Icons\is-SQ058.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	469
Entropy (8bit):	7.4418666112473595
Encrypted:	false
SSDEEP:	12:6v/7+o5N7uja2aoHryTyMoV7RGE6cKgRE1PLbL0FzIWQIDb:kPSa2aoLyTrKK1jsFzIWQIDb
MD5:	85BA40FA6274813CCE711670A6B66267
SHA1:	5A2798D4BBB79D9BD1A76E1D3CD92AAFC8DDCE2B
SHA-256:	F01F1146D657AFA4781E746D7AEABFF2C2FF0B22A0A15361776E40D60B058AE8
SHA-512:	4DB16EB658857279C6466AA33C1CCE4F5C24B513EB934E309986735DA2D714E0FB1145FE2A607DE3CF1AF9E46009624D1372983024FD74FA50BE5E40015FF892
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8O.SAN.A...1.....D......?..p._ ...........gL....L.i..vU4D...S]]]-X...q.....?.A"@..M....W.....C..."...x..d...x1........+..G/H....i].m^X.jo....1....WE.A..."`d..3..c.\O .P.N.[m...h.Uu./;...6X..]....jR..oV......4.C..C.v&.....4}..zK.Lo..D..,........K...S.R.{.%.;..zjT..`.....)...Z..._..1...{.#.M.Yh..d...<...b$.}......<.t.@..5.pO.F.>.l.:Z..>.k.....9.....;.?iT.3._-..e..A...V..l.g..J..J....rG..r.^b....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-STPKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.587360887008445
Encrypted:	false
SSDEEP:	12:6v/7ii5G8jTAQyKxeNvQjk6PlklQfxFBLqtbn+3KIcpbRUrMAsvRuVgMyG9:EG8PymeNmzkK5FBeFhSJyIgMyG9
MD5:	8FF3A00A4CADB333C3E9610B2E4E8F1B
SHA1:	C2A58EE4DB7E3BCF7A06F92D1A323212D3831869
SHA-256:	9D401A6D779C9CA22677890D60212E11228DD499138539C8E99C1864ED5B4EDF
SHA-512:	A87A61C03CD494A2C061008C757EE4BC0D4AC3EFCBD9E66436464D3C363F66853E30014450B5E7460902B42F0C43052ED208B88473A427AFA0569F21667452CB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WAn.P....,c8.H5.&'(.Az..%fQr.....g.r..'(...B.....2..t...oc...Pk....g..y3 ...#.....S..J.j.c...7% ...N...`_O.. Ip.u..A..@e0...7..R(..2....8){..W.....u6.>g..1.~..D.h;.S`_=.XZ~...Lmw.rzYE[.&C.....=.w.p..^...w.?......p._$.......U.\|......jR.oM..."p..hBZ.....~.B......7.......r.`s.."..G36.5AD...[_3..".@...N4.p..z\.7.&a.^.A.KK]....s<...L....A$...~.[w.N...N(.v6...c.\...H..a.....r...;Z.c...I....).,.F.- .{<G i+.?..oCG....a(..N....Y.\|.8.'f@I.f....*...uMQf4Dg..q..f .PV>..F".~....a..\....>...k..mc._.{...E..N].,0..%Wt".+....a..)...n..;......%1..N...)x....`.>O...d\...p..h?.N\|/...Y<..k.e..........[.x... ...H..../...TI4..+.l..CG..X..........$K..q...d...z.G)6...&...$.4O......#r...2x`.@s.....IEND.B`.

C:\ElitechLogWin\Images\Icons\is-TFD3F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	624
Entropy (8bit):	7.444335907239522
Encrypted:	false
SSDEEP:	12:6v/7i+2reNByZGEv7SxEheQrXTwNdSnpLcGKPrUqFrE4CloBpRb1:s2iNG3v7AceQrjw3SnpjKzxjPBpp1
MD5:	4952344E16B525DEE69196BC3CD579C3
SHA1:	471AF6BCBE5526100D817290CE8C1FE161A710EB
SHA-256:	90B705137272C554E8C31F184281DE091427601AF1612786C01C4FE93F60B3CB
SHA-512:	44C4DD8F26C3AE9DECF176EA209B50199FF02E57EC194A9D695DFECF5087D476D147292691BB58666EBFAF06310640FD8CD5F4505B8D3C8E0F9B57A71A52D510
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....7IDATXGcd......,.......`b..Rf_..c.j.(.D.~F."..........OM.F........j.hE?$d....."..RL.<........<%..4s..7....y.T.@.....OS..,=...#KIc..s.....1.7P.......R\....@.Ywg.`U.s...D9....M..av<.?.S.)........,e.c......!....@.....A.G.....#&.......Z..V.:`4.FC`4....7......F..O\.K...G.-1....L.8....0\zs.A.hp.Q&C.&.P.."P.$........./..f...b.>7.....r....%..'{.4.Pl...;.X@..@.)..3...?...16....3.B.........{..D;.d0.....a..E`.bs...V.&`....)....3u..A.J..x?.L......wX....(!"....!*.........x....__......-.Q ...!/..a......r.....u.....juN......o...........s.....!.s...?.?.`.E.j.I0........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-UJRKO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	515
Entropy (8bit):	7.451082465646724
Encrypted:	false
SSDEEP:	12:6v/7i7swKTeW56mCRTIUC1qGZdn+epj5wSZDbN49J:qB/XNvDij
MD5:	3C8BBFA2B66A18340B2B06FEE9EF57EB
SHA1:	9DD2E31510D3414F98A1BE7E787C6F507F10B6B0
SHA-256:	F91E6F68049869A9270DCF7491D09877D5802C7CA775E203DBC67C0768046876
SHA-512:	5F25D0A7A80F48E48C32FA10BE722FDFBE6F942DCABB5F006B75AA9794605B9B221035F97FBA2A7FB1D7154022AC2DAA6E510D770D7AFF1BC56707836B58EF47
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG...U.@.@]^.9.h.............#p@+......v.t.9..3..y@....D.2...3 .`+.r.4.s..(...4....[..s!.=.L&.I.....u.......j...)..%..P1...v:...(.....[0.!\..n..p.........."....;K.....4/....~...u(...R..._."T...T.LC..CHp.g.....G.\%\.Z...+.(@.8...uk.[.._.c...9.......#......tH...%.$`rV........9v8]..{..v.....Y..,@..%H.L8K.`k2..<..Q.....>.\+@..j'4+ma..p..f5q&........]%N.!....x.';.T.)*k..]..,C..........NLG%.,...,.. .C...(...p...^e....H.G.v.^.............?..........IEND.B`.

C:\ElitechLogWin\Images\Icons\is-UVA1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPCM), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop CS3 Windows, datetime=2019:02:18 13:14:43], progressive, precision 8, 500x300, components 3
Category:	dropped
Size (bytes):	36494
Entropy (8bit):	7.548364802140436
Encrypted:	false
SSDEEP:	384:Pr+eKa+emnWv1H7dcdYNg7YmNgqFH8fiiEQ9GobGFSbk1w0Hqweok1WNkivG5Qzd:PrRCWNbAYybRt/iEFJ1bHquNkxIcM7
MD5:	00E8DA51E7A81DFCEF29752BB2DE1E88
SHA1:	605A3FC7476D64C38C37D8673A5947FADA12D77C
SHA-256:	A2E9EB72E329E328EAE947CABAA9E0B4C8AA9777DEA239478C4605388AF81EBC
SHA-512:	C6D5E356D7526210E8715E79A5974DB5AFACE4705D7A27F65E24272DDA545FF6D1A337EC0A339231B176CB68B493FAEB861AFE9FB366DF8FB4163925BBA66AC6
Malicious:	false
Preview:	......JFIF.....`.`......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2019:02:18 13:14:43........................................,...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................`...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....I%)$.,$..u..G ....Y..ObJU~.m.}..........zji...@..;..%)B.v3..'.....MC...l.........v`........?..=...u..x.+.......#$.$.I

C:\ElitechLogWin\Images\Icons\is-VTM1T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	815
Entropy (8bit):	7.594371274102484
Encrypted:	false
SSDEEP:	24:spHpX79jp5XULqAOfvO64ezqNJ9iFuJrX:cZltXXbIIe
MD5:	85F959F5031BBEF05AFBF392AB4D31C4
SHA1:	E1D7AB4078968C731DD27DC72D6E1027DA1C876B
SHA-256:	E1DA12FAA403429D1079B4EF6B7F8B8966C9343C6EE9FE0836276D3C8ECD7EB6
SHA-512:	E43FF5EAC1016BEFB4399FAE3B1711121171101CC5FD2BAF0419E22F56FFEC96AA095D92EBE7E475C00CF5C88971717B2CAC763C5BD27EE18103C2B86F2C2436
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.W.q.P....[..0.D\.+.T`...h8.W`....c..J.&..Bf....X...eYz.J..a...~..o.v\|...V...e...#D..p...#.G"..7_....c.......\.p+.Kwl.E e..k.m".A..3B..g.,....9\.....Dp.JG..'.C.!.l..C.}..g..=..Y@2...y.=..."+.=t.~.7....{.....nC.)y.......,r.Pw..2.x.@......9\|...I].....':....q.@....^..N.R8M..b.\|...+.....\|t.R."...Yw.v\....+.A....0......^...xw<...'..........A,.Q..H...-}.s.c...<.7.9..S].mt..E........'.).:..eA....t2......N#..9.&.J.`.hu2.y....%..........,... ..y.4N..y...M.S"<.B.&#......i.K......6._3..E..: ej m..D....Q.j...,..a[...y.....z.......(...X.s Fp....h..&5.6...3..S&$..E......f.!.%....s..D>....vzR..94...Y......g..>..T<...".qE...F......t..........s...-.{..&}.".3_.e.."...".... .W.2.....$..h...V3&..=X......B.Y....9..* .?...D....IEND.B`.

C:\ElitechLogWin\Images\Icons\jpg1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.303378946908962
Encrypted:	false
SSDEEP:	12:6v/7ipayhibeQ6ktOeVpm4VydvdUQFbOA2eFd4wsc:3Di/6ktVVcJh5bO/u
MD5:	F71B0E10E3F03F959BDF5F3D3B7B064D
SHA1:	14027F7059097E0D2842E2CE3141DA6641D2FAE4
SHA-256:	E7557769B502484465094154DB6BCF96DF7BA43AACD407B19BCA2401CCCFD96B
SHA-512:	BF629B3C440940C53A9553CCD94E093ADDA9B8F78A0AD7F21CCF245B82F9523C4D646FACABE40A8D874F00634962F33B3E99DA7E137E083DF28DE40619641833
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG..1.A...E@......2 ."@......!......].Skvg.nowk.\Wm...t...ofg...4.-3t(i[.."N....H:[......bh.E.c.h.1..,.1.4...@S....@i.....f`...T...R{.......~.W.5y....$.J..m'5n?.1.gIW...^..O.K...5.....h..oI..lK.u$wb~).{.tT...@U7'...O.>H....`..>........}B7.0.....8.gTF....0.....(.u6X.Us.. )nN=.[3U...O.55.,F.7.:'B.X......0 .. .qC..V.V9...v.'.../...U..-...k.X..[..J.xm;=938?03....V.X...b..@o.....S-.?..v81{.....:^Q......vAo.r.&.9.......\|.\|.......IEND.B`.

C:\ElitechLogWin\Images\Icons\jpg2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	7.40901387361443
Encrypted:	false
SSDEEP:	12:6v/7i1zLf6LUk+djtXsCZiVsKKC9dJ/lUuOLrOVryVgM:zzLiQk+djtXsCZ/arUuaWrm/
MD5:	2E7987285940F71F849B21B44CD09204
SHA1:	AE0CEF89B6E2E937C61346C3C7D745CD83ECBAB3
SHA-256:	DB4674E8CD42D8D5241CAD5B27497B501F2EEB67A8BA08D1663B08EE075BA3A7
SHA-512:	A371096575B0F4345AE044CE425D9036E2893B1E50914E49168362D59EEB1AA572F38E3DEDB4BFE675789387F4E4AB80B93AEB032CF81BBE62B57651859F11B5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.AV.0..g.[..p...z...z..`.X.+^..<.x.8...O 7.5.v\|..j,.JA.tE........=....~....$..w.pG.O.p...]...J!v.P....B.}.l..'@.D..D..gQ;V.P..>........2.W=....:...m..m..7.3GA..$.#.\|..;...f..\|fn..}"..1.....p...f@.v..gc...ct8..33....(.....^.%.13.)........@;..+..n..J)5.Z....6x.m...Qg0.4k..k....@..oc.5.<x.. y..H.1."...Ak=..`"%...k..`.J..T..Em.I......,..s6NO...8I.SD......Z'..C..D...^.D..8.oz.....\k.D.8.[Y#7.)kR..T+G.3"....\|.:E[.6.}l...q....X)..m(~D+...T...........g.....!}g.)"...V....t..H........s....wl....n......IEND.B`.

C:\ElitechLogWin\Images\Icons\lang-en.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2608
Entropy (8bit):	7.716978679981293
Encrypted:	false
SSDEEP:	48:h/6Wl9dFWdV5alzzKfSGYwuiv2UwvjbZi0Rs9E2UxZ0Kyf4piHpcEBQ4sZLngBRb:hSWl9idXGKowuiv25Xxr2XR4piHbNkna
MD5:	130D595BAFCFF2C1A7BB72D8391A202F
SHA1:	71E702D3B04FF567375C5FC1EBEE8888C92B46F7
SHA-256:	43CE185FD2F29BA7338235A763B0D844D61933D01CF5B72C30DC449396993C86
SHA-512:	238CA601DEF2764B90EBA382242A4916AB9BA5F0BDC1A0140D6EEF32474DE7BF9B945135D97A60535A6F528B080A3D4D1A7797DC394FD5BA8D4A41B75BC8F8D8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z%..............u0...`..:....o._.F....bKGD..............pHYs.................tIME........U......IDATX..kpU......s.%.I...bHBx.....^..<m1.X-jlmE.J.R.3.[m.K..:HQ.Q@...%<l.Oi...I....$.....&..s.9.....i....5...........o..d........zu=..M...g..P..$f..a.+....t.S.....w>...w...&7.e.hA..y.Z<P<..r......e.s.....r...Q.k....nw;...q...X].....I.o....$.v..m...@....Ys...KO..R.U.).3n.CBN6..(-............ .e2\|x..i...<..^@.$...b..L.:MT.qUr...Xn..N...9l(..Q4....)]......V.Oe..<rr\.........B.(..MU..ph...H.C.........F.]...=d 3...:s...#.o.//.3....[.>w..tm.B..8C........gaYa\|..~...o`.a..;......A.@...0.....BX.f......H:...H..N...r.X.[.T..?A ...3.(.k..l.fS3)3.r..1$%.k......v..@Jd0..`...G.......Z...3{b6.....N.(.C.[1.1.?>EYY-...G.mA..n>.q..q.....8..o$..%L..Gjj<[.Tq..9.P...`.;.. .: 1Ba.. #..3w. 2OVby:./....Et...x....4^o...h.i....F......(.{&. ...5$.?.....0`..}L.....v.?....)..a....L".....G..Jq...L...6Vr.....eIL.B.1b..A3.....C._!g.x.

C:\ElitechLogWin\Images\Icons\lang-zh.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	685
Entropy (8bit):	7.581384275172213
Encrypted:	false
SSDEEP:	12:6v/7iU7Ig2jHh9jFObb41o9gkQW2Dr3mq8A7uTu5h6LrZ4xQlyRCWSMg4z3j1:CIgELoXC9W2eq8A7cu5Crl8RCWSMf3j1
MD5:	E8ED5766C8B27DFF5F4417F9F5109D10
SHA1:	7ED5E02EDF0801D7696A52FED1AE3B0358FCB959
SHA-256:	78276588DAF68A1DDE15A05A0FB4E147DFA44E7F58786238773652F00EB88EDD
SHA-512:	E5EDA9C65FD7789138FC123ABA56D592F5F15B24B5C752CA3071C87C0A2A91AEA5D2B952B706F34F5703F30D156B7F28595D658E90F5A8D5BD0968CAD49CF172
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....tIDATx^..=.$E...zzv..}.C013R0.Nc...DL....\|....b,F"..'0P1...Pg.v.wf... ......=.t....S.t..7.q..$L0..n....<\|..y.4.I..9..q.Z..K...\|...$.o.M{7.^/.oZ.k...3...E)....TD....O..{(....g\|...^..9>._.....J..}....2..4......[...........d..s........ ..Df.mUO..J.d...0..Y.n.;s..A....v....@..k..D-y.P.z.p.Eor...V....g..Aj.{..5......P..v..\.X{......Xf.p....u_..\|.....@.......D..OH..4...&..CA !...9...T...."gu...5...,.{.:\|o..G.TD.{ ..\n.r&....n!..&._x. D.....3.l.A.:...'..\.....p...Z......cc.U)j.w ..5....:..9\.TC.....V;.!.~..9.F....\..3mK..HI...P+......@.EJ....Z.......Z...4..v...-J.NNO.R.%.E...v....0.!fvk...........w...;.....IEND.B`.

C:\ElitechLogWin\Images\Icons\line-chart-x28.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.707217714654351
Encrypted:	false
SSDEEP:	12:6v/7XcQacDtiHNl08bNYn5Di583iwV7xp5ItO0PwRb871vtjQHVQ+vObe7:gcQalgKNYnZi58rV7x4tO0P7gHVrvu8
MD5:	BD5B204ABB9043A6ADE35242FDCAA4E1
SHA1:	51C18D3BACD99E1C8C249F8856F22988DB25BEB5
SHA-256:	FC5A4418922F3288B67DE8346CB3FFF5972CF28228DA0AC0244F40245C6A744B
SHA-512:	D29DDF531D4D57581AED553F292511C4708AA4AA8B15EB34B071733CDBE50A45540E79A266E0F1ACBCCE63B38D11ACF3F95D763339A2D3A8EC9E00A5EFC7B45C
Malicious:	false
Preview:	.PNG........IHDR.............r......IDATHK..]HSa.....<.t.x..kf%...K,..h. ....PI..]DEXA.Q.yQ..Y..-.C(Q..tADB..Lv...m..M=.s.f.S..:....y..}I.z.Q......i....$G....\.i.}~.Y.......x.6U.3..O.b...D.wgqA.y..f.[&.}.o^...".C.>.G...@..S.v!SU.!.Gg..&..,...m..x..s%.3......(\(..H.J.D".L.8...<.(b...Z..Gq..M:..S...Q"Q...d:.cy\....-~U,.I.......;...d1y..VmCS.....`..q.v9...".7..X4.._y.0"b...m(.......P0.Y.,Jo....$6e..E....q+.z...%!...+._.(.l.:...%.av..U.F\|.pC}a\|.\|..(........g..D..b...\..`..F9.w.q}..yB] ...../.#z.F..r.0.Zfl4...J......W..m...HQ.`.QP.ub.j.RR7p.........b.owP....\5.W.6h...T*]0...&..HGs!.%....`..~....vd.5.....Zn..@.[.e2.0........1:&.c...>LZ.`E.....[..".6m:..7.o...!$.e......%a!".../l.....eZ../.[!.R....]........~...s5V....B?4~..\.i....2....?.HM...b....IEND.B`.

C:\ElitechLogWin\Images\Icons\line-chart.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.687854038756322
Encrypted:	false
SSDEEP:	12:6v/7iZaKyWvnfK3RZDb7eWGzgSoORqBCkj3ygRUgEZxYmonSCGVUPOSEajwN0+wy:XrriZDb7bGSOMEk9egKYH83O8N0E5BgI
MD5:	76ADD155A9F2C3A7BBAECD230EDA5F16
SHA1:	358D48EDF5FB11F55162D4470DE40E9C56F43D6E
SHA-256:	DD75ACEEF58323EB6CA631312D8961A2CB43686AEE1E7E5641D2DF36CE59AA85
SHA-512:	876DD8C9226DF08556B56FF8D3EB79CF9C2DA8BB3C26BC1A576763E862AA56D4A7E2B05E4284155855500F09874F9A3D3E6523D401B53DE9CCBFF98B65CA3FB9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.]HSa.....mz.Tjf..Vh..R)u...5.j9..`.HDQ!..MP .. .!..0oJ...5".../.....3k...yN..6.in......=...?...vv.6G.V...BH.4.(...8Iv..i....&..j.a.3PI..N_...W..7....,....6t=.......l^"B...p..^;.:........."t.c.j.6 .....5d...T......f...E........m.d E..p....^.....xs...FDX.#....1.gQ...P]C.......<L&..z}T....}~.A..&.fl....k..w...O:. .0...... .&.v`6..U$Un[.@...U..l..E...c._ta..... ...\|6..P..g~..Z=ti9bp..{.....OS.B4...$b..!Ymu?..n.T..0.F0cW........3..x.p5.a.B....Qu...~e...:.m..c.+...(%..X...........<.c.q,f.....kW5.p./<....N...ihl....+B..]%.0t.<.O.......e...#.].<2Br..E..[\|...U.G..~XB....<.m.......R,....cHgk..~4f.......";'wNp!.d.J....L.H@V..Q..'.../.o.XE'.............[..I..._...r..I.4h-B..8...\y...=.....IEND.B`.

C:\ElitechLogWin\Images\Icons\login-eye@22.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.194151772074488
Encrypted:	false
SSDEEP:	6:6v/lhPYo5cuPD+KxHknKBLlMWHLzTXBm3y+V86ex7ZEVbUd3VSNQp:6v/7t5c4qrKBLltTB7q86ex7ZqUSM
MD5:	224AE765515023AC953DB9D02F67D49B
SHA1:	8E1C57C1CF0B58851E4905BE45951081AD386AB5
SHA-256:	31C1646DDCE44DB519B990CFADEEE771B140B7B15647E98954DE43F4F33D7D1E
SHA-512:	DD1831DDA01381D69B330694CA46C78571E83FB8C14AC39A198F8A20D2464132A832AEB7380F5BF1B4DCA9F9768430131D48777633D71A4A5FECC37E95B64D1F
Malicious:	false
Preview:	.PNG........IHDR..............l;...'IDATHK....@....%...H.t@.:@.t :............:L...3o.....e....!n...:[..2.RO....R).>..'.D...ykcd.P.q)m..)....t....6.xh..1A>y..3..t+H.]ar.l....\|.`.{.E\|.....,.(@.l....s...6V`6".c..b(...z.B..n.qc`.R.g..?..P..q....a.9z{x...YZH.....x.f.w......<...`...E=..X.s.=.7.4.zM..\.^.N...F....U..k....F....e....IEND.B`.

C:\ElitechLogWin\Images\Icons\login-password@24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.439757121295215
Encrypted:	false
SSDEEP:	12:6v/7aO162gVYM1+lx6npIZngKO9lPzG0z2XuVDRR:qvgV5Y6npOngVvzLzAI
MD5:	D1D318D8ACEEF77B86CB73C62C6F0BD0
SHA1:	5420CC810049F4E6FC65532DD333D7ADAC3CF43D
SHA-256:	406FB75614BB712182154FEB4667B2E4C30EE39F506A6C146068B38BE3564ACC
SHA-512:	8F60BD9FAC3A85963292DA0834774E476C2D42AE042B77580B5086356E3EF2F8AE4C9F69BF11CBC940C4F56C62866AABD0C659FDCB0F6EB6D4DD7EB86770D7E7
Malicious:	false
Preview:	.PNG........IHDR..............w=.....IDATHK.AR.@.E.S.K.....[..x...l..........n.'.O@............ .q..J........Y..,o.A@....p..#.(0N.V..R.j.t....Q.....Y.D@49..q`?@..I........2q.........,....dA...X.;..M..l.......l.a._.v...(.N<..U.-b.Y....5.>,.M. ...@.g...u..=V....n9?...,m...8RkW..D.;e.nZ..Z.-...J.rp^:..,......8...P......3.cSn..LV..b......>..61x....nD...o..DM.e.....}.. .A@t...I_W.T.....U&/..l......;.<..i.G.LW.t.v)}......z.y..W@8=.<"tB.!9..\|....I.@...f.`T..?.+.I..K....../(wP.j....IEND.B`.

C:\ElitechLogWin\Images\Icons\login-password@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	594
Entropy (8bit):	7.518731384433625
Encrypted:	false
SSDEEP:	12:6v/7iJenx/r7xkm4ZtwbCtvg1xHH01o/y3fOOV0TSKHnVmU7PSNbXOb8jOx/7:+Vem6twbCRSHhCfOOV1cnV9PFDx/7
MD5:	DEB34329BAD868A843BBB58789A70DBC
SHA1:	C85854917F8E6E090428CB786F18899FCFF0C25E
SHA-256:	01F68853D5D1D106EEC2F6A4A9F77A9D6037C4A77524984AFF59181CD6072100
SHA-512:	DCCC977176498E18AF8FB37560FF064AB996524AA3AE5AD873CE54412E500476C19BCDECC79A918E50B0D0C6ACDA39E51B4256EEE03A9C9D56D90CC564D81541
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.WMV.@.Nx"KGN .Y.z.......B9.x...\.7....tm}.z.R..6f.B..........K2..AX./..q.@U..E.-.N@...@D=x...Rhj.M.E....5c.izD.2.z.;&....[O. ......u..\|.......Z..:6.......n..A./..-...D....X6.....@(.....G.16B7.].....w..h..e9..J.;..0k..X\|..'Y2]...6.^/Ni...I.o....h.;....UI.R.(.=.......%..Tw.`.....q.U.t.7....`..VZ.bi..wI.I.F.W.......rr...cN..(... .gu`..d.L.$.1........E.X....../.g.L.Yz\...i.K.o.`......{...X#....]n...v.. ":._..W%...............MW.\a....,.....D..\|=....8r.>8.y...4....F..X.`....h.G......._.... ..Tu....n<...'l.f0).......IEND.B`.

C:\ElitechLogWin\Images\Icons\login-user@24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	518
Entropy (8bit):	7.393790436359761
Encrypted:	false
SSDEEP:	12:6v/7p4MeYXrSlzuLjiyX8ogbbGkynsG5GIE:lMh7Czm7X+bL2E
MD5:	AB326C004A44F7E768D54C8171B92FE9
SHA1:	3A893F875BE3F778C6F1709D1A848E783A044707
SHA-256:	8759BFE59C9535BDD1B4DE2AC3EFCACB3EE9247C4FAECCBECAE0F15317ADD54A
SHA-512:	351DC6E1A1B659AF749BA2936AE52CB77DC4BF9D8BDFD2F7047C7F7EAB6BC3BCA485ED0FD2B89FACF86B97C6F57F11E1EC50D66594007B973B3C05091485947E
Malicious:	false
Preview:	.PNG........IHDR..............w=.....IDATHK..MN.@...k..t..BB.'PN.....p....e).@o G.[J.^....Xhk;.Pg......9E....kv..{f.Q=W....J...vS..`...^....e{. .Y...9k.qq4.b.}@.o....+....H=([...N...\w....._.$.sQ......`.1ru.!.$8...;.h[.YK....F.z.y...z...Q..P....>S..qe....0.. ,OB....P...U$.K1.....[_".C._p.MWmc....@........9..b.^i....=...L.....$.<kZ..J....E..".h?....Uhz\|..b..j./T....k..`..?. 4..1......j.aE.z...(MNUtl..<(.ZU. 3D.ra._2.DU(...'m.j4].}....L....p.}...(..$..m.w.w...Q@^..@.$.1..#...ig......IEND.B`.

C:\ElitechLogWin\Images\Icons\login-user@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.590889183860746
Encrypted:	false
SSDEEP:	12:6v/7iRuHLA8VRRhQS8VziIuRllX1DXof7UvEMqdLboo8wA4TUkAhzxd2k67:/GA8VZQNVWvh10ffMqdpVAhPO
MD5:	3D68C719F9EA87EBAEF486BF379C59FA
SHA1:	A7F2A4545CC339C8B9D095D9F743ADCFE4AD896A
SHA-256:	B391C94C6E8B5AF925D314C24A9B49DC561402DB6678C4F8F537B1982D86751D
SHA-512:	F37A19C158145F0FE21B436B100A4EE72317299432DF8FDE0BE8CDAAEE98C23A08EBEC6B755464AB2E1794AAEBAAB602BA224B082C7BACA3261DD86C6BD93E37
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....YIDATXG.MR.P..SQ....U.v.....O ..6p...8..r...7PO`...d. ........./.....U._......?.p}....g..~.....@..].o.....FO...:..na...z..F.HJ!....z.......[m)...>....]23...z........;...I..G!.Gg.[S..`g.^.q=7%........S.....xhJ...6..6..b.....6..S.l.[.?....S.h.<?.p....e...Q.ye....$u..p..fJ.......V.%M..@._...P..Q[.E......].G.`..i.......]}....p)..1"..C.}YaJK.G...w?~O.9.vX.\|X...._.8...).H....L...x..:p.......6....@\|J..Eq\|... ...C.........+..u..W....j...\7i..x...V;...H...xa..._-.z.....k....$..]...@%.%X...._k....l...<.z..4n...v....m.U.D.^..k..>t@?....*DR......b..I+.C. $.......4.JY.gE...:kI......#.0........IEND.B`.

C:\ElitechLogWin\Images\Icons\logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 157 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8275
Entropy (8bit):	7.937075402202231
Encrypted:	false
SSDEEP:	192:ZSHIIHUCD4waAxjwEFpn6P8I+IBMLANJBqYRW1x62D:A50wBxj7iyAv0qWf62D
MD5:	AD3FA9D19D9B5E2BEECB11D9D2743FD5
SHA1:	6EFEC2B9865E096461411BB9BD26482C6B2CE2F8
SHA-256:	527B4F272E926BF803DACC7F6F379BC355665444D513AA4300E3CB3C67EF43B0
SHA-512:	F22D557EA01798B32ECA6FF36E1EE5F9CC9976FFD791BB0E7ACF75DF4640435088A2BA5FE92EFCF2F7CFC02036E8B4AC67772597ABCBB5CB71DA136360EB5796
Malicious:	false
Preview:	.PNG........IHDR.......F.......:....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\ElitechLogWin\Images\Icons\sensor1.jpg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPCM), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop CS3 Windows, datetime=2019:02:14 13:19:29], progressive, precision 8, 500x300, components 3
Category:	dropped
Size (bytes):	36368
Entropy (8bit):	7.540958381336001
Encrypted:	false
SSDEEP:	384:hP+p7eXE+p7eynWr1H7d7WdYNg7YEoQTUxtJ8BZ5EJeXNhU8XnA+a8p93jYc5YO0:hFWZbhIYyfTyX8BEeX/FpdjlYbFF5
MD5:	0AD6A78915B347D37BECD7564807CBC1
SHA1:	AC3313C4DFE5924EC79780E1C9F1B591217D2743
SHA-256:	6796C0CF798AC2BEFE76ED9FEDEDABB167BDB3557F4D03EE91349D2F329E4B0C
SHA-512:	3A5E8AB7C5959FD878EB5DD7718DB4C57BE913B7656E674AD38923AB521F7111766C016D05AABB7D5A1E9552091C53EF7BD13690ADDE252D2F971B16BD50BD3A
Malicious:	false
Preview:	......JFIF.....`.`......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2019:02:14 13:19:29........................................,...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................`...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....I%)E....;...........................L5..;W4{......n9.i$.....r/<0..0;...".$..R.wN\|s. .....nII..k...+`?..w.$T.....IJI$

C:\ElitechLogWin\Images\Icons\sensor2.jpg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPCM), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop CS3 Windows, datetime=2019:02:18 13:14:43], progressive, precision 8, 500x300, components 3
Category:	dropped
Size (bytes):	36494
Entropy (8bit):	7.548364802140436
Encrypted:	false
SSDEEP:	384:Pr+eKa+emnWv1H7dcdYNg7YmNgqFH8fiiEQ9GobGFSbk1w0Hqweok1WNkivG5Qzd:PrRCWNbAYybRt/iEFJ1bHquNkxIcM7
MD5:	00E8DA51E7A81DFCEF29752BB2DE1E88
SHA1:	605A3FC7476D64C38C37D8673A5947FADA12D77C
SHA-256:	A2E9EB72E329E328EAE947CABAA9E0B4C8AA9777DEA239478C4605388AF81EBC
SHA-512:	C6D5E356D7526210E8715E79A5974DB5AFACE4705D7A27F65E24272DDA545FF6D1A337EC0A339231B176CB68B493FAEB861AFE9FB366DF8FB4163925BBA66AC6
Malicious:	false
Preview:	......JFIF.....`.`......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2019:02:18 13:14:43........................................,...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................`...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....I%)$.,$..u..G ....Y..ObJU~.m.}..........zji...@..;..%)B.v3..'.....MC...l.........v`........?..=...u..x.+.......#$.$.I

C:\ElitechLogWin\Images\Icons\txt.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4058
Entropy (8bit):	6.818352708030445
Encrypted:	false
SSDEEP:	96:DSsYkknmWq2Y2u7y/uuYrNNfsTGrcyHnp8ZyHgkUH7giUH5orzr8os7wxFTW+YWA:DSdkknTrYZlIyHXAQyflsXpWtJcFz
MD5:	E6FE53A151086344C9E25755B0F77B99
SHA1:	6A9452ACD33EF9694CC3BFD1A72D2155C0F44818
SHA-256:	86AF808468D9F63CD1582B9002BB749B8A95620A7EDB91AEEEB186E402A61B7F
SHA-512:	6F2ED2B44A7BA85CF718603A4BB337798AD0D2C96E04F12C5A05220C892EFB4FDA3F7BD7DBFB3C65A3F79DDC0E8116F2EFCB838FF56059DE74D307F72304556A
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....pHYs................viTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-06-13T09:47:48+08:00" xmp:ModifyDate="2019-06-13T15:32:14+08:00" xmp:MetadataDate="2019-06-13T15:32:14+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:18debc0a-8586-0e49-9cc0-03ff51f17d1d" xmpMM:Document

C:\ElitechLogWin\Images\Icons\user-add@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.667306984860578
Encrypted:	false
SSDEEP:	24:msWl45B3EXSOkzkcS+Vl/T7IfvV8uf8v6jlV:3Wl45aXEgcT/f2f8v6j
MD5:	1A7848FA224BB6C426DAD9B55E090791
SHA1:	C7BE71918A8089C14C12E6F32FF77F0D9ACE556A
SHA-256:	A8D3BF1E879A3B32136001DC61713716AAAD0F50545E1C78EA6244FB3E1D2BE9
SHA-512:	8C2712A9360BA56F5B2BF8732F2A0B948C0E15FE490F8951DA5BB9C7BCC14E3C612FEAA19A9472FCA4BDFE90803B09B6777746ED7739D08E50A53CC435894BAB
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATXG.Kr.@..........TEl.'0>..A.......p..e....LN...... ......$.,...X.......p....>...Q.......&.!......V.;..-......i...#...Q........._...`J.L..H(......t..y.........%@.;...;.K..~..N..1@.;.{.........R_...[\.ss....x.W...!..Q..nH.@.3~.)q........p.;.)...}.e.t....b5@..&.<.~..N..q..u......]azR.y.v.q.........5#...w..S..Q..:.>..m.;../,HM.....XK.....m%...$u.{.Y......B.&Zf...@.m....uGC."..k..U...Z..4...p...v..r.]U.dZF'].7...t...#.2..@..`5\@.....>@.QMQ.@.....\|pH..F..].^d...IZ..\|...+........\...Pv..+.dwpa...l.:....W......!..G.`.D..@p.D...Q........T..6...)..)@.x<..\+..@...........=o..*`.......Y........h..f..\........?M.....,...A.9.I..n....l..U.p.~'....!..X%..&x...7.3.tb.{..brrF...,.y........J..........0[0.0......IEND.B`.

C:\ElitechLogWin\Images\Icons\user-edit@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.534493054653098
Encrypted:	false
SSDEEP:	12:6v/7ici61TwPouw2zH41dfHYNhOJlesZnWbVTPaiqHaEFVf:MyzzGKhOGsZWbVTii5ED
MD5:	1791307ACEC64D7D3FBEEDBBDCD15642
SHA1:	1A2E23DCD199E45EC39C77D72FA57D6C8BDF6DAD
SHA-256:	9998515B0F4C3F45AFCECD863C7E37E005F85745431F91D4E6CD895A97AD897E
SHA-512:	B0CEE49040B3C843D1BBA4EC46D9B4C9AADA0267F28DD4F884858FDFBAA071430C05EFB0CC0D085B8ED87F25599432A143837EF895D7D1CA27795DA3DB395280
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....4IDATXG.KN.A....u...0.......'..2........%x...x.q......XVM2..abwO.;.Q...WOW#l.......nZE.kn.......-..uz~...%&..ne....x..)..`o....."..-w.9...q.J..Nb.9@...".)w>.xC..X...M..x..N.A...9...4...e!....8p+.U.5.b;.a.f.2w.v..@.m....\|5...w...\|\|o.k6..{..R ..$1.e.l.......{.^^\f...G...r+..S.Lr.F...D\.$..8...L.E0....r..F9`.....5.......s@.I_.s.<.8.......1...Au..(z...dm..~U!t........_.!!6.sk,.\|.J.>.i....8...{....z..N.a.dR7h....D.w...+....C.k[.@....PVn....p..D[Q.t.N4..&..wN*...(M..K.9.\|.F..D...4..4..G.@..>U....a._KM...>..;.K.;.&....._N\|.:.Uq.b:.6.:...^.0..M....IEND.B`.

C:\ElitechLogWin\Images\Skin\gbx-headline@32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.705333828526007
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrMx9iWFazjAmFeFBx2uGKr5w6Bxpz35XeZMXjp:6v/lhPKEiTz1aHjGI1Bxbjp
MD5:	EE7BA578CFA8D667BD2BAE4B4D778BF8
SHA1:	CA598C458F2C1D1B5A52F3361DA94574A3B7FA0F
SHA-256:	6D6313CCBC9B1178C014D24AA3B94309DB4CD29F239CD776F8DB9A678DDE074C
SHA-512:	F49A140B683FDDB2A1559A25C7BA05DA8F2B9421301B727BCBE9B48118C14CD3FFECB9DE46B1A3EF19812C850D121B71F2908E1482B204A7BD30F169866E513B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....UIDATXGcd.`.8..3.:`4.FC`4.FC`4..! .Ty...Q..........k...5x.@..c.c4....h....h....h..x...oy.!\|......IEND.B`.

C:\ElitechLogWin\Images\Skin\is-G6CLN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 800 x 800, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	255036
Entropy (8bit):	7.997126169053659
Encrypted:	true
SSDEEP:	6144:xIbF7lV6vTCNIlZE2rtI2ax1RtkSKzd4whhzlSqcsRbA:xIhpV6QIlZlrtI2a3RtMR4wLEqru
MD5:	DE0A55ECF726C25613842B28FA82A051
SHA1:	CC56B64BCDBB05C630D8E24359B93B43B688775D
SHA-256:	93143206134DAF3CD3FAB2AC8A9F8F28EA5FCA5D88B457B1957026060F325CC1
SHA-512:	267063AA480585A019B3CB3779713CB6E84692F50ABC701E5F24D023FED3FFA16286C8EA2EB71030198C73C6D9D42B3DC7C82B8C57E1B89F060929E8DE686A11
Malicious:	false
Preview:	.PNG........IHDR... ... .....T..?....gAMA......a....6iCCPEmbedded Profile..H...wTS....7.P.....khR.H..H..1..J..."6DTpDQ...2(...C.."...Q....D.qp...Id...y.....~k....g.}.......LX....X......g`......l..p..B..F...\|.l....... ...?.......Y"1.P......\...8=W.%.O..4M.0J."Y.2V.s.,[\|..e.9.2.<..s..e...'.9....`......2.&c.tI.@.o..\|N6.(....sSdl-c.(2.-.y..H._../X........Z..$...&\S........M...0.7.#.1..Y..r.f..Y.ym..";.8980m-m.(..]....v.^....D....W~.....e....mi..]..P....`/....u.}q..\|^R..,g+...\K..k)/......C_\|.R....ax.8.t1C^7nfz.D....p.......u....$../.ED.L L..[.....B.@...............X..!.@~..(*. .{d+..}..G.........}W.L...$..cGD2..Q...Z.4 .E@..@...............A(..q`1.....D .........`'..u..4.6p.t.c.48....`...R0...)...@......R.t C....X.....C.P...%CBH..@.R.....f.[.(t....C..Qh...z.#0...Z..l..`O8.......28......p.\|..O...X.?......:..0...FB.x$..!.....i@......H...[..EE1PL........V.6..Q.P..>.U.(j...MFk......t,:....FW........8.....c.1...L.&........9...a..X.:.....r.bl1..{.{.{.;.}.#.tp.8_

C:\ElitechLogWin\Images\Skin\is-VPIIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.705333828526007
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrMx9iWFazjAmFeFBx2uGKr5w6Bxpz35XeZMXjp:6v/lhPKEiTz1aHjGI1Bxbjp
MD5:	EE7BA578CFA8D667BD2BAE4B4D778BF8
SHA1:	CA598C458F2C1D1B5A52F3361DA94574A3B7FA0F
SHA-256:	6D6313CCBC9B1178C014D24AA3B94309DB4CD29F239CD776F8DB9A678DDE074C
SHA-512:	F49A140B683FDDB2A1559A25C7BA05DA8F2B9421301B727BCBE9B48118C14CD3FFECB9DE46B1A3EF19812C850D121B71F2908E1482B204A7BD30F169866E513B
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....UIDATXGcd.`.8..3.:`4.FC`4.FC`4..! .Ty...Q..........k...5x.@..c.c4....h....h....h..x...oy.!\|......IEND.B`.

C:\ElitechLogWin\Images\Skin\login-top-banner.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 800 x 800, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	255036
Entropy (8bit):	7.997126169053659
Encrypted:	true
SSDEEP:	6144:xIbF7lV6vTCNIlZE2rtI2ax1RtkSKzd4whhzlSqcsRbA:xIhpV6QIlZlrtI2a3RtMR4wLEqru
MD5:	DE0A55ECF726C25613842B28FA82A051
SHA1:	CC56B64BCDBB05C630D8E24359B93B43B688775D
SHA-256:	93143206134DAF3CD3FAB2AC8A9F8F28EA5FCA5D88B457B1957026060F325CC1
SHA-512:	267063AA480585A019B3CB3779713CB6E84692F50ABC701E5F24D023FED3FFA16286C8EA2EB71030198C73C6D9D42B3DC7C82B8C57E1B89F060929E8DE686A11
Malicious:	false
Preview:	.PNG........IHDR... ... .....T..?....gAMA......a....6iCCPEmbedded Profile..H...wTS....7.P.....khR.H..H..1..J..."6DTpDQ...2(...C.."...Q....D.qp...Id...y.....~k....g.}.......LX....X......g`......l..p..B..F...\|.l....... ...?.......Y"1.P......\...8=W.%.O..4M.0J."Y.2V.s.,[\|..e.9.2.<..s..e...'.9....`......2.&c.tI.@.o..\|N6.(....sSdl-c.(2.-.y..H._../X........Z..$...&\S........M...0.7.#.1..Y..r.f..Y.ym..";.8980m-m.(..]....v.^....D....W~.....e....mi..]..P....`/....u.}q..\|^R..,g+...\K..k)/......C_\|.R....ax.8.t1C^7nfz.D....p.......u....$../.ED.L L..[.....B.@...............X..!.@~..(*. .{d+..}..G.........}W.L...$..cGD2..Q...Z.4 .E@..@...............A(..q`1.....D .........`'..u..4.6p.t.c.48....`...R0...)...@......R.t C....X.....C.P...%CBH..@.R.....f.[.(t....C..Qh...z.#0...Z..l..`O8.......28......p.\|..O...X.?......:..0...FB.x$..!.....i@......H...[..EE1PL........V.6..Q.P..>.U.(j...MFk......t,:....FW........8.....c.1...L.&........9...a..X.:.....r.bl1..{.{.{.;.}.#.tp.8_

C:\ElitechLogWin\Images\import-icons\00001[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4595
Entropy (8bit):	7.947328387010405
Encrypted:	false
SSDEEP:	96:rqfunlYnR0PQjt4mAHJuFbu0ba8iJoo6mWnN376OZH:GfwlQR0Pkt4xHcFbp2io6mWNL6OZH
MD5:	EEFEFE6FC708EA70E1A8F8A17236370C
SHA1:	6C69E782BD7F850A532A001114B2603F6A32B764
SHA-256:	F3CF7FCD9A8CB2B6EF9DE61DDBAD98F21D27DBEB2D3B0A0BEEB91631D4CC28CE
SHA-512:	63CE3497C5011B46272E75BB2B9E720E583BAB077E700E4B051949DB5DD322DB47FF0CE3BB0CA2919FB4FB7D60C30D55BB897EC1A21100C5CD0480A471618413
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.YyX.i..L.4!C"cK.B....d$..%.Z.$QIBKQ...d-m..VQTRR...o..z..9...`....y...}...y...._............E.uY.waISZ~~......./.7d.6.K......;!.qUlr.....QV.&_.ioaiSa.f..5.yA#..5".E..g7 .i=.2...Q..z.N.{w.Q.k.5...o..M.IQQcY..&.j..Fd0..&..Y#RrZ.......7..Z.H.EXr-.%.!(:.50....jy.#.;......58.U#r^6"+..iL:.Ig..9%@Z!....f...z.{...@d6.\|#.....~.....[.w.v.....Y.Q.VJyR..EA.2r....!X.<...V..-..M=1u.N.......a...F..y.\a\|<....r.p>...1.8.].....}W..^..@Nn..[Q...r[..I.......w;...w.... ."..l..T.f..a[..A..`[ ...L:p<....>.....I=......]..X...]..+.....Hy...Qs.iP'u&....Q...6a.,K,Xv..+.1]...G..k..<g9.6$.-....G.......0T.>h.....M..EW[.1.y3..6!..I...t.....c2. 1...-......m<..CMM5.f.O...]E.n.K...?z....uA...op.........h.k..........kf#....1.....>!"....T@y.k<.....rF.a-o.......5U.........-.MB!.#5..6....K...J.......l..._.i...=V4.OB.....-v.9Y.P...O.....h'..L.0..HL...~..W.....Caa!JJJ...{..Q

C:\ElitechLogWin\Images\import-icons\00003[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.933244475879462
Encrypted:	false
SSDEEP:	96:R6zCEAXHygkDBwuzz6e8T66Xj1pEErHTCqnS6GjU9BuEdfDC:R62EMcqe6eACB6GedfDC
MD5:	3A0429634B9FFB29F5FEB4C14CA86445
SHA1:	E83C6E2ECBE2C3836479037FB9F1043A9A690373
SHA-256:	8E9E9E03C9D336C950A90934D2826F33F61CC9FB7EC79D8CA3534E7684F43543
SHA-512:	2CF44914F95AC9D1908CB8CC4B8D2E9AA712AD13D56A435DC3DF957D1DA8AFB0E2556597BD9594EC48CBA75E74D2FFFFE364578212469362FAB5C7981DDD3902
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....(IDAThC.wx.U..'.d.......].".*....4.UwY]\TDl(......B.$...@ ...$t.....)I&}.....3d...+...}.....2.....<.9.y........~.a...>.v..=~.q..;5..v........O..y.......w.\...]f.....NE......K...(...Q..T...u...i.......>9.w.<>m....N+....m../...A>.v.....3...zf..&....x<.......r0\_....P8.....p~3.Ns#.8?......b0pA.......... 4.>.>;.~.'..W...,.....r....e..:.i.6FM...3.....;n.......s....Nx.?..m.._.....E.9...#.[Q.?H.C6.....M.K..........F...$......V...^..j.....?.g...7..).g...x>G.....R..C.6=..3..z..3.CNx.u...`.;7...".a..>:........p ....o.1P./..'..}.\.........z..O..............x.iCx...<.fZ../E.....;.....oD..G.uF..8..Svx[.2.00.d8...'....kS....}u.(;^..g.._n..~..,.Q.j..;#.j.......9?.......L.._;.?...pX...r..N.%..... ".%.u.#..A..,E.Q_}.n.w.!....R...z.^..c%...~7......~...+..u9..oF.i..8......\|n8..M.-...Gh"..'....b..3..y'.;1..L......)..i.../....;Sl..y.TVI..y.y......w...#\..\|n..R..Qp........C..

C:\ElitechLogWin\Images\import-icons\00005[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4202
Entropy (8bit):	7.948244172278149
Encrypted:	false
SSDEEP:	96:gZtv4aLPI0Dfhd95tdeCs+hfzp3lXQc7206f0ksTzzgLfT9ZA3Gbm2z:Qt9jTDpd95yr+hfzllv72xJsPsLb9S2J
MD5:	E340020B7A43D82295380FC778644A63
SHA1:	73405ADF1E192C7187E05BAE28CF8944AFFA8B50
SHA-256:	6710735D9881AA7DA3E15B84086D763C708CD6BCBA2C93CF98DD8D5857F1F6DA
SHA-512:	85B8C57C049B42006482E3E1CA71D7F4037FC25CAEC33AB3FE6305F99B5E5CF79DF04BE14477305355ECDB95C83044AD4A4A934E0F6AA744460437FBFC606BCE
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.wTU....}.7...T.&1.J...5...n"..Mb."..F. .......^E..&.:.{/................c.....{.}.x.k^............T:.....T[W.YTU.(....tO.+.L/.V...{[O......I....4v-........=d.?./".K.0.,=.j.`W.<0......SH........lee.....RV..ghZ.rQm.wq..=.$g.`f..=.p..S......E.... .=b...K..........3..`d.......'.........YUW'..]QU...?..CH...F.....a.[.....!..G. .JIL.......69z......9v..Ay...>.m..;F.$...b.[X..=.........Q.&%.......[....3(.E..x.$.?...HL.at.!:...:.....W...k>.a.'..m8-3......+.^..5.Q>..>.kz)m..........p...0....+...~....SJ.......G.'.l..l....W...[.....6.X..6..op.-.....h......:.K!...Db\|..}f.`...Z...."m...3....J....r.$.+. ..9(.c........_......f!..0=..N..........Q.-t.#i..:...DrE~.U.@..H.g..{$.I..EZ...JC.3.HN.....J5..t0....N..l8~....M...V.$:9{..C..Y.C.}..l....3...)......0P.X..c.@.*.0,...Y.P.z...2\.%C....GW.<.Y...)..LO.$.^....s.L...^...G.7Qq..g..Ra{..Z&.,V3.5...7......Y.'.5V.

C:\ElitechLogWin\Images\import-icons\00007[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4231
Entropy (8bit):	7.941445751823313
Encrypted:	false
SSDEEP:	96:rZ+y0iwEEkc02B3Ai98820Rwo+G2BsWI3mV8qVrSYfhJ:r4R6EJAic0WoEBsWqmvNfhJ
MD5:	63CCD3E964A6582EBABB901A6E0367A5
SHA1:	EB232A2A9D101F665BA58E7500A77961058CE673
SHA-256:	7C22C5FB0B5BC3DBB57BD61CCC47DDF301F06D0883FC7A88C216B276C94131A4
SHA-512:	B797245EF2C1598B248F9F1BC8C050880D578FE6F4B736C5A7F6A66E6DE19DBACF29890509ADFFF8D5B211F624C351A036C774F4B1C9DFEEA83E388706FC0BC5
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.YyP.g...8..L..I..Lv'.nj..8.....I....(FAn..Q...0.wCs.4."7(r.GC.@..t.M74.......[....f...\|.....}......g.L..?...6}....kj..jh.kj..oj..k..mh......{...a..Q...V..:.w.._..........a.L&....g...Q.....hRN.p(.wp(../...H.:{z.."...q._...6a.[^..../,<..."f..5....jv.+++...l.....3.~!q..K..A1..d").......i,..0O{../..kV.~......?~....6,....2..b..{.eu....L&w......<fT.....\.'.~fZ.k..p..>...O...q...P....&.....2..7.oD.G.y.h..Y.~.1$cRz....`.../.......<...H....I:D..T..Q.......`f~..N.CE../...5.<.../.G.@....%b./..v..nYM....k@.%c..../.#.?z.9....67}q..]G.d.......&...l\..q9..-....{..db...m..n=s8.B.1?..D...).ub......I.....?..q...B..@.....'.F._.> `.....o...P(&].SS.)...&N.[..-..+GrF.......QS[.....6.o..w.......E.$r..Q8I07....R9....J5.e.....H.Y.I....jyJ..R.9Yj........~g...b.>z.'.6n.c......m.gkc.9....%....!.B...Y\|N.......RQ.,>.U%$.U..w........wg,N...>!....w...d.nh......]...E..b@>Z...<.

C:\ElitechLogWin\Images\import-icons\00010[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4028
Entropy (8bit):	7.936381459841525
Encrypted:	false
SSDEEP:	96:sIcR524OrLoLE6R7QmXqvblhJXUxlVhW5QsJb7QZdUBfyMf1mMu1tTilg:MWvoLEe7HXkb5b60nQMu1Ylg
MD5:	6872CDC860D8870A9175939C44B652BD
SHA1:	98D9C0E0A0932A7E9A09D63D73897DFF974D1CE6
SHA-256:	37610541B7292A84F61973A26D763AFBB0B8AE167257C81AA08CA7973699CCA3
SHA-512:	A37DEAD96F788382CE682F2E75C9F0EE47126A76C9F384B2138250A26410B43CD78F09157A71B6AB971BEDA5BF9B0F481C01107F2E9F7990608F4D888DBBC6D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....QIDAThC.Y.TT.>..@.&...&F..M4....\...P,.D... U...3.2.3.u.0.2......HQD.2 .T.{{F^.[w.....Zw........o....^..^.?..y..E.1.2.).AB..O8WW<-+..,.z#T.i.V.~[QE.`.....&&6KMl.ML.......S^.}..EZZZ.......#.....g..I/t..8.!..T.N.K..]pj?.......o;..qw...kJ...+.VV]h.]KJo./...r....y...r.'.d.....M..Mjjj.CCC.277....{........C>.0e.p.P....$p,..k..\....\....Q}..3f/.g.ahx...].........]/.....e3..C....~va0.SQQ...,'....\RQu..C.s..P....\..pI.DK...B0J..3.B.Em.N.....'O.ONMMazz..vXT.'...A'.].6...-...~.....O?-vv.(lm./vt...9:........0M~.n...?...5... ..x.1.?~..O.a..OLN..........: j.q..?....u.._....K5u.....W...mlu.p..-(..A3R......H...........Fb.....&..1>...........V^tww_,j./.L....Y...G.tj.......v9Ja..$...".....7...o.a`.......DC8.......ya....G.K .........3......h...Fss.....=...X.La...l1..n..........y..i[.]....Y.......`pp...h...?y....v<F\...dhb.T.......g@W_...{.Vc.6...W.4(...S..#..S....

C:\ElitechLogWin\Images\import-icons\00011[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3615
Entropy (8bit):	7.914172330649661
Encrypted:	false
SSDEEP:	96:nfn05CP7nRrg/GDd2yPRsj53rnB8wSFkqpj:P05CP7n++JDcnBJ+
MD5:	E78623981E2A4366A6E77CFB36287B84
SHA1:	ECD40065AB6553F7B2FA18820AD0FBC386DA82A2
SHA-256:	DC37C9EF7CD988B8142A7E20627596CACD4D7798590DDB441E968821D65D064E
SHA-512:	8F7AECDE5660439B04879C2B02AB459BBF573DC084A2844DE734EA03373D7C31CDA74A85E905ADDE0B880D746E82FB14D94B1D59E9F9C445809295A9700E684D
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.yTSg..S....b]j].:.u....Z..ZK..j[.......Z....7(..,..2 R.+..-...$.ld.....B..3.........s...7!..\|..Y..r..S{j.7.\.\|IIIPnnnavv..,..G....o:e./...m.}x...>..~.6...v..;...q....L.P.6..z.N.....E-.....y...K.......6..\|}..M4.'.9..A>z...w..;.n..1.S.:`jq..T8.P....+.3.r...6..s`.A.....}....w`..D'...r..{....................c....._..,....r..~6.cg........o.....o{...c..,...\....@rrr....o/.;.{_5z,<...?gM..GZ+f...'.d;_.d.~.M/.0x-......+.6..N+A@~mz.[...#..z.W.#!!.....s.........E...I.._....f.[.N..E.,x/...3.f..1.47..'..vT....1).t.?.Z0"...~..?./.DX...4.q.y.._W...zl.....e0....l.\|.w#m...PBZ1.f\|$....<`.C&x...F....Rb.a.f.4`..1<.U..JD.,@]...........7X......K.Gw.-.eN..a0......5a.....x...k......X.9oE.-...j....x.K.?xi...f.yI0x{.z-....n@X........q..5\.\|.qqqW\.....j.a4.....D..9+..X.,.j..o...Z...N\-..T....m.5.m....~...x.3aa....,...Wq.a!.M..^...$\.t..@tt.....o...@.E...<.. .,

C:\ElitechLogWin\Images\import-icons\00012[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3513
Entropy (8bit):	7.936732492172983
Encrypted:	false
SSDEEP:	96:fJk+oNnsInURHhwc1mtVNqzXlu/BS4/sVaiP6Gag0+4:Bk75DwBwc1SVILMBLidhd4
MD5:	9CFD9ADA5AA63621AE0A6CAD0AD2B0C4
SHA1:	5AA9DCB6E6DDC1140953F8123EB99659C4A9CDB1
SHA-256:	2E664E0061CE80FDEAD7180B0A20E1540AE9C6A56CF52D19B68A9B37E8339E81
SHA-512:	762DC8A244D5D2AFEDE7C3D9AF00FAA14F572DFC8604FF65233471BAD2323E77731D5027204A1B207F72AC82A70040A7536365CC3B63FD3B0D818D7D17AD93C6
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....NIDAThC.yX....?.t.:...T....h...Y.d..j....V..v.E....h$.2d.,I.............3...3...}]...t..~^.....s.C...?P..".D., #$..d.X.R.4...rx.....v......J.....dF...s.......%2..jeB..d.y..f.......,L..aU..".K..D.....9.]A(v..Hh...w...rfC........... Z.p5.C.1....6...Ib.A!v.. .J..{.......,..W...z....9..:\|(..!..;......7...#..8.,.8pI."..iuB...".../......e......p0XM...\|..%..q<H....cC{1.&....}..^.<..K!....PE...H..&..)#v...\J".K..PP>-....5]......(b{.....0..e2.N.\...aE.$].E...B.y.T.X".D.Y...J..d/a.`2..&.d..N..d.g.i.U....[..}:............ET..G]......5.....$...a...!..].%....\|I..PB....E.%........Z.}A.&,...F.....L...D8.`{.......O..ps...,}l.S.(.....U".;...M..N.o....._)..h....4....Y.W.@\|.#..7.m&..../.\.DH...*.8xF..`..Z...]Y6j.../Gl..l...2U....l.......Fm...8}....s.g.p.Im.4..yFLI......C.n>.......I..$Uk.T.h.....1-W.^.9./.B$.."......?^.@...........~7.../....\|.7..KY.q..Q..0.).k....

C:\ElitechLogWin\Images\import-icons\00015[48x48x8BPP].png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4545
Entropy (8bit):	7.940940779315774
Encrypted:	false
SSDEEP:	96:jXtAE8hFIAFXExNWEWQcWjw7srgjrCGFoSPteJpUyN:j2XVNnQccw7K90PteUyN
MD5:	A59546153BA3B7C5EF307C2FD4C36DC7
SHA1:	DAE920A9B9A0DA8300A6E398DF771E54BA003B6E
SHA-256:	75B3E84EED67383498F52D019F56681B9DA57B6334B0A3C0F76F48FA6B1AA312
SHA-512:	3D2695D321D0F37730A430B668596A4A8740F1500E445DACCDB98DC4F1805F86B0F1251FCFD97F0A3403DB932A6646D03002125B9D1AE0EB4B63223BE171A787
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....VIDAThC..P...?.%.k....cL.Xc!(&v....5JD.....A@.".....]@:H.".{/.........y..I.7y.....5{....Z._.>......%...C.F'i.[[..4...9.%.!..O.FY...n7.F.)M...&.ZKc.....F.T..Fo+..?.F.?..zl..Y.I.W_.....o.....I.....6.N.S.).Vk..\|.4L..V#us.q{.$..a....pB..4.4B.f.QZ..;..5.9`{../...O.....\..d.s".3.C....j.i...&..J..m.....tI.T7...O.?..C.......'..B....++y.j.k.\|.:w....Fn.....B./.....<y............o...H.......I...Q..'A+q.4..B..4.[FuE9..9..d.STA^q..%e...P.q.....Z..y..R~....+\.}..w.Sy.L..~C..f.4dy\;..?)..c....LZ.KJr2..y...D..&21...<.2.I.<Gb.ER..s..+.x......-...)8Oai.0s.;.....%7?`K...z.n.~x.b.?.Z)..m..6......-...8..DHt2....D...,b3..+...c.<;....n..Q..........-$+..l...Jj...........H]U..V..X._C[W.X...+.6s..}..k..H.....#...J!0..`.@1.=WIz.%.z. ....[.maB.....r.2JH.$E.M.\|...s......y.DQ.j.ZO....O.UG.m..T..QstY..H.....W8..Q.......GD..Q.x..#1)d......?h...mxy...h..G..P.K.N+$V0.l...K.H..

C:\ElitechLogWin\Images\import-icons\is-5652K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3513
Entropy (8bit):	7.936732492172983
Encrypted:	false
SSDEEP:	96:fJk+oNnsInURHhwc1mtVNqzXlu/BS4/sVaiP6Gag0+4:Bk75DwBwc1SVILMBLidhd4
MD5:	9CFD9ADA5AA63621AE0A6CAD0AD2B0C4
SHA1:	5AA9DCB6E6DDC1140953F8123EB99659C4A9CDB1
SHA-256:	2E664E0061CE80FDEAD7180B0A20E1540AE9C6A56CF52D19B68A9B37E8339E81
SHA-512:	762DC8A244D5D2AFEDE7C3D9AF00FAA14F572DFC8604FF65233471BAD2323E77731D5027204A1B207F72AC82A70040A7536365CC3B63FD3B0D818D7D17AD93C6
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....NIDAThC.yX....?.t.:...T....h...Y.d..j....V..v.E....h$.2d.,I.............3...3...}]...t..~^.....s.C...?P..".D., #$..d.X.R.4...rx.....v......J.....dF...s.......%2..jeB..d.y..f.......,L..aU..".K..D.....9.]A(v..Hh...w...rfC........... Z.p5.C.1....6...Ib.A!v.. .J..{.......,..W...z....9..:\|(..!..;......7...#..8.,.8pI."..iuB...".../......e......p0XM...\|..%..q<H....cC{1.&....}..^.<..K!....PE...H..&..)#v...\J".K..PP>-....5]......(b{.....0..e2.N.\...aE.$].E...B.y.T.X".D.Y...J..d/a.`2..&.d..N..d.g.i.U....[..}:............ET..G]......5.....$...a...!..].%....\|I..PB....E.%........Z.}A.&,...F.....L...D8.`{.......O..ps...,}l.S.(.....U".;...M..N.o....._)..h....4....Y.W.@\|.#..7.m&..../.\.DH...*.8xF..`..Z...]Y6j.../Gl..l...2U....l.......Fm...8}....s.g.p.Im.4..yFLI......C.n>.......I..$Uk.T.h.....1-W.^.9./.B$.."......?^.@...........~7.../....\|.7..KY.q..Q..0.).k....

C:\ElitechLogWin\Images\import-icons\is-6CICJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.933244475879462
Encrypted:	false
SSDEEP:	96:R6zCEAXHygkDBwuzz6e8T66Xj1pEErHTCqnS6GjU9BuEdfDC:R62EMcqe6eACB6GedfDC
MD5:	3A0429634B9FFB29F5FEB4C14CA86445
SHA1:	E83C6E2ECBE2C3836479037FB9F1043A9A690373
SHA-256:	8E9E9E03C9D336C950A90934D2826F33F61CC9FB7EC79D8CA3534E7684F43543
SHA-512:	2CF44914F95AC9D1908CB8CC4B8D2E9AA712AD13D56A435DC3DF957D1DA8AFB0E2556597BD9594EC48CBA75E74D2FFFFE364578212469362FAB5C7981DDD3902
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....(IDAThC.wx.U..'.d.......].".*....4.UwY]\TDl(......B.$...@ ...$t.....)I&}.....3d...+...}.....2.....<.9.y........~.a...>.v..=~.q..;5..v........O..y.......w.\...]f.....NE......K...(...Q..T...u...i.......>9.w.<>m....N+....m../...A>.v.....3...zf..&....x<.......r0\_....P8.....p~3.Ns#.8?......b0pA.......... 4.>.>;.~.'..W...,.....r....e..:.i.6FM...3.....;n.......s....Nx.?..m.._.....E.9...#.[Q.?H.C6.....M.K..........F...$......V...^..j.....?.g...7..).g...x>G.....R..C.6=..3..z..3.CNx.u...`.;7...".a..>:........p ....o.1P./..'..}.\.........z..O..............x.iCx...<.fZ../E.....;.....oD..G.uF..8..Svx[.2.00.d8...'....kS....}u.(;^..g.._n..~..,.Q.j..;#.j.......9?.......L.._;.?...pX...r..N.%..... ".%.u.#..A..,E.Q_}.n.w.!....R...z.^..c%...~7......~...+..u9..oF.i..8......\|n8..M.-...Gh"..'....b..3..y'.;1..L......)..i.../....;Sl..y.TVI..y.y......w...#\..\|n..R..Qp........C..

C:\ElitechLogWin\Images\import-icons\is-BS5NG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3615
Entropy (8bit):	7.914172330649661
Encrypted:	false
SSDEEP:	96:nfn05CP7nRrg/GDd2yPRsj53rnB8wSFkqpj:P05CP7n++JDcnBJ+
MD5:	E78623981E2A4366A6E77CFB36287B84
SHA1:	ECD40065AB6553F7B2FA18820AD0FBC386DA82A2
SHA-256:	DC37C9EF7CD988B8142A7E20627596CACD4D7798590DDB441E968821D65D064E
SHA-512:	8F7AECDE5660439B04879C2B02AB459BBF573DC084A2844DE734EA03373D7C31CDA74A85E905ADDE0B880D746E82FB14D94B1D59E9F9C445809295A9700E684D
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.yTSg..S....b]j].:.u....Z..ZK..j[.......Z....7(..,..2 R.+..-...$.ld.....B..3.........s...7!..\|..Y..r..S{j.7.\.\|IIIPnnnavv..,..G....o:e./...m.}x...>..~.6...v..;...q....L.P.6..z.N.....E-.....y...K.......6..\|}..M4.'.9..A>z...w..;.n..1.S.:`jq..T8.P....+.3.r...6..s`.A.....}....w`..D'...r..{....................c....._..,....r..~6.cg........o.....o{...c..,...\....@rrr....o/.;.{_5z,<...?gM..GZ+f...'.d;_.d.~.M/.0x-......+.6..N+A@~mz.[...#..z.W.#!!.....s.........E...I.._....f.[.N..E.,x/...3.f..1.47..'..vT....1).t.?.Z0"...~..?./.DX...4.q.y.._W...zl.....e0....l.\|.w#m...PBZ1.f\|$....<`.C&x...F....Rb.a.f.4`..1<.U..JD.,@]...........7X......K.Gw.-.eN..a0......5a.....x...k......X.9oE.-...j....x.K.?xi...f.yI0x{.z-....n@X........q..5\.\|.qqqW\.....j.a4.....D..9+..X.,.j..o...Z...N\-..T....m.5.m....~...x.3aa....,...Wq.a!.M..^...$\.t..@tt.....o...@.E...<.. .,

C:\ElitechLogWin\Images\import-icons\is-GUK93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4202
Entropy (8bit):	7.948244172278149
Encrypted:	false
SSDEEP:	96:gZtv4aLPI0Dfhd95tdeCs+hfzp3lXQc7206f0ksTzzgLfT9ZA3Gbm2z:Qt9jTDpd95yr+hfzllv72xJsPsLb9S2J
MD5:	E340020B7A43D82295380FC778644A63
SHA1:	73405ADF1E192C7187E05BAE28CF8944AFFA8B50
SHA-256:	6710735D9881AA7DA3E15B84086D763C708CD6BCBA2C93CF98DD8D5857F1F6DA
SHA-512:	85B8C57C049B42006482E3E1CA71D7F4037FC25CAEC33AB3FE6305F99B5E5CF79DF04BE14477305355ECDB95C83044AD4A4A934E0F6AA744460437FBFC606BCE
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.wTU....}.7...T.&1.J...5...n"..Mb."..F. .......^E..&.:.{/................c.....{.}.x.k^............T:.....T[W.YTU.(....tO.+.L/.V...{[O......I....4v-........=d.?./".K.0.,=.j.`W.<0......SH........lee.....RV..ghZ.rQm.wq..=.$g.`f..=.p..S......E.... .=b...K..........3..`d.......'.........YUW'..]QU...?..CH...F.....a.[.....!..G. .JIL.......69z......9v..Ay...>.m..;F.$...b.[X..=.........Q.&%.......[....3(.E..x.$.?...HL.at.!:...:.....W...k>.a.'..m8-3......+.^..5.Q>..>.kz)m..........p...0....+...~....SJ.......G.'.l..l....W...[.....6.X..6..op.-.....h......:.K!...Db\|..}f.`...Z...."m...3....J....r.$.+. ..9(.c........_......f!..0=..N..........Q.-t.#i..:...DrE~.U.@..H.g..{$.I..EZ...JC.3.HN.....J5..t0....N..l8~....M...V.$:9{..C..Y.C.}..l....3...)......0P.X..c.@.*.0,...Y.P.z...2\.%C....GW.<.Y...)..LO.$.^....s.L...^...G.7Qq..g..Ra{..Z&.,V3.5...7......Y.'.5V.

C:\ElitechLogWin\Images\import-icons\is-HAB8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4231
Entropy (8bit):	7.941445751823313
Encrypted:	false
SSDEEP:	96:rZ+y0iwEEkc02B3Ai98820Rwo+G2BsWI3mV8qVrSYfhJ:r4R6EJAic0WoEBsWqmvNfhJ
MD5:	63CCD3E964A6582EBABB901A6E0367A5
SHA1:	EB232A2A9D101F665BA58E7500A77961058CE673
SHA-256:	7C22C5FB0B5BC3DBB57BD61CCC47DDF301F06D0883FC7A88C216B276C94131A4
SHA-512:	B797245EF2C1598B248F9F1BC8C050880D578FE6F4B736C5A7F6A66E6DE19DBACF29890509ADFFF8D5B211F624C351A036C774F4B1C9DFEEA83E388706FC0BC5
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.YyP.g...8..L..I..Lv'.nj..8.....I....(FAn..Q...0.wCs.4."7(r.GC.@..t.M74.......[....f...\|.....}......g.L..?...6}....kj..jh.kj..oj..k..mh......{...a..Q...V..:.w.._..........a.L&....g...Q.....hRN.p(.wp(../...H.:{z.."...q._...6a.[^..../,<..."f..5....jv.+++...l.....3.~!q..K..A1..d").......i,..0O{../..kV.~......?~....6,....2..b..{.eu....L&w......<fT.....\.'.~fZ.k..p..>...O...q...P....&.....2..7.oD.G.y.h..Y.~.1$cRz....`.../.......<...H....I:D..T..Q.......`f~..N.CE../...5.<.../.G.@....%b./..v..nYM....k@.%c..../.#.?z.9....67}q..]G.d.......&...l\..q9..-....{..db...m..n=s8.B.1?..D...).ub......I.....?..q...B..@.....'.F._.> `.....o...P(&].SS.)...&N.[..-..+GrF.......QS[.....6.o..w.......E.$r..Q8I07....R9....J5.e.....H.Y.I....jyJ..R.9Yj........~g...b.>z.'.6n.c......m.gkc.9....%....!.B...Y\|N.......RQ.,>.U%$.U..w........wg,N...>!....w...d.nh......]...E..b@>Z...<.

C:\ElitechLogWin\Images\import-icons\is-LIFNK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4545
Entropy (8bit):	7.940940779315774
Encrypted:	false
SSDEEP:	96:jXtAE8hFIAFXExNWEWQcWjw7srgjrCGFoSPteJpUyN:j2XVNnQccw7K90PteUyN
MD5:	A59546153BA3B7C5EF307C2FD4C36DC7
SHA1:	DAE920A9B9A0DA8300A6E398DF771E54BA003B6E
SHA-256:	75B3E84EED67383498F52D019F56681B9DA57B6334B0A3C0F76F48FA6B1AA312
SHA-512:	3D2695D321D0F37730A430B668596A4A8740F1500E445DACCDB98DC4F1805F86B0F1251FCFD97F0A3403DB932A6646D03002125B9D1AE0EB4B63223BE171A787
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....VIDAThC..P...?.%.k....cL.Xc!(&v....5JD.....A@.".....]@:H.".{/.........y..I.7y.....5{....Z._.>......%...C.F'i.[[..4...9.%.!..O.FY...n7.F.)M...&.ZKc.....F.T..Fo+..?.F.?..zl..Y.I.W_.....o.....I.....6.N.S.).Vk..\|.4L..V#us.q{.$..a....pB..4.4B.f.QZ..;..5.9`{../...O.....\..d.s".3.C....j.i...&..J..m.....tI.T7...O.?..C.......'..B....++y.j.k.\|.:w....Fn.....B./.....<y............o...H.......I...Q..'A+q.4..B..4.[FuE9..9..d.STA^q..%e...P.q.....Z..y..R~....+\.}..w.Sy.L..~C..f.4dy\;..?)..c....LZ.KJr2..y...D..&21...<.2.I.<Gb.ER..s..+.x......-...)8Oai.0s.;.....%7?`K...z.n.~x.b.?.Z)..m..6......-...8..DHt2....D...,b3..+...c.<;....n..Q..........-$+..l...Jj...........H]U..V..X._C[W.X...+.6s..}..k..H.....#...J!0..`.@1.=WIz.%.z. ....[.maB.....r.2JH.$E.M.\|...s......y.DQ.j.ZO....O.UG.m..T..QstY..H.....W8..Q.......GD..Q.x..#1)d......?h...mxy...h..G..P.K.N+$V0.l...K.H..

C:\ElitechLogWin\Images\import-icons\is-T7D3N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4595
Entropy (8bit):	7.947328387010405
Encrypted:	false
SSDEEP:	96:rqfunlYnR0PQjt4mAHJuFbu0ba8iJoo6mWnN376OZH:GfwlQR0Pkt4xHcFbp2io6mWNL6OZH
MD5:	EEFEFE6FC708EA70E1A8F8A17236370C
SHA1:	6C69E782BD7F850A532A001114B2603F6A32B764
SHA-256:	F3CF7FCD9A8CB2B6EF9DE61DDBAD98F21D27DBEB2D3B0A0BEEB91631D4CC28CE
SHA-512:	63CE3497C5011B46272E75BB2B9E720E583BAB077E700E4B051949DB5DD322DB47FF0CE3BB0CA2919FB4FB7D60C30D55BB897EC1A21100C5CD0480A471618413
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J.....IDAThC.YyX.i..L.4!C"cK.B....d$..%.Z.$QIBKQ...d-m..VQTRR...o..z..9...`....y...}...y...._............E.uY.waISZ~~......./.7d.6.K......;!.qUlr.....QV.&_.ioaiSa.f..5.yA#..5".E..g7 .i=.2...Q..z.N.{w.Q.k.5...o..M.IQQcY..&.j..Fd0..&..Y#RrZ.......7..Z.H.EXr-.%.!(:.50....jy.#.;......58.U#r^6"+..iL:.Ig..9%@Z!....f...z.{...@d6.\|#.....~.....[.w.v.....Y.Q.VJyR..EA.2r....!X.<...V..-..M=1u.N.......a...F..y.\a\|<....r.p>...1.8.].....}W..^..@Nn..[Q...r[..I.......w;...w.... ."..l..T.f..a[..A..`[ ...L:p<....>.....I=......]..X...]..+.....Hy...Qs.iP'u&....Q...6a.,K,Xv..+.1]...G..k..<g9.6$.-....G.......0T.>h.....M..EW[.1.y3..6!..I...t.....c2. 1...-......m<..CMM5.f.O...]E.n.K...?z....uA...op.........h.k..........kf#....1.....>!"....T@y.k<.....rF.a-o.......5U.........-.MB!.#5..6....K...J.......l..._.i...=V4.OB.....-v.9Y.P...O.....h'..L.0..HL...~..W.....Caa!JJJ...{..Q

C:\ElitechLogWin\Images\import-icons\is-VL9U4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4028
Entropy (8bit):	7.936381459841525
Encrypted:	false
SSDEEP:	96:sIcR524OrLoLE6R7QmXqvblhJXUxlVhW5QsJb7QZdUBfyMf1mMu1tTilg:MWvoLEe7HXkb5b60nQMu1Ylg
MD5:	6872CDC860D8870A9175939C44B652BD
SHA1:	98D9C0E0A0932A7E9A09D63D73897DFF974D1CE6
SHA-256:	37610541B7292A84F61973A26D763AFBB0B8AE167257C81AA08CA7973699CCA3
SHA-512:	A37DEAD96F788382CE682F2E75C9F0EE47126A76C9F384B2138250A26410B43CD78F09157A71B6AB971BEDA5BF9B0F481C01107F2E9F7990608F4D888DBBC6D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........(J....QIDAThC.Y.TT.>..@.&...&F..M4....\...P,.D... U...3.2.3.u.0.2......HQD.2 .T.{{F^.[w.....Zw........o....^..^.?..y..E.1.2.).AB..O8WW<-+..,.z#T.i.V.~[QE.`.....&&6KMl.ML.......S^.}..EZZZ.......#.....g..I/t..8.!..T.N.K..]pj?.......o;..qw...kJ...+.VV]h.]KJo./...r....y...r.'.d.....M..Mjjj.CCC.277....{........C>.0e.p.P....$p,..k..\....\....Q}..3f/.g.ahx...].........]/.....e3..C....~va0.SQQ...,'....\RQu..C.s..P....\..pI.DK...B0J..3.B.Em.N.....'O.ONMMazz..vXT.'...A'.].6...-...~.....O?-vv.(lm./vt...9:........0M~.n...?...5... ..x.1.?~..O.a..OLN..........: j.q..?....u.._....K5u.....W...mlu.p..-(..A3R......H...........Fb.....&..1>...........V^tww_,j./.L....Y...G.tj.......v9Ja..$...".....7...o.a`.......DC8.......ya....G.K .........3......h...Fss.....=...X.La...l1..n..........y..i[.]....Y.......`pp...h...?y....v<F\...dhb.T.......g@W_...{.Vc.6...W.4(...S..#..S....

C:\ElitechLogWin\Ionic.Zip.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.756472592247957
Encrypted:	false
SSDEEP:	6144:jrQweBeGtSV41QJDsTDDTXamJ0Zu3xLV/m9suGOKtM3:jgBlS4YsbXalu3fm9vGZM
MD5:	746F909970274C71991F63325BA3AB4E
SHA1:	CDC53CD41C8CE8D356B057A3ECE483F9116FDDA9
SHA-256:	5C0449B8A9B65F36CB6A66C1AC9379F8F62A75DFCCFDA67FE959563177B3C5B0
SHA-512:	5552710EC9C648385E72EC650F437A99C28116C69198DD94268AC5308F1D7FC279C6CD7F563AE7EB5B1F0D0BC29E83104EA4404A7401A644F3E29AC471CAB2B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......K...........!..................... ........@.. .......................@..............................................`...L.......t.................... ....................................................................... ..H............text...?.... ...................... ..`.rsrc...t...........................@..@.reloc....... ......................@..B................H........<.............L...H0..........................................&...(.......0.. ........(........(........(......}........>.(.......(.....0..d.........o....:.....s....8.....}......(......}.....(....s....}......}......}......(.....r...p}......j(........rr...p.{.....{.........(........0..J........{....9......}....r]..ps....z..}.....{....:......}.....{....:......}............{......{....9......}....r]..ps....z..@......}....r...ps....z..}.......{!..."..}!........{"...

C:\ElitechLogWin\Log\NLog.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1872
Entropy (8bit):	5.067760414124108
Encrypted:	false
SSDEEP:	48:o8ZCrcgGKCErMArMFMVReY34fQcgpCO6jBKI:P5fzErLrE2kFfLjR
MD5:	8885B88EF038EADCBBDDE078D9267295
SHA1:	509B836FBDBB17FB1882F29A4DEE65A5C1DBADE2
SHA-256:	AB9C24B0EB54F92713B8F2AE28E1E66ABAB4C52C661B386D128C1378E3B82193
SHA-512:	C73B2998C753F3953DBA6DCDAE13DF25784B3CBD47B08372CE1C27AA93019DE10F0189E05A6E75114DF7A805C18DC3BD52370BC3657CE6222E0D848FFDAEEA95
Malicious:	false
Preview:	<?xml version="1.0" ?>..<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">.. <targets>.. <target name="file" xsi:type="File".. layout="${date:format=yyyy-MM-dd HH\:mm\:ss} [${level:uppercase=true}] ${logger} ${event-properties:username} ${event-properties:action} ${message}".. fileName="${basedir}/Log/logs/logfile.log".. archiveFileName="${basedir}/Log/archives/log.{#####}.log".. archiveAboveSize="1024000".. archiveNumbering="Sequence".. concurrentWrites="true".. keepFileOpen="false".. encoding="utf-8" />.... <target name="db" type="Database">.. <dbprovider>.. System.Data.SQLite.SQLiteConnection,.. System.Data.SQLite,.. Version=1.0.106.0,.. Culture=neutral,.. PublicKeyToken=db937bc2d44ff139.. </dbprovider>.... <commandText>.. INSERT INTO log(time_stamp, level, logger, message,username, action, type, parameters_id).

C:\ElitechLogWin\Log\is-07HJ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1872
Entropy (8bit):	5.067760414124108
Encrypted:	false
SSDEEP:	48:o8ZCrcgGKCErMArMFMVReY34fQcgpCO6jBKI:P5fzErLrE2kFfLjR
MD5:	8885B88EF038EADCBBDDE078D9267295
SHA1:	509B836FBDBB17FB1882F29A4DEE65A5C1DBADE2
SHA-256:	AB9C24B0EB54F92713B8F2AE28E1E66ABAB4C52C661B386D128C1378E3B82193
SHA-512:	C73B2998C753F3953DBA6DCDAE13DF25784B3CBD47B08372CE1C27AA93019DE10F0189E05A6E75114DF7A805C18DC3BD52370BC3657CE6222E0D848FFDAEEA95
Malicious:	false
Preview:	<?xml version="1.0" ?>..<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">.. <targets>.. <target name="file" xsi:type="File".. layout="${date:format=yyyy-MM-dd HH\:mm\:ss} [${level:uppercase=true}] ${logger} ${event-properties:username} ${event-properties:action} ${message}".. fileName="${basedir}/Log/logs/logfile.log".. archiveFileName="${basedir}/Log/archives/log.{#####}.log".. archiveAboveSize="1024000".. archiveNumbering="Sequence".. concurrentWrites="true".. keepFileOpen="false".. encoding="utf-8" />.... <target name="db" type="Database">.. <dbprovider>.. System.Data.SQLite.SQLiteConnection,.. System.Data.SQLite,.. Version=1.0.106.0,.. Culture=neutral,.. PublicKeyToken=db937bc2d44ff139.. </dbprovider>.... <commandText>.. INSERT INTO log(time_stamp, level, logger, message,username, action, type, parameters_id).

C:\ElitechLogWin\LumiSoft.Net.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1130496
Entropy (8bit):	5.808910233677625
Encrypted:	false
SSDEEP:	24576:w7gTUIeYcQuFOzye+nW1aB2hrDUv36Rp1ZIu13:MuxzyazIu
MD5:	3AF100CAD8EF53BBF7C36520FA39D0C8
SHA1:	065DCB0192E8B35EC8F3BD730A4C1C9B83F7422E
SHA-256:	0D6AB9A9CF481012BC48C4722B577E97C086D2BCFC99722AA24799833D95CA79
SHA-512:	2A5EC7076297F6C1621B6DB4399BDDB37F90DB59503948C5280743DB9BC8A0C4D89FE7FA3B85DCEDE1CF5E4E55B28D3FFB3D1E105AACBCF7C4998F63CCD0A169
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.P...........!......... .......)... ...@....... ....................................@.................................L)..O....@..P....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...P....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\MarkControl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.839823542304099
Encrypted:	false
SSDEEP:	384:FEBnJwk/59hJsgmKYBOz3dzOMzFBzxiapBazqccrXS7VJwk/59hJFL0QGZVYs9MS:1cdcL0jYB5D/
MD5:	4E77D269A9AF0D326AC0326DF0FD92CA
SHA1:	F9C7C23A3F3B4ED68DB367D023DB2A4A2A64A883
SHA-256:	AE20EDD43D3E62BDD780816E21D696AB917076B7618B57D9F4FF515E66BC8229
SHA-512:	8130733D8FE303A207852E2D6B9C220CC2DB7E3B62BC148BD0346DCE4A7D19E414A8193ED284095BD3360909BCC5CBC297BA1041F5832CB66BE008074D7CCE4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y.........." ..0..F...........d... ........... ....................................@.................................8d..O....................................c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................ld......H........6..D...........HT..............................................".(.........0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.*....0...........s....}.....s....}.....s....}.....s....}......}....."....}......}......}......}.....(.......(.......,...........+....,`...(.....JX..(........,.....(......(....Y

C:\ElitechLogWin\NGettext.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.647891900426496
Encrypted:	false
SSDEEP:	768:M2PFJNrJ2rSFeTBzbRhhRonhSUD3/SZ2WuqO/NYeK:79JFErSUTB5Ronhz3/SUoeK
MD5:	D92437B05B2D2B745E2ABBCFE125D726
SHA1:	6D3242418D0E7CBDEBECD1A47EB59558BFF66BB4
SHA-256:	404AA253460521EF376156826CF0549549806E43AC168918FE1232D00E500601
SHA-512:	8941BD78ED6A3BB7A6C52C5A2A970C39992E1FE77B97C45560F68A946DD7FC4CBF17C6FAC1ADCB8F1801EE6AF55A3577B6866F89C933D0A093C25F9C9B8CEB2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W............" ..0.............B.... ........... ....................................@....................................O...................................\...8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................!.......H.......(^...Y...........................................................{...."..}......{...."..}......{....Z.-.r...ps....z..}....2.(....(......(......(.....s....(.....s8....o7...(....6..(....(......0............(......(.......r...p.o....(....rS..p(........................6..s....(....:..s.....(....:...s....(....>...s.....(....Z.-.re..ps....z..o~...&...o....V.(.......o.....(..........o....b.(.........o......(....R..rs..p.(.....o......(......rs..p.(.....o.

C:\ElitechLogWin\NGettext.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1244), with CRLF line terminators
Category:	dropped
Size (bytes):	72572
Entropy (8bit):	4.539288617422733
Encrypted:	false
SSDEEP:	768:7Y7u0fmzC5BJUEs32nPSV/K791pNirZI5Hrl+n3GoUMN+yP:8BJxs32nPSV/K791pNircHrl+WoHNR
MD5:	EE31F007ED9E84678B54437D91F4BE85
SHA1:	6B8499B8860574936285CE76DC6A5457C6264BBA
SHA-256:	1552138AC6F486BAD9D014798FF146AD6CD5B87A4EDBA127BCCDF2319118B08F
SHA-512:	54EA64675474DCB79964481BB743CE5158D0ED80D9C8B1B92C756DED78D11AB8790BD85A4B69136ECC6D9729277827D640A70EBF7330F42B20A306A2F67B774F
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>NGettext</name>.. </assembly>.. <members>.. <member name="T:NGettext.Catalog">.. <summary>.. Represents a Gettext catalog instance... </summary>.. </member>.. <member name="F:NGettext.Catalog.CONTEXT_GLUE">.. <summary>.. Context glue (<EOT> symbol).. </summary>.. </member>.. <member name="P:NGettext.Catalog.CultureInfo">.. <summary>.. Current catalog locale... </summary>.. </member>.. <member name="P:NGettext.Catalog.Translations">.. <summary>.. Loaded raw translation strings... (msgctxt<EOT>)msgid => msgstr[].. </summary>.. </member>.. <member name="P:NGettext.Catalog.PluralRule">.. <summary>.. Gets or sets current plural form rule... </summary>.. </member>..

C:\ElitechLogWin\NLog.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	604672
Entropy (8bit):	5.958390269882712
Encrypted:	false
SSDEEP:	6144:X+n+hEmw+9s0Bv5pllUsQY4FIjWRm4kHVf120UzquGDFTGpQsA/RwqWd:O+X+0Bv5pllUsQv2jWA/TkqLwo
MD5:	F777533E9C54A5B5AEEFD8353659FBFC
SHA1:	2A0D9AFF4A0B3A8E13AD0E3F3D659194E9D3BC72
SHA-256:	7164DAE2B677907DD9F9EF37147BC2571D0A954A5C5A00F047C7F5C1C1B99DE8
SHA-512:	85CE75B14B585BD8B37AEDAB6B0B3FE01C56B1DE4EE0B507FE8FFF7292C76ECFD8BD7519B6D6E98AA549F3394C628CAF5B98ED78D4ECCB4F1B5F0FC094FC4C4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y...........!.....2..........~P... ...`....... ....................................@.................................,P..O....`...............................N............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B................`P......H.......L.......................P .......................................a.\Gq......>%.Liv.4.k..:T.LE...C&3..,.WyP.............$b.srw...t.pQ6W.`qHy....U.......]}.4..F.....mOv..<$.[g].........-.D.<..(!.....(!...:.(!.....(......{...."..}......(!.....(!...:.(!.....(......{...."..}....&...(....V.(!.....(......(......{...."..}......{...."..}...."..(....:.(!.....(......{...."..}......(!...:.(!.....(......{...."..}....&...(....&...(....&...(....*V.(!...

C:\ElitechLogWin\NLog.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1373710
Entropy (8bit):	4.55524192185406
Encrypted:	false
SSDEEP:	6144:hbD3OCes/IyBgBxF+PJFqiS1CCM8KPbfHxCUIHMVc66z+VbC1h6:RGoPH
MD5:	84AB210D707F87002A080B69B99A9679
SHA1:	4743795AD876299229B061ADEBD239FCBCCBC088
SHA-256:	0456ED4DA2E3D2CC7C93329569A80C929F665E4325264A32EEC84D1D35A873DE
SHA-512:	1E643875D80FBA7CA4731D7097C982BFD6BC0B31FF2C7A6C781603CE1FF7505E7AC968306CEAE77767C875E1B44B005365A742F87F5C8F1D60302EAAAAF8A540
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>NLog</name>.. </assembly>.. <members>.. <member name="T:JetBrains.Annotations.CanBeNullAttribute">.. <summary>.. Indicates that the value of the marked element could be <c>null</c> sometimes,.. so the check for <c>null</c> is necessary before its usage.. </summary>.. <example><code>.. [CanBeNull] public object Test() { return null; }.. public void UseTest() {.. var p = Test();.. var s = p.ToString(); // Warning: Possible 'System.NullReferenceException'.. }.. </code></example>.. </member>.. <member name="T:JetBrains.Annotations.NotNullAttribute">.. <summary>.. Indicates that the value of the marked element could never be <c>null</c>.. </summary>.. <example><code>.. [NotNull] public object Foo() {.. return null;

C:\ElitechLogWin\NPOI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1282560
Entropy (8bit):	5.961335291442756
Encrypted:	false
SSDEEP:	24576:T1fExYh340V04QVi1VKWAJz3Cjd++BCGOruRuQa/thHIA0928Kxp:T1fExYe0V03VPJz3Cjdx/CpkA048K
MD5:	B5DC130D491BBE0C95220AAC7BC00712
SHA1:	F2D4EA54AE7EDAD8CF96B5064A2BA4A79B4F5E84
SHA-256:	5465A41228621A30268E8059BFE4151F510FC805D75A8FEB7726B8F24912C2D1
SHA-512:	0ECDF1300E938266C421BEADC12A0D89082DEC4D114FD6D4D1D0D27222800350BD0A428ADC70321499A0BACD33543B99AD077FECFF912FC25261ECA075174469
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.N...........!................N.... ........@.. ..............................b.....@.....................................W.......H............................................................................ ............... ..H............text...T.... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B................0.......H.......................<..l^..P .........................................{.+.....2..?^..]...&p..N...._.(..X.3..Z....;d..].......Y..z.....M..\........tn..`..'c;.Z..Q..3Ptr.....%.-...0............................................................................................................................................................................................................................ . ....!.!...."."....#.#....$.$....%.%....&.&....'.'....(.

C:\ElitechLogWin\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	525824
Entropy (8bit):	5.856165679472465
Encrypted:	false
SSDEEP:	12288:3MRKBWOcZJToYL7fxWpJd7YxQ+kBadQd:cRmU7xq7Yx0BadQd
MD5:	07E04FD870CEE6F9994921B5AF243B7F
SHA1:	0EA4611EEEE3736963CB718132099624BFEBF460
SHA-256:	52CC6DDF77990FBAAAE4DB593F655610652133CEEADB32262C122D8C9EEA1BAD
SHA-512:	4639A7F77F7A9CAFA38C632332DD5085355623F3D84475374241A64BD110569F504086B479B519E90DDBD471D4A5034239418EBC03277424212E0E6698E64418
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HP..........." ..0.................. ... ....... .......................`......-e....@.................................:...O.... ..d....................@......l...8............................................ ............... ..H............text...L.... ...................... ..`.rsrc...d.... ......................@..@.reloc.......@......................@..B................n.......H........Q..l.............................................................{...."..}......($...:.($.....}...."..(%.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(....0...........{)......(....-....(....*6..s..

C:\ElitechLogWin\Newtonsoft.Json.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527790
Entropy (8bit):	4.60374428445931
Encrypted:	false
SSDEEP:	6144:XqYRirv6df0/IuHtpOVIeR0R+CRFo9TA82mzKj+sJjoqoyO185QyMYFLsgflf:2
MD5:	E7841470F741868A4E959295F255E951
SHA1:	49771219B04B7B92F39A356BA91F82F334D49FA8
SHA-256:	A31F40DADCAEDB110605197ADA84C4BA803A0EB67BF90A24CA1EAECFDBCDB254
SHA-512:	F5D99827FEF3800727A658170E996DA9B3178CBF5D108DE6B7E2FDD8BF4C7307FD75A8B008FBA73EF921EF3E4DD2B545B2D2B52F68286B551548F645A4AF6E7D
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\ElitechLogWin\Properties\app.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	5.883611780247811
Encrypted:	false
SSDEEP:	48:3C30NtuBLkzYcr/9qCWyXsleV1VlGZNOGt0u8PQ6tL4wfT4M+bUg63h:y30Nt8kzYcZqCnGexlEb8PQ6tLz7aS
MD5:	DDF932314E895974A3429F409EEC582A
SHA1:	80E9465938802DB58F2F4D8F150C55F16CF1D410
SHA-256:	1BB9C3A4C2B261D6D2CA3EA1675B5FF07688DEB43FA85A6BAE509520EFC01A3A
SHA-512:	50E57CBB77B8E67031BE0868D405212C3A8F8F9C3EB4C3C819D278EB3FB4D17714ABB52F9EE2A5269EFFFFCFD02D61B40D0CA5B25D66D2CABA9E3FB6B7A47FA8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app" />.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">.. UAC ...... ...... Windows .............. ........ requestedExecutionLevel ...n.. <requestedExecutionLevel level="asInvoker" uiAccess="false" />.. <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />.. <requestedExecutionLevel level="highestAvailable" uiAccess="false" />.... .. requestedExecutionLevel ................. ............................. ..... -->.. <requestedExecutio

C:\ElitechLogWin\Properties\is-HLFM4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	5.883611780247811
Encrypted:	false
SSDEEP:	48:3C30NtuBLkzYcr/9qCWyXsleV1VlGZNOGt0u8PQ6tL4wfT4M+bUg63h:y30Nt8kzYcZqCnGexlEb8PQ6tLz7aS
MD5:	DDF932314E895974A3429F409EEC582A
SHA1:	80E9465938802DB58F2F4D8F150C55F16CF1D410
SHA-256:	1BB9C3A4C2B261D6D2CA3EA1675B5FF07688DEB43FA85A6BAE509520EFC01A3A
SHA-512:	50E57CBB77B8E67031BE0868D405212C3A8F8F9C3EB4C3C819D278EB3FB4D17714ABB52F9EE2A5269EFFFFCFD02D61B40D0CA5B25D66D2CABA9E3FB6B7A47FA8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app" />.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">.. UAC ...... ...... Windows .............. ........ requestedExecutionLevel ...n.. <requestedExecutionLevel level="asInvoker" uiAccess="false" />.. <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />.. <requestedExecutionLevel level="highestAvailable" uiAccess="false" />.... .. requestedExecutionLevel ................. ............................. ..... -->.. <requestedExecutio

C:\ElitechLogWin\Resource\SysConfig.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	4.893413503903754
Encrypted:	false
SSDEEP:	12:TMHd1qSB0KLzQ5KcN/P8TABtN/HAKtN/aTAA6tN/n9AQtN/WAVtN/YBTANtN/ptJ:2dFLzQ5KcR86XUY9RRemco3xDisPXx35
MD5:	D70215265F3E18CFF6B0BE9038354E0E
SHA1:	A693C62F6739B770E7495F99CAD4DDBECCADF260
SHA-256:	893A7DAF3158DF0341993EC2BD3DBFF98FC34BB6463327E4E7ED4EC357DDF9A9
SHA-512:	E610B469F0524DEA12FD02D98C33210D88620FC94504883CC4E1AE489C3B3C71C284BBC336F727FF9236E30FA531D8929E23F3779E5B7FA134BE002BA0FE863E
Malicious:	false
Preview:	<?xml version="1.0" encoding="gb2312"?>...<System>....<softwareVersion>V6.4.6</softwareVersion>....<softType>Conventional</softType>....<companyName>ElitechLog</companyName>....<emailAdd></emailAdd>....<showGuide>False</showGuide>....<hardSerial>.... .<Version hardSerialInitial="5" softwareSerial="EF5"></Version>.... .<Version hardSerialInitial="6" softwareSerial="EF6"></Version>.... .<Version hardSerialInitial="7" softwareSerial="EF7"></Version>.... .<Version hardSerialInitial="8" softwareSerial="EF8"></Version>.... .<Version hardSerialInitial="9" softwareSerial="EF9"></Version>.... .<Version hardSerialInitial="A" softwareSerial="EFA"></Version>.... .<Version hardSerialInitial="B" softwareSerial="EFB"></Version>.... .<Version hardSerialInitial="C" softwareSerial="EFC"></Version>.... .<Version hardSerialInitial="D" softwareSerial="EFD"></Version>.... .<Version hardSerialInitial="E" softwareSerial="EFE"></Version>.... .<Version hardSerialInitial="F" softwareSerial="EFF"></Version>.... .

C:\ElitechLogWin\Resource\Sysinfo.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.951607188342787
Encrypted:	false
SSDEEP:	3:LAACZEUhNc5sNRqyGPmpGDivxUJyGPmrQGRAUz8S4jA1oO4Qln:0r/bcmv8mogZ8mrFmoD4jA1FNln
MD5:	02EABE32FA74F61AAEAEF51B4D01E04C
SHA1:	ABADD47FC1049F74262B2905419CFEAC854DA48F
SHA-256:	2A3A5B8287B4DB67C83A44B6896476BAC37A4556ECE173A927BD7EF70AB73B33
SHA-512:	AC62C365385B59AC675A0600BEA416B5BCEE031883520B5BAC67F14A6D29B83D559607BB5760F0037CA5BEB8BE2D835E1E37ADAB9B9803774CA7919E41E74991
Malicious:	false
Preview:	[System]..Type=1..ProgramName=ElitechLog..Version=V6.4.6..Icon=\Images\Icons\elitech.ico..Trademark=\Images\Icons\elitechLogo.png..Website=http://www.elitechlog.com..CloudPlatform=

C:\ElitechLogWin\Resource\alarm.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 154 x 138, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4254
Entropy (8bit):	7.924013497920226
Encrypted:	false
SSDEEP:	96:kYZdoxBCZdVki/lAsCmvJBNJSRPOUj0bhxJe56UMpsX:kYZdoGjVkYlAs7R4POy6Ns
MD5:	C03789DA7288BE786CDD4AB572539E3C
SHA1:	4EA20A0EFB447785B3880BFFF4DF203EC6924E0D
SHA-256:	E8D0CEBEDDCB73E687CEDC55DCAF457B31CDA171CF88278341D726EA66A60118
SHA-512:	66B5E81071086D65A139D5D9B5A8D9E58E88B370BF70D35A9EFEEC0C1463793A6345CEC7297E04E1353ABBD928CA1E2D42AEC08C4608E7D0476C35151C24AC41
Malicious:	false
Preview:	.PNG........IHDR..............K......sRGB.........gAMA......a.....pHYs..........o.d...3IDATx^..p.e....G...&.W-P.@.h[..Kl......wp.....=.9.f.....y.sn.p.-P.R.7..C.Z.."P.M.f.M.{_.G....f..d....../.........FQT..T..2.@.))d..B.))d..B.))d..B.))bz.....~.g....U..a...ICy<..V,9...p...U....q.P..W?...7...S]....X....O...in.qR."-M..a.0.8i.a.8........................]..Y.E......?...v..s.WW.8..'.$\....Ft.@=dH.....a...:...7..z/_.q$$i..K?........0.....}...G.e..@...^Bvt.8..%.s....2...e..9...Gw.=..h.L...2..{...\|...@.;.,[..%@.}..K.....q.Y..\...a.?...Gy..hF..;~...@.;..y..$n........d:...%~$.Q$......K.@..z5\.Mb.E..@.\p...J!....$.Q....Xt.F.F........8.F'..k...Q!\...N...4:I..S.`..q...%...%N..i.xj.P#6..4...\|.5.p..N\.4......QA].~=...6..B..w..g...&...v.''.+.[.Ye.Xa.;.....>~..d:..6....(u.$i4Q\....H.h.].,e...H.h.].$.U...:0$..qp...L'HEJF..%..`+......R'@.F..%..N@B.Mh...:..j4.]....H8..p..J' ..J.%@@...0*...au.DnTJ........\.b.. B..s...N@........EQW./..K@.t.bot....f........3....K@L

C:\ElitechLogWin\Resource\is-00CJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.951607188342787
Encrypted:	false
SSDEEP:	3:LAACZEUhNc5sNRqyGPmpGDivxUJyGPmrQGRAUz8S4jA1oO4Qln:0r/bcmv8mogZ8mrFmoD4jA1FNln
MD5:	02EABE32FA74F61AAEAEF51B4D01E04C
SHA1:	ABADD47FC1049F74262B2905419CFEAC854DA48F
SHA-256:	2A3A5B8287B4DB67C83A44B6896476BAC37A4556ECE173A927BD7EF70AB73B33
SHA-512:	AC62C365385B59AC675A0600BEA416B5BCEE031883520B5BAC67F14A6D29B83D559607BB5760F0037CA5BEB8BE2D835E1E37ADAB9B9803774CA7919E41E74991
Malicious:	false
Preview:	[System]..Type=1..ProgramName=ElitechLog..Version=V6.4.6..Icon=\Images\Icons\elitech.ico..Trademark=\Images\Icons\elitechLogo.png..Website=http://www.elitechlog.com..CloudPlatform=

C:\ElitechLogWin\Resource\is-33NRP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	7.766388850618031
Encrypted:	false
SSDEEP:	48:f5X+NeI5d99C1xzOUWYnsVRhNi71nxOlwF8ipfCpVhnbTeuaW38cqsZ:f5XZGd99Yzfls1Ni71HFrpfChVq8
MD5:	0D7FBA89C6C02938D01F4B64C18F0F6A
SHA1:	113F4C0A16076198CFCA6CB384ABE9879A6F676C
SHA-256:	BDB83E34580E070C5F62252EDA600499DC6B2F118262E58702267A46FCE6A186
SHA-512:	8D19C4A42E9F7C3D56313E3E79E747C8ED75F18BF558D7738B570A359A67A63F6A8C5302811D0EC45EDE6A59DAD312D91C0F9459C0175CCB51BAE5E86664B2DC
Malicious:	false
Preview:	.PNG........IHDR.............P..w...7iCCPsRGB IEC61966-2.1..x...wTS....7.P.....khR.H..H..1..J..."6DTpDQ...2(...C.."...Q....D.qp...Id...y.....~k....g.}.......LX....X......g`......l..p..B..F...\|.l....... ...?.......Y"1.P......\...8=W.%.O..4M.0J."Y.2V.s.,[\|..e.9.2.<..s..e...'.9....`......2.&c.tI.@.o..\|N6.(....sSdl-c.(2.-.y..H._../X........Z..$...&\S........M...0.7.#.1..Y..r.f..Y.ym..";.8980m-m.(..]....v.^....D....W~.....e....mi..]..P....`/....u.}q..\|^R..,g+...\K..k)/......C_\|.R....ax.8.t1C^7nfz.D....p.......u....$../.ED.L L..[.....B.@...............X..!.@~..(*. .{d+..}..G.........}W.L...$..cGD2..Q...Z.4 .E@..@...............A(..q`1.....D .........`'..u..4.6p.t.c.48....`...R0...)...@......R.t C....X.....C.P...%CBH..@.R.....f.[.(t....C..Qh...z.#0...Z..l..`O8.......28......p.\|..O...X.?......:..0...FB.x$..!.....i@......H...[..EE1PL........V.6..Q.P..>.U.(j...MFk......t,:....FW........8.....c.1...L.&........9...a..X.:.....r.bl1..{.{.{.;.}.#.tp.8_\<N.+.U.Zp'pWp.

C:\ElitechLogWin\Resource\is-AQK0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	4.893413503903754
Encrypted:	false
SSDEEP:	12:TMHd1qSB0KLzQ5KcN/P8TABtN/HAKtN/aTAA6tN/n9AQtN/WAVtN/YBTANtN/ptJ:2dFLzQ5KcR86XUY9RRemco3xDisPXx35
MD5:	D70215265F3E18CFF6B0BE9038354E0E
SHA1:	A693C62F6739B770E7495F99CAD4DDBECCADF260
SHA-256:	893A7DAF3158DF0341993EC2BD3DBFF98FC34BB6463327E4E7ED4EC357DDF9A9
SHA-512:	E610B469F0524DEA12FD02D98C33210D88620FC94504883CC4E1AE489C3B3C71C284BBC336F727FF9236E30FA531D8929E23F3779E5B7FA134BE002BA0FE863E
Malicious:	false
Preview:	<?xml version="1.0" encoding="gb2312"?>...<System>....<softwareVersion>V6.4.6</softwareVersion>....<softType>Conventional</softType>....<companyName>ElitechLog</companyName>....<emailAdd></emailAdd>....<showGuide>False</showGuide>....<hardSerial>.... .<Version hardSerialInitial="5" softwareSerial="EF5"></Version>.... .<Version hardSerialInitial="6" softwareSerial="EF6"></Version>.... .<Version hardSerialInitial="7" softwareSerial="EF7"></Version>.... .<Version hardSerialInitial="8" softwareSerial="EF8"></Version>.... .<Version hardSerialInitial="9" softwareSerial="EF9"></Version>.... .<Version hardSerialInitial="A" softwareSerial="EFA"></Version>.... .<Version hardSerialInitial="B" softwareSerial="EFB"></Version>.... .<Version hardSerialInitial="C" softwareSerial="EFC"></Version>.... .<Version hardSerialInitial="D" softwareSerial="EFD"></Version>.... .<Version hardSerialInitial="E" softwareSerial="EFE"></Version>.... .<Version hardSerialInitial="F" softwareSerial="EFF"></Version>.... .

C:\ElitechLogWin\Resource\is-G7PA2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.951607188342787
Encrypted:	false
SSDEEP:	3:LAACZEUhNc5sNRqyGPmpGDivxUJyGPmrQGRAUz8S4jA1oO4Qln:0r/bcmv8mogZ8mrFmoD4jA1FNln
MD5:	02EABE32FA74F61AAEAEF51B4D01E04C
SHA1:	ABADD47FC1049F74262B2905419CFEAC854DA48F
SHA-256:	2A3A5B8287B4DB67C83A44B6896476BAC37A4556ECE173A927BD7EF70AB73B33
SHA-512:	AC62C365385B59AC675A0600BEA416B5BCEE031883520B5BAC67F14A6D29B83D559607BB5760F0037CA5BEB8BE2D835E1E37ADAB9B9803774CA7919E41E74991
Malicious:	false
Preview:	[System]..Type=1..ProgramName=ElitechLog..Version=V6.4.6..Icon=\Images\Icons\elitech.ico..Trademark=\Images\Icons\elitechLogo.png..Website=http://www.elitechlog.com..CloudPlatform=

C:\ElitechLogWin\Resource\is-JLT7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 154 x 138, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6516
Entropy (8bit):	7.948773810881862
Encrypted:	false
SSDEEP:	192:JXBYCp0nsAXXCu/hlZP/+/Uk6Q7YnRu4jxcF:BKnFnz/hn/+ck6ZRu4jxQ
MD5:	8EAF4AA1134BBF4BE2D1481187784A09
SHA1:	02362B1B770DBE17E203F3F3C22E963350E18D09
SHA-256:	A88D101698BA411B35DF8AE24A7767A16351221C1EB75A84E055031A39492261
SHA-512:	E9725773650A83584D2B7EF301B231124356AF2DF2B860BC784C8C24442670D7647CA504CFC2E4BA7DBBFB0938B86DEF9A86CDBD3382C7AEDED1C90B3CEE78F4
Malicious:	false
Preview:	.PNG........IHDR.............R)S.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...5iCCPsRGB IEC61966-2.1..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1...:L1

C:\ElitechLogWin\Resource\is-TOH61.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 154 x 138, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	4254
Entropy (8bit):	7.924013497920226
Encrypted:	false
SSDEEP:	96:kYZdoxBCZdVki/lAsCmvJBNJSRPOUj0bhxJe56UMpsX:kYZdoGjVkYlAs7R4POy6Ns
MD5:	C03789DA7288BE786CDD4AB572539E3C
SHA1:	4EA20A0EFB447785B3880BFFF4DF203EC6924E0D
SHA-256:	E8D0CEBEDDCB73E687CEDC55DCAF457B31CDA171CF88278341D726EA66A60118
SHA-512:	66B5E81071086D65A139D5D9B5A8D9E58E88B370BF70D35A9EFEEC0C1463793A6345CEC7297E04E1353ABBD928CA1E2D42AEC08C4608E7D0476C35151C24AC41
Malicious:	false
Preview:	.PNG........IHDR..............K......sRGB.........gAMA......a.....pHYs..........o.d...3IDATx^..p.e....G...&.W-P.@.h[..Kl......wp.....=.9.f.....y.sn.p.-P.R.7..C.Z.."P.M.f.M.{_.G....f..d....../.........FQT..T..2.@.))d..B.))d..B.))d..B.))bz.....~.g....U..a...ICy<..V,9...p...U....q.P..W?...7...S]....X....O...in.qR."-M..a.0.8i.a.8........................]..Y.E......?...v..s.WW.8..'.$\....Ft.@=dH.....a...:...7..z/_.q$$i..K?........0.....}...G.e..@...^Bvt.8..%.s....2...e..9...Gw.=..h.L...2..{...\|...@.;.,[..%@.}..K.....q.Y..\...a.?...Gy..hF..;~...@.;..y..$n........d:...%~$.Q$......K.@..z5\.Mb.E..@.\p...J!....$.Q....Xt.F.F........8.F'..k...Q!\...N...4:I..S.`..q...%...%N..i.xj.P#6..4...\|.5.p..N\.4......QA].~=...6..B..w..g...&...v.''.+.[.Ye.Xa.;.....>~..d:..6....(u.$i4Q\....H.h.].,e...H.h.].$.U...:0$..qp...L'HEJF..%..`+......R'@.F..%..N@B.Mh...:..j4.]....H8..p..J' ..J.%@@...0*...au.DnTJ........\.b.. B..s...N@........EQW./..K@.t.bot....f........3....K@L

C:\ElitechLogWin\Resource\noAlarm.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	7.766388850618031
Encrypted:	false
SSDEEP:	48:f5X+NeI5d99C1xzOUWYnsVRhNi71nxOlwF8ipfCpVhnbTeuaW38cqsZ:f5XZGd99Yzfls1Ni71HFrpfChVq8
MD5:	0D7FBA89C6C02938D01F4B64C18F0F6A
SHA1:	113F4C0A16076198CFCA6CB384ABE9879A6F676C
SHA-256:	BDB83E34580E070C5F62252EDA600499DC6B2F118262E58702267A46FCE6A186
SHA-512:	8D19C4A42E9F7C3D56313E3E79E747C8ED75F18BF558D7738B570A359A67A63F6A8C5302811D0EC45EDE6A59DAD312D91C0F9459C0175CCB51BAE5E86664B2DC
Malicious:	false
Preview:	.PNG........IHDR.............P..w...7iCCPsRGB IEC61966-2.1..x...wTS....7.P.....khR.H..H..1..J..."6DTpDQ...2(...C.."...Q....D.qp...Id...y.....~k....g.}.......LX....X......g`......l..p..B..F...\|.l....... ...?.......Y"1.P......\...8=W.%.O..4M.0J."Y.2V.s.,[\|..e.9.2.<..s..e...'.9....`......2.&c.tI.@.o..\|N6.(....sSdl-c.(2.-.y..H._../X........Z..$...&\S........M...0.7.#.1..Y..r.f..Y.ym..";.8980m-m.(..]....v.^....D....W~.....e....mi..]..P....`/....u.}q..\|^R..,g+...\K..k)/......C_\|.R....ax.8.t1C^7nfz.D....p.......u....$../.ED.L L..[.....B.@...............X..!.@~..(*. .{d+..}..G.........}W.L...$..cGD2..Q...Z.4 .E@..@...............A(..q`1.....D .........`'..u..4.6p.t.c.48....`...R0...)...@......R.t C....X.....C.P...%CBH..@.R.....f.[.(t....C..Qh...z.#0...Z..l..`O8.......28......p.\|..O...X.?......:..0...FB.x$..!.....i@......H...[..EE1PL........V.6..Q.P..>.U.(j...MFk......t,:....FW........8.....c.1...L.&........9...a..X.:.....r.bl1..{.{.{.;.}.#.tp.8_\<N.+.U.Zp'pWp.

C:\ElitechLogWin\Resource\ok.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 154 x 138, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6516
Entropy (8bit):	7.948773810881862
Encrypted:	false
SSDEEP:	192:JXBYCp0nsAXXCu/hlZP/+/Uk6Q7YnRu4jxcF:BKnFnz/hn/+ck6ZRu4jxQ
MD5:	8EAF4AA1134BBF4BE2D1481187784A09
SHA1:	02362B1B770DBE17E203F3F3C22E963350E18D09
SHA-256:	A88D101698BA411B35DF8AE24A7767A16351221C1EB75A84E055031A39492261
SHA-512:	E9725773650A83584D2B7EF301B231124356AF2DF2B860BC784C8C24442670D7647CA504CFC2E4BA7DBBFB0938B86DEF9A86CDBD3382C7AEDED1C90B3CEE78F4
Malicious:	false
Preview:	.PNG........IHDR.............R)S.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...5iCCPsRGB IEC61966-2.1..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1...:L1

C:\ElitechLogWin\Resources\is-HB3QV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	7.472964855468155
Encrypted:	false
SSDEEP:	48:GwqNn2SDKJ3NsYjCbHvzm4/EESKRJMolFnFipZO2Lb:u26ajCbHvrXS4GgFFipc8b
MD5:	3719D6A45168E15359AD9CCD294B910F
SHA1:	E054B9021B2F7657903DC74DF35D8A2A8630A3EE
SHA-256:	B8FA13256491020BFA59B4715F9261806BA888EFA060AA8CB8DED6D4D30F4322
SHA-512:	F04E255FBACF361957D4C1ACD123A1031C1982D27BA4B745A8FB30B6F9B98714DD070EB47D1548DC431B941401C252BC0F1A23F65B4865D717476668B34503E7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:EE4D982F58FF11E2919AC3449BEB7907" xmpMM:DocumentID="xmp.did:EE4D983058FF11E2919AC3449BEB7907"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE4D982D58FF11E2919AC3449BEB7907" stRef:documentID="xmp.did:EE4D982E58FF11E2919AC3449BEB7907"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>vR\.....IDATx..[L.e...\vv.."...Pb..K.$.....Xl..Iy...1..4...."b..M.1.Tkb4..i.(<.R...B.[K..R.].2.s.<.sF..].J..9......

C:\ElitechLogWin\Resources\is-LIPIV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	7.7895978350852415
Encrypted:	false
SSDEEP:	24:3zRpfRxvAQVcsiG+UpqECtfCmiDAgkya1AhdPmlPfHGOsOWV9DIC+Adc:3zR3xvA8nqRLiDAzyauhdPmlP/GOsOMq
MD5:	2A28C6C339C752BF9E6712F1E2B90531
SHA1:	9E657FC97BF0197291482FB4E37088B9518932A6
SHA-256:	DD18B457CC63EBBE846303F67A86622E44AAF7ED86A56444ED3D6E26BD169F9B
SHA-512:	3BC051689AB27A8DD6A398406A101AE004A3A32B28DB5CFA362C72E737F447FF84414603451CF42A1281804882F30A3CD3C82863FAB439ECDE3DBCCB4061E00E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...#IDATx..V[l.U.......m....A.Q.C+..ZA..bI4.3....h...B .....C...A..J...Q..H.i.j..R.]z.......N.n.;.[.p6...9g.w.....gRJ....1..wu......%.En.(.4..U1......=...m.Z.....z...\.1.4.~..{zd..HA....?.E...326c./].U;.u..U...UV....5:?,..[.N=]W....PS..h<..a?.....^.\|I.[.~o.X.....g.M.y....C.F..}q.T.............,:.<.E...P.p..0........h.......~.j.r.........L..]u7v^.W<.....z.j.......h..~>:>{..,.......p@O'.-...I0<....%s.<....\.....1.VF.....3.:..E..\....,T..1..........1`...(........Q.O....G$}C1L1.s.(..\. -AQ...IY..L....!..~.t.....ASsC....ZW....a....r.X.[V.&.$..<LFA..x....w.e.......w...\|..4.fC.?.......:."...y..}N.5.?.hG...u...F...aC.7-d.9.@...:`@J...G.;......5..@..z8q.;t@..17......x...t...~'......@'nB..fL0qq.(...`2%!.W..$<..4..E......L.nf(SsJ.k.U..\@H....Cx.B./Cj.4.......:sh.,....<..J.....o...<.......iSB...,X....b....C.h.tj.....$...,..b...5.9.}....N...Z.14..p....C..z..o.qS8MG.)7.z..KpZ

C:\ElitechLogWin\Resources\is-OASR0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	7.478146033453535
Encrypted:	false
SSDEEP:	48:GwqNn2SGyGNJ3NZDKIFSWHj3XTMnDiVbHFWQK4wZa7n9QNyAfC:u2lyGhZDpgWzXCuVTFW3a79QNyA6
MD5:	85A14890244626B22543E2D25597BB7F
SHA1:	E458849658A8E343E508C60E4406A9A4F018FEE7
SHA-256:	4A6FA52012DF145A958D446E709AB75D9C12D2BE65392BB68FD020B2CE6B1A5D
SHA-512:	2CFA2DB3F911E9D89B849CBAE64B21CF05279BA126C4E8EDCBC2B6431F41FB5998C5EDC05E730C6AC747536A7F2AF78F10F25F93AD7E5DB366B3869DB064B688
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DE745B0758FF11E2B21E9BE2D27BA3CF" xmpMM:DocumentID="xmp.did:DE745B0858FF11E2B21E9BE2D27BA3CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE745B0558FF11E2B21E9BE2D27BA3CF" stRef:documentID="xmp.did:DE745B0658FF11E2B21E9BE2D27BA3CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>EFY.....IDATx..Wmh[U.~...m..&]?...h.v8Y-*..."smae.!.)...)S..c[:.?...?....q62.c+h+..ZV....vssK?....{\|...Hj..t.z.s.9.

C:\ElitechLogWin\Resources\script_export.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	7.478146033453535
Encrypted:	false
SSDEEP:	48:GwqNn2SGyGNJ3NZDKIFSWHj3XTMnDiVbHFWQK4wZa7n9QNyAfC:u2lyGhZDpgWzXCuVTFW3a79QNyA6
MD5:	85A14890244626B22543E2D25597BB7F
SHA1:	E458849658A8E343E508C60E4406A9A4F018FEE7
SHA-256:	4A6FA52012DF145A958D446E709AB75D9C12D2BE65392BB68FD020B2CE6B1A5D
SHA-512:	2CFA2DB3F911E9D89B849CBAE64B21CF05279BA126C4E8EDCBC2B6431F41FB5998C5EDC05E730C6AC747536A7F2AF78F10F25F93AD7E5DB366B3869DB064B688
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DE745B0758FF11E2B21E9BE2D27BA3CF" xmpMM:DocumentID="xmp.did:DE745B0858FF11E2B21E9BE2D27BA3CF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE745B0558FF11E2B21E9BE2D27BA3CF" stRef:documentID="xmp.did:DE745B0658FF11E2B21E9BE2D27BA3CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>EFY.....IDATx..Wmh[U.~...m..&]?...h.v8Y-*..."smae.!.)...)S..c[:.?...?....q62.c+h+..ZV....vssK?....{\|...Hj..t.z.s.9.

C:\ElitechLogWin\Resources\script_import.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	7.472964855468155
Encrypted:	false
SSDEEP:	48:GwqNn2SDKJ3NsYjCbHvzm4/EESKRJMolFnFipZO2Lb:u26ajCbHvrXS4GgFFipc8b
MD5:	3719D6A45168E15359AD9CCD294B910F
SHA1:	E054B9021B2F7657903DC74DF35D8A2A8630A3EE
SHA-256:	B8FA13256491020BFA59B4715F9261806BA888EFA060AA8CB8DED6D4D30F4322
SHA-512:	F04E255FBACF361957D4C1ACD123A1031C1982D27BA4B745A8FB30B6F9B98714DD070EB47D1548DC431B941401C252BC0F1A23F65B4865D717476668B34503E7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:EE4D982F58FF11E2919AC3449BEB7907" xmpMM:DocumentID="xmp.did:EE4D983058FF11E2919AC3449BEB7907"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE4D982D58FF11E2919AC3449BEB7907" stRef:documentID="xmp.did:EE4D982E58FF11E2919AC3449BEB7907"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>vR\.....IDATx..[L.e...\vv.."...Pb..K.$.....Xl..Iy...1..4...."b..M.1.Tkb4..i.(<.R...B.[K..R.].2.s.<.sF..].J..9......

C:\ElitechLogWin\Resources\script_save.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	7.7895978350852415
Encrypted:	false
SSDEEP:	24:3zRpfRxvAQVcsiG+UpqECtfCmiDAgkya1AhdPmlPfHGOsOWV9DIC+Adc:3zR3xvA8nqRLiDAzyauhdPmlP/GOsOMq
MD5:	2A28C6C339C752BF9E6712F1E2B90531
SHA1:	9E657FC97BF0197291482FB4E37088B9518932A6
SHA-256:	DD18B457CC63EBBE846303F67A86622E44AAF7ED86A56444ED3D6E26BD169F9B
SHA-512:	3BC051689AB27A8DD6A398406A101AE004A3A32B28DB5CFA362C72E737F447FF84414603451CF42A1281804882F30A3CD3C82863FAB439ECDE3DBCCB4061E00E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...#IDATx..V[l.U.......m....A.Q.C+..ZA..bI4.3....h...B .....C...A..J...Q..H.i.j..R.]z.......N.n.;.[.p6...9g.w.....gRJ....1..wu......%.En.(.4..U1......=...m.Z.....z...\.1.4.~..{zd..HA....?.E...326c./].U;.u..U...UV....5:?,..[.N=]W....PS..h<..a?.....^.\|I.[.~o.X.....g.M.y....C.F..}q.T.............,:.<.E...P.p..0........h.......~.j.r.........L..]u7v^.W<.....z.j.......h..~>:>{..,.......p@O'.-...I0<....%s.<....\.....1.VF.....3.:..E..\....,T..1..........1`...(........Q.O....G$}C1L1.s.(..\. -AQ...IY..L....!..~.t.....ASsC....ZW....a....r.X.[V.&.$..<LFA..x....w.e.......w...\|..4.fC.?.......:."...y..}N.5.?.hG...u...F...aC.7-d.9.@...:`@J...G.;......5..@..z8q.;t@..17......x...t...~'......@'nB..fL0qq.(...`2%!.W..$<..4..E......L.nf(SsJ.k.U..\@H....Cx.B./Cj.4.......:sh.,....<..J.....o...<.......iSB...,X....b....C.h.tj.....$...,..b...5.9.}....N...Z.14..p....C..z..o.qS8MG.)7.z..KpZ

C:\ElitechLogWin\System.Data.SQLite.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	5.986830361762183
Encrypted:	false
SSDEEP:	6144:i4xtlRVuJ4v4pFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbZ:Xljdv4pFNFaFeFOFwcGF6cmFWc0FWc8O
MD5:	03311A06B7516B5A998F5966BD45088A
SHA1:	DD560C6B59D8ABFA88DCC6EB438E1E58E3D90BBC
SHA-256:	05D68A3CD4D52C268880B0C6BC32ACEA60FB674E9B72B1CAD5C0D08600C3D021
SHA-512:	B4167F57F463396B0B24C44E77274FF077B673DEC5179E65BA3F432AB180A511DD3A58E659EAEDB48356D23BACF326B7E69DDBCADC4C371880F93A975A2613C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y...........!.....<..........n[... ...`....... ....................................@................................. [..K....`.. ............................Y............................................... ............... ..H............text...t;... ...<.................. ..`.rsrc... ....`.......>..............@..@.reloc...............D..............@..B................P[......H...........T...................P .......................................'K.K.z;\s....%`.[.7w.>.P,...x...S`St..&......lG:k4.).MQ.........?.../.l....R..6...On..h'6.5..^..I.}I........Tw..taU.._:.(......}......{....:.(......}......{....r.(......}......}......}......0..5........-..~.....o.....X...r....~.......o......o .........6..(....(...."..(.....0..T........~!...("...-..-.~#...../....+...X....($...-..-.~#.....r........(%...~.......o&...Z.~....2..~.........

C:\ElitechLogWin\System.Data.SQLite.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.904553105011224
Encrypted:	false
SSDEEP:	12:TMGJldRms9wuCkI4RpE3zryErFyNCcOKLbFdyQKiL3xm:3z/m4wuCI+7rF4Q5
MD5:	384DD2C6F11FFBEBC4A8FD0F7D255C9E
SHA1:	38E352300655DDD8EECCF45C1DAFD5B8616F6CD2
SHA-256:	8A4A9908D893122D427354AA6E5973CAE4165D175DB3E3C48F7F37730C04D997
SHA-512:	1E71AD56475708BE6CB24FB652853F4A815999928AA249E3DBDC50D124169CE19AEC6D54935F9F1853A2CF7D4E65854A05582C3C870A1A03C7C68F81BBDC2D46
Malicious:	false
Preview:	<?xml version="1.0"?>.. .. .. System.Data.SQLite.dll.config -.. .. WARNING: This XML configuration file is intended for use within the NuGet.. * package directories only. Please do not copy this file to any of.. * the build output directories because it could interfere with the.. * native library pre-loading feature... .. Written by Joe Mistachkin... * Released to the public domain, use at your own risk!.. *..-->..<configuration>.. <appSettings>.. <add key="PreLoadSQLite_BaseDirectory".. value="%PreLoadSQLite_AssemblyDirectory%\..\..\build\%PreLoadSQLite_TargetFramework%" />.. </appSettings>..</configuration>..

C:\ElitechLogWin\System.Data.SQLite.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1022648
Entropy (8bit):	4.4916290583565655
Encrypted:	false
SSDEEP:	6144:uXGJ3h2KpJT550jFnKKKFu6HXU1IFt3TCqmh+Ye:v
MD5:	C2EA76799CE4DBDF86A5F59B87538860
SHA1:	F051C12808E6266C7D3CD0E1D85995C6A5E10768
SHA-256:	0E418CDD53059FD53E041EF64DC530D4A46EED3BD9705191F2E86125967E9B70
SHA-512:	FB6CEC136CA76A540FF10F2DDD3C9B084D8A861E7775A2F8C80F22F2007A24B7DB5CF39E83B468FABC519CF8F0FDFC3CB808C1615DC2B4F2BCFD78B58B81727A
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.Data.SQLite</name>.. </assembly>.. <members>.. <member name="T:System.Data.SQLite.AssemblySourceIdAttribute">.. <summary>.. Defines a source code identifier custom attribute for an assembly.. manifest... </summary>.. </member>.. <member name="M:System.Data.SQLite.AssemblySourceIdAttribute.#ctor(System.String)">.. <summary>.. Constructs an instance of this attribute class using the specified.. source code identifier value... </summary>.. <param name="value">.. The source code identifier value to use... </param>.. </member>.. <member name="P:System.Data.SQLite.AssemblySourceIdAttribute.SourceId">.. <summary>.. Gets the source code identifier value... </summary>.. </member>.. <member name="T:System.Data.SQLite.Assembl

C:\ElitechLogWin\Tem.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x96, 8 bits/pixel
Category:	dropped
Size (bytes):	3774
Entropy (8bit):	4.877872612057642
Encrypted:	false
SSDEEP:	48:2mo3pYN6H7JnFYROQMCgSAGa+gW4ckZB2cY4HCbglVVJ/6MvsmyJrHcKLYs:2moYNAUR5M3S4S8NlVH/6SKr8KL1
MD5:	40FA1A942F6FB424A9A0D841ACDB4FFD
SHA1:	A04B4769C0C464699BCF884C89B168B6F5E30923
SHA-256:	08DAF372EFBF0349E0E78B42826122A5C8FC741541C906AC9EFD4858E745BCEB
SHA-512:	595AA4C364C6F7752CE26399CB95ED8AE6F1DCE401EDDDA9866917BF982C075427673C790062D8ABDF2DFCDEBF56098AD13A6FCC96C6F7C54E62055FCBA002B7
Malicious:	false
Preview:	......0`..............(...0...`................................................................................................................................................................................................................................................................................................................w..f..w..w..w..f..f..w..f..U..U...w...w..w...w...w...wf..fD..wf..wU..wD..fU..fD..wD..fU..DD..U3..f3..f"..f3..f"..U3..U"..D3..D"..U3..U"..D3..D"..U...U...D...ww..fD..wU..fU..UU..UD..ww..ff..fD..UD..DD..UD..DD..f3..U3..D"..U"..D"..D...D...D3..D"..D3..D...3"..3...3"..3"..3...3..w...U...D...D...w.w.wf..fw..ff..ff..ww..ff..UU..UD..DU..3U..3D.."U..www.wwf.wfw.fww.fwf.ffw.fff.ffU.fUf.wUD.fUD.Uff.UfU.UUw.UUf.DUw.DDf.UUU.UDD.DUD.wD".fD3.UD".DD3.D3f.D3U.D3D.f3".w"..f3..f"..f"..U33.U3".U"".D"".U3..U"..U"..D"..U...D...3Df.3DU.33f.33U.3"D."3D.""D.".D...D.333.3"3.3""."33.""3.""".3"..3"..".".3...3...3..."..."..."..."...."3..""...

C:\ElitechLogWin\UpgradeFile\Local.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.007517745138765
Encrypted:	false
SSDEEP:	6:nGpERnEWl445K/HRfGyqgPyzDHLD1kPIFAyHRYAyPTER+:nGq5ZBK/HRf/vak+AyHRYAyQs
MD5:	4509C4779AE2C99ED065D3D2D4ED24BF
SHA1:	10D2DA2B8F2C83018FC16111659511A0F52823EB
SHA-256:	F9CD7EC844FDA2016CB4F685A810CCBFC32D1ABC99C49B2232F42E12571938DE
SHA-512:	507BFCC016462D70F7083B4F150B6666597398965CD9492CB83E65D5DD644D1D5289A4AD7B7E58D6E08992E08EC62E9D1481B38E4972C2ECA5A056928685EC44
Malicious:	false
Preview:	.<LocalUpdate>.. <LastUdpate>2023/10/08 0:0:0</LastUdpate>.. <LocalVersion>6.4.6</LocalVersion>.. <ServerUpdateUrl>http://et-app-update.e-elitech.com/Windows/ElitechLog/Server.xml</ServerUpdateUrl>.. <IgnoreVersion>6.4.6</IgnoreVersion>..</LocalUpdate>

C:\ElitechLogWin\UpgradeFile\is-TQC4A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.007517745138765
Encrypted:	false
SSDEEP:	6:nGpERnEWl445K/HRfGyqgPyzDHLD1kPIFAyHRYAyPTER+:nGq5ZBK/HRf/vak+AyHRYAyQs
MD5:	4509C4779AE2C99ED065D3D2D4ED24BF
SHA1:	10D2DA2B8F2C83018FC16111659511A0F52823EB
SHA-256:	F9CD7EC844FDA2016CB4F685A810CCBFC32D1ABC99C49B2232F42E12571938DE
SHA-512:	507BFCC016462D70F7083B4F150B6666597398965CD9492CB83E65D5DD644D1D5289A4AD7B7E58D6E08992E08EC62E9D1481B38E4972C2ECA5A056928685EC44
Malicious:	false
Preview:	.<LocalUpdate>.. <LastUdpate>2023/10/08 0:0:0</LastUdpate>.. <LocalVersion>6.4.6</LocalVersion>.. <ServerUpdateUrl>http://et-app-update.e-elitech.com/Windows/ElitechLog/Server.xml</ServerUpdateUrl>.. <IgnoreVersion>6.4.6</IgnoreVersion>..</LocalUpdate>

C:\ElitechLogWin\app.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3353
Entropy (8bit):	5.87931299109583
Encrypted:	false
SSDEEP:	48:3C30NtuBLkzYcr/9qCWyNVXEV1VlX8ZNOGtjx8PQ6tL4wfT4M+bUg63h:y30Nt8kzYcZqC9xExlCf8PQ6tLz7aS
MD5:	F37D7983A4FD8A1C985982AD75F531DB
SHA1:	7420C2A1219BE6DAA6D4111C1C791C3784EE1E0B
SHA-256:	7F086BA9C51D406BEFD7F53CF8867880473B58D81984A4228E9938B39BB4BBD3
SHA-512:	39753D0CD3423CDBF7041707017D78050E814F4F70CD749FFC3A51259115C4E70277F0C24FD0DFCA1B0169C8F5A98048916D92B71A0F89B669A849C4C9E3472D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app" />.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">.. UAC ...... ...... Windows .............. ........ requestedExecutionLevel ...n.. <requestedExecutionLevel level="asInvoker" uiAccess="false" />.. <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />.. <requestedExecutionLevel level="highestAvailable" uiAccess="false" />.... .. requestedExecutionLevel ................. ............................. ..... -->.. <requestedExecutio

C:\ElitechLogWin\elitech.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	2.6137809854184813
Encrypted:	false
SSDEEP:	48:9OUMfMQoo8Hl29utsIvXv/+TQgW6kX3FMt1Le0otP:9cX8F29umYvvRVUBeTP
MD5:	C7289EE7D185C1D8E535E2E3DC7162C3
SHA1:	92FA40B8036F0D78582565695ECCDAE9EBD8BE76
SHA-256:	8BB97D0A3226702D409D8D399499993CC0E6B73C0D398046E8E5A526013C468B
SHA-512:	AF4C7FE927655639EBF7CC05FCBBB61DA3F3B9A7657028A274735F052A4BC5FE22B725D4FC211AB1286BBB3C76D987D84A91CA53398A31100BFAA44CBD570045
Malicious:	false
Preview:	......00.... ..%......(...0...`..... ......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\en.pdf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	1629521
Entropy (8bit):	7.794730280439886
Encrypted:	false
SSDEEP:	24576:Z2wdGQnS0ispf9YPn/so8UNJJUIk2J0PEEEJfNmrhF93i/iQ:M8FnCHFjNJJh0ElkJlQ
MD5:	31EEAF66E0AE0C487DE1AC50C25096E4
SHA1:	9CA36CD3C0B7FCA5143C0EDCAB42BEB997AD6F5E
SHA-256:	1A8BCEEA036DC138A13C96F77AA3AFB8451AA3D3F9181B6DFD2F7BA6F2EEB9D6
SHA-512:	195E26482F83200A4CD48AB9C23D5453671375C50CF29C42B939687F7EFA7B3185A272B6333E97003104DBE93CE5CE1D7C7FBFD78E4EB060C0B3E00586E24364
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091224+01'12') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091224+01'12') /Producer () /SourceModified (D:20231008091224+01'12') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 283>>..stream..x..R.J.1.}....,8.\&......\|P.~.h.P....T[...H..=9..s2...d.K....u.6...h...7o...>.!1\|)..2.e....i!u....,.h.#X. ....Y[X~....K{...K.H.kuKd.]^..#''<.SA.+h .I.Q.5.p.fY=^ .G..d..MzPS.....$V.ju.[..$uq&)a.....BaS..N.>....WT...l.@n.c...u.....H...cO.?.:.C..E..<...<...m.U...;.[i........endstream.endobj.14 0 obj.<</Annots [22 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 4

C:\ElitechLogWin\es.pdf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	1629521
Entropy (8bit):	7.794730280439886
Encrypted:	false
SSDEEP:	24576:Z2wdGQnS0ispf9YPn/so8UNJJUIk2J0PEEEJfNmrhF93i/iQ:M8FnCHFjNJJh0ElkJlQ
MD5:	31EEAF66E0AE0C487DE1AC50C25096E4
SHA1:	9CA36CD3C0B7FCA5143C0EDCAB42BEB997AD6F5E
SHA-256:	1A8BCEEA036DC138A13C96F77AA3AFB8451AA3D3F9181B6DFD2F7BA6F2EEB9D6
SHA-512:	195E26482F83200A4CD48AB9C23D5453671375C50CF29C42B939687F7EFA7B3185A272B6333E97003104DBE93CE5CE1D7C7FBFD78E4EB060C0B3E00586E24364
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091224+01'12') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091224+01'12') /Producer () /SourceModified (D:20231008091224+01'12') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 283>>..stream..x..R.J.1.}....,8.\&......\|P.~.h.P....T[...H..=9..s2...d.K....u.6...h...7o...>.!1\|)..2.e....i!u....,.h.#X. ....Y[X~....K{...K.H.kuKd.]^..#''<.SA.+h .I.Q.5.p.fY=^ .G..d..MzPS.....$V.ju.[..$uq&)a.....BaS..N.>....WT...l.@n.c...u.....H...cO.?.:.C..E..<...<...m.U...;.[i........endstream.endobj.14 0 obj.<</Annots [22 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 4

C:\ElitechLogWin\is-0ANOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.904553105011224
Encrypted:	false
SSDEEP:	12:TMGJldRms9wuCkI4RpE3zryErFyNCcOKLbFdyQKiL3xm:3z/m4wuCI+7rF4Q5
MD5:	384DD2C6F11FFBEBC4A8FD0F7D255C9E
SHA1:	38E352300655DDD8EECCF45C1DAFD5B8616F6CD2
SHA-256:	8A4A9908D893122D427354AA6E5973CAE4165D175DB3E3C48F7F37730C04D997
SHA-512:	1E71AD56475708BE6CB24FB652853F4A815999928AA249E3DBDC50D124169CE19AEC6D54935F9F1853A2CF7D4E65854A05582C3C870A1A03C7C68F81BBDC2D46
Malicious:	false
Preview:	<?xml version="1.0"?>.. .. .. System.Data.SQLite.dll.config -.. .. WARNING: This XML configuration file is intended for use within the NuGet.. * package directories only. Please do not copy this file to any of.. * the build output directories because it could interfere with the.. * native library pre-loading feature... .. Written by Joe Mistachkin... * Released to the public domain, use at your own risk!.. *..-->..<configuration>.. <appSettings>.. <add key="PreLoadSQLite_BaseDirectory".. value="%PreLoadSQLite_AssemblyDirectory%\..\..\build\%PreLoadSQLite_TargetFramework%" />.. </appSettings>..</configuration>..

C:\ElitechLogWin\is-1T4ET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	2.6137809854184813
Encrypted:	false
SSDEEP:	48:9OUMfMQoo8Hl29utsIvXv/+TQgW6kX3FMt1Le0otP:9cX8F29umYvvRVUBeTP
MD5:	C7289EE7D185C1D8E535E2E3DC7162C3
SHA1:	92FA40B8036F0D78582565695ECCDAE9EBD8BE76
SHA-256:	8BB97D0A3226702D409D8D399499993CC0E6B73C0D398046E8E5A526013C468B
SHA-512:	AF4C7FE927655639EBF7CC05FCBBB61DA3F3B9A7657028A274735F052A4BC5FE22B725D4FC211AB1286BBB3C76D987D84A91CA53398A31100BFAA44CBD570045
Malicious:	false
Preview:	......00.... ..%......(...0...`..... ......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\is-22UOT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6712
Entropy (8bit):	3.943977525490966
Encrypted:	false
SSDEEP:	96:UeIX+tip7uemP4I3bYFE6H6IyYrL9Cu6d0CGeSG4qb6Yiigx9BGWsy:Uegda4Irx6HhGLbqig7Lsy
MD5:	69B6FEC924C30042D329AE56CA8925CC
SHA1:	54E8D7D9004C8C819FE2E8BF7A1306BCBDD5ECBF
SHA-256:	45494CE819C1B5C21ABB72DC47A0CA36807E0ED74CE55B631DA174C77A9B24DB
SHA-512:	A6BC866712C2B6D2EC115341DE6EC5B352505FFF159AF967B03D27AD767164271F147780639E836A4DA54F4B2B688591EDF1374802CB5F7340062AEE9B341ABC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................l.......^...............Rich............PE..L...c..B ..........!......................... ....@..........................P..................................................<....0..8....................@..D...@...T...............................................4............................text............................... ..`.data...`.... ......................@....rsrc...8....0......................@..@.reloc..p....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\is-3KLJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2235904
Entropy (8bit):	6.630820579741516
Encrypted:	false
SSDEEP:	49152:Ifon77ZdDDCll2TQuKQ9nRLcOYxyUQxvs:0onzDDClITQuTnayUQx
MD5:	E5596A3451E809F94891BD0EFDD61535
SHA1:	5D03782915D63CC1EDFDE40DE6954DA84E162430
SHA-256:	1CA91FA639AA83E0198A581B5787147F8DCDA7053B726C3FC2640667BE855005
SHA-512:	E4AAAC1609B0BC322F7C831B5A9C329EE518998E42CEB0E35082FF2A9067A58CC121D6864F4A6EB0551E45FC1509A35E0DD5CB1BD0C7AD9F59A3C576587C1F62
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ElitechLogWin\is-3KLJS.tmp, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0e.........."...0...!..:........!.. ... "...@.. ........................"...........`.................................p.!.O.... "..6...................`".....8.!.............................................. ............... ..H............text...p.!.. ....!................. ..`.rsrc....6... "..8....!.............@..@.reloc.......`".......".............@..B..................!.....H....... ....................G...........................................0............ 4......(.....+...0.................o.....+..B.........o........0..1.........o....r...p $...........%...%....o ...t.....+.......o!....".(".......0...........r!..p"...A.~#...($...}.....r!..p"...A....s%...($...}.....~....r-..p.(&...}.....~8...rC..p('...-.~8...rI..p('...+..}.....((.......}......{...."...@s)...}......}......}.......}......{...."...As)...}......{...."...A... ....s%...s*...}

C:\ElitechLogWin\is-4QHAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.756472592247957
Encrypted:	false
SSDEEP:	6144:jrQweBeGtSV41QJDsTDDTXamJ0Zu3xLV/m9suGOKtM3:jgBlS4YsbXalu3fm9vGZM
MD5:	746F909970274C71991F63325BA3AB4E
SHA1:	CDC53CD41C8CE8D356B057A3ECE483F9116FDDA9
SHA-256:	5C0449B8A9B65F36CB6A66C1AC9379F8F62A75DFCCFDA67FE959563177B3C5B0
SHA-512:	5552710EC9C648385E72EC650F437A99C28116C69198DD94268AC5308F1D7FC279C6CD7F563AE7EB5B1F0D0BC29E83104EA4404A7401A644F3E29AC471CAB2B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......K...........!..................... ........@.. .......................@..............................................`...L.......t.................... ....................................................................... ..H............text...?.... ...................... ..`.rsrc...t...........................@..@.reloc....... ......................@..B................H........<.............L...H0..........................................&...(.......0.. ........(........(........(......}........>.(.......(.....0..d.........o....:.....s....8.....}......(......}.....(....s....}......}......}......(.....r...p}......j(........rr...p.{.....{.........(........0..J........{....9......}....r]..ps....z..}.....{....:......}.....{....:......}............{......{....9......}....r]..ps....z..@......}....r...ps....z..}.......{!..."..}!........{"...

C:\ElitechLogWin\is-4RFOM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows icon resource - 1 icon, 48x96, 8 bits/pixel
Category:	dropped
Size (bytes):	3774
Entropy (8bit):	4.877872612057642
Encrypted:	false
SSDEEP:	48:2mo3pYN6H7JnFYROQMCgSAGa+gW4ckZB2cY4HCbglVVJ/6MvsmyJrHcKLYs:2moYNAUR5M3S4S8NlVH/6SKr8KL1
MD5:	40FA1A942F6FB424A9A0D841ACDB4FFD
SHA1:	A04B4769C0C464699BCF884C89B168B6F5E30923
SHA-256:	08DAF372EFBF0349E0E78B42826122A5C8FC741541C906AC9EFD4858E745BCEB
SHA-512:	595AA4C364C6F7752CE26399CB95ED8AE6F1DCE401EDDDA9866917BF982C075427673C790062D8ABDF2DFCDEBF56098AD13A6FCC96C6F7C54E62055FCBA002B7
Malicious:	false
Preview:	......0`..............(...0...`................................................................................................................................................................................................................................................................................................................w..f..w..w..w..f..f..w..f..U..U...w...w..w...w...w...wf..fD..wf..wU..wD..fU..fD..wD..fU..DD..U3..f3..f"..f3..f"..U3..U"..D3..D"..U3..U"..D3..D"..U...U...D...ww..fD..wU..fU..UU..UD..ww..ff..fD..UD..DD..UD..DD..f3..U3..D"..U"..D"..D...D...D3..D"..D3..D...3"..3...3"..3"..3...3..w...U...D...D...w.w.wf..fw..ff..ff..ww..ff..UU..UD..DU..3U..3D.."U..www.wwf.wfw.fww.fwf.ffw.fff.ffU.fUf.wUD.fUD.Uff.UfU.UUw.UUf.DUw.DDf.UUU.UDD.DUD.wD".fD3.UD".DD3.D3f.D3U.D3D.f3".w"..f3..f"..f"..U33.U3".U"".D"".U3..U"..U"..D"..U...D...3Df.3DU.33f.33U.3"D."3D.""D.".D...D.333.3"3.3""."33.""3.""".3"..3"..".".3...3...3..."..."..."..."...."3..""...

C:\ElitechLogWin\is-64LH2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2235904
Entropy (8bit):	6.630820579741516
Encrypted:	false
SSDEEP:	49152:Ifon77ZdDDCll2TQuKQ9nRLcOYxyUQxvs:0onzDDClITQuTnayUQx
MD5:	E5596A3451E809F94891BD0EFDD61535
SHA1:	5D03782915D63CC1EDFDE40DE6954DA84E162430
SHA-256:	1CA91FA639AA83E0198A581B5787147F8DCDA7053B726C3FC2640667BE855005
SHA-512:	E4AAAC1609B0BC322F7C831B5A9C329EE518998E42CEB0E35082FF2A9067A58CC121D6864F4A6EB0551E45FC1509A35E0DD5CB1BD0C7AD9F59A3C576587C1F62
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ElitechLogWin\is-64LH2.tmp, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0e.........."...0...!..:........!.. ... "...@.. ........................"...........`.................................p.!.O.... "..6...................`".....8.!.............................................. ............... ..H............text...p.!.. ....!................. ..`.rsrc....6... "..8....!.............@..@.reloc.......`".......".............@..B..................!.....H....... ....................G...........................................0............ 4......(.....+...0.................o.....+..B.........o........0..1.........o....r...p $...........%...%....o ...t.....+.......o!....".(".......0...........r!..p"...A.~#...($...}.....r!..p"...A....s%...($...}.....~....r-..p.(&...}.....~8...rC..p('...-.~8...rI..p('...+..}.....((.......}......{...."...@s)...}......}......}.......}......{...."...As)...}......{...."...A... ....s%...s*...}

C:\ElitechLogWin\is-6NPH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1244), with CRLF line terminators
Category:	dropped
Size (bytes):	72572
Entropy (8bit):	4.539288617422733
Encrypted:	false
SSDEEP:	768:7Y7u0fmzC5BJUEs32nPSV/K791pNirZI5Hrl+n3GoUMN+yP:8BJxs32nPSV/K791pNircHrl+WoHNR
MD5:	EE31F007ED9E84678B54437D91F4BE85
SHA1:	6B8499B8860574936285CE76DC6A5457C6264BBA
SHA-256:	1552138AC6F486BAD9D014798FF146AD6CD5B87A4EDBA127BCCDF2319118B08F
SHA-512:	54EA64675474DCB79964481BB743CE5158D0ED80D9C8B1B92C756DED78D11AB8790BD85A4B69136ECC6D9729277827D640A70EBF7330F42B20A306A2F67B774F
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>NGettext</name>.. </assembly>.. <members>.. <member name="T:NGettext.Catalog">.. <summary>.. Represents a Gettext catalog instance... </summary>.. </member>.. <member name="F:NGettext.Catalog.CONTEXT_GLUE">.. <summary>.. Context glue (<EOT> symbol).. </summary>.. </member>.. <member name="P:NGettext.Catalog.CultureInfo">.. <summary>.. Current catalog locale... </summary>.. </member>.. <member name="P:NGettext.Catalog.Translations">.. <summary>.. Loaded raw translation strings... (msgctxt<EOT>)msgid => msgstr[].. </summary>.. </member>.. <member name="P:NGettext.Catalog.PluralRule">.. <summary>.. Gets or sets current plural form rule... </summary>.. </member>..

C:\ElitechLogWin\is-7A1RE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1202385
Entropy (8bit):	6.367633063809205
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxytm:3qTytRFk6ek1L1
MD5:	321A206D27DE7ECE191C8AD9F09E5B72
SHA1:	B678673E1CE3D76F521B4365354AC779E2A80BE6
SHA-256:	1A07C9E9B358B1E0A6E04010093A20382B5E3B6514BEC22EC1CB74F8D5803A2F
SHA-512:	19554EDA2941467C8F2FDAF95D3A64AEBE3AB0095FE765C1AEA6247BFF3B4B5FD714FF291B53F60A2C27AC7333FF241BECE084A81751F95FF0E295B86A6414E8
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\ElitechLogWin\is-7B027.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.782247250134279
Encrypted:	false
SSDEEP:	96:5+tH6RbkMa27CvSVeGQGgKRLYm4vJDpLN/yZkO4rsaKRUAe3ipMnQSmXDT/2:5caRI27C8zRkth/DrXKRUAeIMQjzC
MD5:	CCE714483B5568F140C904C30A38BCE6
SHA1:	8C668F156D612B677BD4408F4578B8E6CB31104C
SHA-256:	9EAFBEC3431A3DDC072D870DD71F96D4FD421EFF27B3F855FB29DDE31463803A
SHA-512:	92A947245699D48F7AAEF4340519496CD18F4EA245E0D7D4913BF8E5294E026AA3D7CA47C84772917F9014BA94F086D1DD30078A808F08DE32866D32F6EC9FC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%Z...........!.................4... ...@....... ...............................s....@.................................X4..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........&..\|...................P ......................................x...,..9...p'..P...6A.....z...y......#.b......=.=.+>...i)....!.v..46.x.}..?....Ot5B..8...m.iO....b.}....L+].....H2NN.1......~Z..}.....(...... }....:.(......}......-.s....z..2...2...X..i1.r...ps....z....(....V.-.s....z.....i(........(...."..(......0..J.........X..i1.rq..pr...ps....z....(.......X........X..d....X...d....X...d.....i./.r...pr...ps....z....i.Y(....F....(.... .KgH.....i./.r...p

C:\ElitechLogWin\is-7UN9L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.647891900426496
Encrypted:	false
SSDEEP:	768:M2PFJNrJ2rSFeTBzbRhhRonhSUD3/SZ2WuqO/NYeK:79JFErSUTB5Ronhz3/SUoeK
MD5:	D92437B05B2D2B745E2ABBCFE125D726
SHA1:	6D3242418D0E7CBDEBECD1A47EB59558BFF66BB4
SHA-256:	404AA253460521EF376156826CF0549549806E43AC168918FE1232D00E500601
SHA-512:	8941BD78ED6A3BB7A6C52C5A2A970C39992E1FE77B97C45560F68A946DD7FC4CBF17C6FAC1ADCB8F1801EE6AF55A3577B6866F89C933D0A093C25F9C9B8CEB2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W............" ..0.............B.... ........... ....................................@....................................O...................................\...8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................!.......H.......(^...Y...........................................................{...."..}......{...."..}......{....Z.-.r...ps....z..}....2.(....(......(......(.....s....(.....s8....o7...(....6..(....(......0............(......(.......r...p.o....(....rS..p(........................6..s....(....:..s.....(....:...s....(....>...s.....(....Z.-.re..ps....z..o~...&...o....V.(.......o.....(..........o....b.(.........o......(....R..rs..p.(.....o......(......rs..p.(.....o.

C:\ElitechLogWin\is-9A33P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MSVC program database ver 7.00, 512*5383 bytes
Category:	dropped
Size (bytes):	2756096
Entropy (8bit):	4.373355261566474
Encrypted:	false
SSDEEP:	24576:Lnr28BKtz9BiVUqpC0CWcYIAGL1L3Q9BaHMC5Gqae3/Mqu:7r28E7+78JQBdCcUMq
MD5:	F7D5FD526094E5E057D08E04C4669E0F
SHA1:	4A75DBE341AD6E26FCA970C2785F0DE19C74266D
SHA-256:	FE92956CC26FB550A23B2E49F2F12B0583F05C436263475ED75BAE98135C19BD
SHA-512:	4D4F51B8767A0AFF5A305BC2E556857BFD10F9C1FF7C28E30A1CA9B18EE74961F428AADD865621F3D3CB37F31AB19DC149F26DBADE561010E8D0006C4A24786E
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS................_..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\is-9M3SJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	5.986830361762183
Encrypted:	false
SSDEEP:	6144:i4xtlRVuJ4v4pFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbZ:Xljdv4pFNFaFeFOFwcGF6cmFWc0FWc8O
MD5:	03311A06B7516B5A998F5966BD45088A
SHA1:	DD560C6B59D8ABFA88DCC6EB438E1E58E3D90BBC
SHA-256:	05D68A3CD4D52C268880B0C6BC32ACEA60FB674E9B72B1CAD5C0D08600C3D021
SHA-512:	B4167F57F463396B0B24C44E77274FF077B673DEC5179E65BA3F432AB180A511DD3A58E659EAEDB48356D23BACF326B7E69DDBCADC4C371880F93A975A2613C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y...........!.....<..........n[... ...`....... ....................................@................................. [..K....`.. ............................Y............................................... ............... ..H............text...t;... ...<.................. ..`.rsrc... ....`.......>..............@..@.reloc...............D..............@..B................P[......H...........T...................P .......................................'K.K.z;\s....%`.[.7w.>.P,...x...S`St..&......lG:k4.).MQ.........?.../.l....R..6...On..h'6.5..^..I.}I........Tw..taU.._:.(......}......{....:.(......}......{....r.(......}......}......}......0..5........-..~.....o.....X...r....~.......o......o .........6..(....(...."..(.....0..T........~!...("...-..-.~#...../....+...X....($...-..-.~#.....r........(%...~.......o&...Z.~....2..~.........

C:\ElitechLogWin\is-ACGED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	5.683688089372797
Encrypted:	false
SSDEEP:	3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
MD5:	C8164876B6F66616D68387443621510C
SHA1:	7A9DF9C25D49690B6A3C451607D311A866B131F4
SHA-256:	40B3D590F95191F3E33E5D00E534FA40F823D9B1BB2A9AFE05F139C4E0A3AF8D
SHA-512:	44A6ACCC70C312A16D0E533D3287E380997C5E5D610DBEAA14B2DBB5567F2C41253B895C9817ECD96C85D286795BBE6AB35FD2352FDDD9D191669A2FB0774BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.K...........!......... ......^.... ........@.. .......................@............@.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\is-DH4PP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1282560
Entropy (8bit):	5.961335291442756
Encrypted:	false
SSDEEP:	24576:T1fExYh340V04QVi1VKWAJz3Cjd++BCGOruRuQa/thHIA0928Kxp:T1fExYe0V03VPJz3Cjdx/CpkA048K
MD5:	B5DC130D491BBE0C95220AAC7BC00712
SHA1:	F2D4EA54AE7EDAD8CF96B5064A2BA4A79B4F5E84
SHA-256:	5465A41228621A30268E8059BFE4151F510FC805D75A8FEB7726B8F24912C2D1
SHA-512:	0ECDF1300E938266C421BEADC12A0D89082DEC4D114FD6D4D1D0D27222800350BD0A428ADC70321499A0BACD33543B99AD077FECFF912FC25261ECA075174469
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.N...........!................N.... ........@.. ..............................b.....@.....................................W.......H............................................................................ ............... ..H............text...T.... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B................0.......H.......................<..l^..P .........................................{.+.....2..?^..]...&p..N...._.(..X.3..Z....;d..].......Y..z.....M..\........tn..`..'c;.Z..Q..3Ptr.....%.-...0............................................................................................................................................................................................................................ . ....!.!...."."....#.#....$.$....%.%....&.&....'.'....(.

C:\ElitechLogWin\is-EN453.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.0892429116254965
Encrypted:	false
SSDEEP:	384:uLlqpqiKCsiRZKaRfAUNqVI48DagJqtN61fDku8fqcy+LTHZMGLL4:4kU98KINZ5ktMGQ
MD5:	701953731FD51B8109D61939BA8BFAEE
SHA1:	21184C8A12D785B431D870EA2A2776720BCEE894
SHA-256:	4DDF72843EEE74B0E29BFFEDB9C40B721655C1328B82F79F5FDF21D95FC8DA92
SHA-512:	DE51C91E7FC8A92B69B9E3362822B55A4A577FE71902B63DA7CF35732B55971A266BADA81611AAE9781B35658352BDDF73C1DFA6206F02E51278E84267F0769F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......N...........!.....:..........nY... ...`....@.. ....................................@..................................Y..S....................................`............................................... ............... ..H............text...t9... ...:.................. ..`.sdata.......`.......>..............@....rsrc................@..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\is-F2Q6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	1629521
Entropy (8bit):	7.794730280439886
Encrypted:	false
SSDEEP:	24576:Z2wdGQnS0ispf9YPn/so8UNJJUIk2J0PEEEJfNmrhF93i/iQ:M8FnCHFjNJJh0ElkJlQ
MD5:	31EEAF66E0AE0C487DE1AC50C25096E4
SHA1:	9CA36CD3C0B7FCA5143C0EDCAB42BEB997AD6F5E
SHA-256:	1A8BCEEA036DC138A13C96F77AA3AFB8451AA3D3F9181B6DFD2F7BA6F2EEB9D6
SHA-512:	195E26482F83200A4CD48AB9C23D5453671375C50CF29C42B939687F7EFA7B3185A272B6333E97003104DBE93CE5CE1D7C7FBFD78E4EB060C0B3E00586E24364
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091224+01'12') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091224+01'12') /Producer () /SourceModified (D:20231008091224+01'12') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 283>>..stream..x..R.J.1.}....,8.\&......\|P.~.h.P....T[...H..=9..s2...d.K....u.6...h...7o...>.!1\|)..2.e....i!u....,.h.#X. ....Y[X~....K{...K.H.kuKd.]^..#''<.SA.+h .I.Q.5.p.fY=^ .G..d..MzPS.....$V.ju.[..$uq&)a.....BaS..N.>....WT...l.@n.c...u.....H...cO.?.:.C..E..<...<...m.U...;.[i........endstream.endobj.14 0 obj.<</Annots [22 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 4

C:\ElitechLogWin\is-FCR10.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3166756
Entropy (8bit):	4.624419518720948
Encrypted:	false
SSDEEP:	49152:pRj8IeK+hJoIZy9K01FStXe5yEUBw8Tx/IcoGVc:ZFShC
MD5:	9352880121E419EA991F850EEB98FBD7
SHA1:	F7CEEA17E4FECF52CE9AFDB1921AD330C578F5A1
SHA-256:	9994314DC43C6091F335DC6645293C06034227BE09FDF3A689EE91B99A067F76
SHA-512:	7269F88B29C1FF9F69B903D31FEA5F0C4F7D22C29E434B3283A1714B78CD41F4C46841A4D2F786F917E6D9D197523B811446DC344B7F6D502B9EBD8B3EDC0586
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>itextsharp</name>.. </assembly>.. <members>.. <member name="T:iTextSharp.text.Anchor">.. <summary>.. An Anchor can be a reference or a destination of a reference... </summary>.. <remarks>.. An Anchor is a special kind of <see cref="T:iTextSharp.text.Phrase"/>... It is constructed in the same way... </remarks>.. <seealso cref="T:iTextSharp.text.Element"/>.. <seealso cref="T:iTextSharp.text.Phrase"/>.. </member>.. <member name="T:iTextSharp.text.Phrase">.. <summary>.. A Phrase is a series of Chunks... </summary>.. <remarks>.. A Phrase has a main Font, but some chunks.. within the phrase can have a Font that differs from the.. main Font. All the Chunks in a Phrase.. have the same leading... </remarks>..

C:\ElitechLogWin\is-G9K3Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	5.010777093927904
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOodBQV7VKXRAmIRMNHjFHr0lUfEyhTRyAEDDQIMOov:TMVBd1InV7VQ7VJdfEyFRyAqDQIm
MD5:	DDC25AEFCAE9826CCE1754C2C89E959D
SHA1:	36899490B8B0CF36AE8A1477468F3884C0CC9664
SHA-256:	F8AD17C37D444521B3905CCBD75EA6CB6E3D2763B16EB56B2E1AA4274173E614
SHA-512:	4C52E02E4E6A17FD36714E3769D34BC14675D47BE0322B14F4BBB13268C34DFE647A37DB7DF0DE7D8C31494BF878B597EDF85913E7FB648CB0D993E89FB5D611
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/></startup></configuration>..

C:\ElitechLogWin\is-GDL1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	525824
Entropy (8bit):	5.856165679472465
Encrypted:	false
SSDEEP:	12288:3MRKBWOcZJToYL7fxWpJd7YxQ+kBadQd:cRmU7xq7Yx0BadQd
MD5:	07E04FD870CEE6F9994921B5AF243B7F
SHA1:	0EA4611EEEE3736963CB718132099624BFEBF460
SHA-256:	52CC6DDF77990FBAAAE4DB593F655610652133CEEADB32262C122D8C9EEA1BAD
SHA-512:	4639A7F77F7A9CAFA38C632332DD5085355623F3D84475374241A64BD110569F504086B479B519E90DDBD471D4A5034239418EBC03277424212E0E6698E64418
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HP..........." ..0.................. ... ....... .......................`......-e....@.................................:...O.... ..d....................@......l...8............................................ ............... ..H............text...L.... ...................... ..`.rsrc...d.... ......................@..@.reloc.......@......................@..B................n.......H........Q..l.............................................................{...."..}......($...:.($.....}...."..(%.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(....0...........{)......(....-....(....*6..s..

C:\ElitechLogWin\is-HM61C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3353
Entropy (8bit):	5.87931299109583
Encrypted:	false
SSDEEP:	48:3C30NtuBLkzYcr/9qCWyNVXEV1VlX8ZNOGtjx8PQ6tL4wfT4M+bUg63h:y30Nt8kzYcZqC9xExlCf8PQ6tLz7aS
MD5:	F37D7983A4FD8A1C985982AD75F531DB
SHA1:	7420C2A1219BE6DAA6D4111C1C791C3784EE1E0B
SHA-256:	7F086BA9C51D406BEFD7F53CF8867880473B58D81984A4228E9938B39BB4BBD3
SHA-512:	39753D0CD3423CDBF7041707017D78050E814F4F70CD749FFC3A51259115C4E70277F0C24FD0DFCA1B0169C8F5A98048916D92B71A0F89B669A849C4C9E3472D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app" />.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">.. UAC ...... ...... Windows .............. ........ requestedExecutionLevel ...n.. <requestedExecutionLevel level="asInvoker" uiAccess="false" />.. <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />.. <requestedExecutionLevel level="highestAvailable" uiAccess="false" />.... .. requestedExecutionLevel ................. ............................. ..... -->.. <requestedExecutio

C:\ElitechLogWin\is-JET2T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	604672
Entropy (8bit):	5.958390269882712
Encrypted:	false
SSDEEP:	6144:X+n+hEmw+9s0Bv5pllUsQY4FIjWRm4kHVf120UzquGDFTGpQsA/RwqWd:O+X+0Bv5pllUsQv2jWA/TkqLwo
MD5:	F777533E9C54A5B5AEEFD8353659FBFC
SHA1:	2A0D9AFF4A0B3A8E13AD0E3F3D659194E9D3BC72
SHA-256:	7164DAE2B677907DD9F9EF37147BC2571D0A954A5C5A00F047C7F5C1C1B99DE8
SHA-512:	85CE75B14B585BD8B37AEDAB6B0B3FE01C56B1DE4EE0B507FE8FFF7292C76ECFD8BD7519B6D6E98AA549F3394C628CAF5B98ED78D4ECCB4F1B5F0FC094FC4C4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y...........!.....2..........~P... ...`....... ....................................@.................................,P..O....`...............................N............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B................`P......H.......L.......................P .......................................a.\Gq......>%.Liv.4.k..:T.LE...C&3..,.WyP.............$b.srw...t.pQ6W.`qHy....U.......]}.4..F.....mOv..<$.[g].........-.D.<..(!.....(!...:.(!.....(......{...."..}......(!.....(!...:.(!.....(......{...."..}....&...(....V.(!.....(......(......{...."..}......{...."..}...."..(....:.(!.....(......{...."..}......(!...:.(!.....(......{...."..}....&...(....&...(....&...(....*V.(!...

C:\ElitechLogWin\is-K0HRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1130496
Entropy (8bit):	5.808910233677625
Encrypted:	false
SSDEEP:	24576:w7gTUIeYcQuFOzye+nW1aB2hrDUv36Rp1ZIu13:MuxzyazIu
MD5:	3AF100CAD8EF53BBF7C36520FA39D0C8
SHA1:	065DCB0192E8B35EC8F3BD730A4C1C9B83F7422E
SHA-256:	0D6AB9A9CF481012BC48C4722B577E97C086D2BCFC99722AA24799833D95CA79
SHA-512:	2A5EC7076297F6C1621B6DB4399BDDB37F90DB59503948C5280743DB9BC8A0C4D89FE7FA3B85DCEDE1CF5E4E55B28D3FFB3D1E105AACBCF7C4998F63CCD0A169
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.P...........!......... .......)... ...@....... ....................................@.................................L)..O....@..P....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...P....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\is-KN84P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527790
Entropy (8bit):	4.60374428445931
Encrypted:	false
SSDEEP:	6144:XqYRirv6df0/IuHtpOVIeR0R+CRFo9TA82mzKj+sJjoqoyO185QyMYFLsgflf:2
MD5:	E7841470F741868A4E959295F255E951
SHA1:	49771219B04B7B92F39A356BA91F82F334D49FA8
SHA-256:	A31F40DADCAEDB110605197ADA84C4BA803A0EB67BF90A24CA1EAECFDBCDB254
SHA-512:	F5D99827FEF3800727A658170E996DA9B3178CBF5D108DE6B7E2FDD8BF4C7307FD75A8B008FBA73EF921EF3E4DD2B545B2D2B52F68286B551548F645A4AF6E7D
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\ElitechLogWin\is-LJB4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.839823542304099
Encrypted:	false
SSDEEP:	384:FEBnJwk/59hJsgmKYBOz3dzOMzFBzxiapBazqccrXS7VJwk/59hJFL0QGZVYs9MS:1cdcL0jYB5D/
MD5:	4E77D269A9AF0D326AC0326DF0FD92CA
SHA1:	F9C7C23A3F3B4ED68DB367D023DB2A4A2A64A883
SHA-256:	AE20EDD43D3E62BDD780816E21D696AB917076B7618B57D9F4FF515E66BC8229
SHA-512:	8130733D8FE303A207852E2D6B9C220CC2DB7E3B62BC148BD0346DCE4A7D19E414A8193ED284095BD3360909BCC5CBC297BA1041F5832CB66BE008074D7CCE4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y.........." ..0..F...........d... ........... ....................................@.................................8d..O....................................c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................ld......H........6..D...........HT..............................................".(.........0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.*....0...........s....}.....s....}.....s....}.....s....}......}....."....}......}......}......}.....(.......(.......,...........+....,`...(.....JX..(........,.....(......(....Y

C:\ElitechLogWin\is-NS0HU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1022648
Entropy (8bit):	4.4916290583565655
Encrypted:	false
SSDEEP:	6144:uXGJ3h2KpJT550jFnKKKFu6HXU1IFt3TCqmh+Ye:v
MD5:	C2EA76799CE4DBDF86A5F59B87538860
SHA1:	F051C12808E6266C7D3CD0E1D85995C6A5E10768
SHA-256:	0E418CDD53059FD53E041EF64DC530D4A46EED3BD9705191F2E86125967E9B70
SHA-512:	FB6CEC136CA76A540FF10F2DDD3C9B084D8A861E7775A2F8C80F22F2007A24B7DB5CF39E83B468FABC519CF8F0FDFC3CB808C1615DC2B4F2BCFD78B58B81727A
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.Data.SQLite</name>.. </assembly>.. <members>.. <member name="T:System.Data.SQLite.AssemblySourceIdAttribute">.. <summary>.. Defines a source code identifier custom attribute for an assembly.. manifest... </summary>.. </member>.. <member name="M:System.Data.SQLite.AssemblySourceIdAttribute.#ctor(System.String)">.. <summary>.. Constructs an instance of this attribute class using the specified.. source code identifier value... </summary>.. <param name="value">.. The source code identifier value to use... </param>.. </member>.. <member name="P:System.Data.SQLite.AssemblySourceIdAttribute.SourceId">.. <summary>.. Gets the source code identifier value... </summary>.. </member>.. <member name="T:System.Data.SQLite.Assembl

C:\ElitechLogWin\is-OLJUM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	2329326
Entropy (8bit):	7.833605385493755
Encrypted:	false
SSDEEP:	24576:J90Mwi5+ayHjvL8WJfp6T9zqC1yVbZTEOUKEEEEEEHVR7gdAJCOt85W2:J9fiDvwJJFsVVEONracCr5W2
MD5:	DACB9E09B8CF4FCE40E112931F986DCA
SHA1:	65CAA21B892A2BE09B803AC183147C6CB2F5CB69
SHA-256:	B1D02750157691A91DEF35AF84399E519748305E48DC9BB4CCDB351C9EA08F0E
SHA-512:	FEA8091A3B3941616AF6E25945F2CDE1E9F0801506D99B905FECE44F6C1670A87FC2E0FDD14D2305671C06A4C4043C0FCE5ECF37C51677ACFC289AF7DB3AD7ED
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091049+01'10') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091049+01'10') /Producer () /SourceModified (D:20231008091049+01'10') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT14 14 0 R /FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 215>>..stream..x....jB1....y.\.V.69MA.#z.a...{........_{t..F.M..i....T..1tN.?.p..........G G....\r[r?.._7.o.o...fC6.b._0.q....}\|r..!+9...0.>.E..z.y5..o.h.h.&JlHJ.!6......u!.../........O.WwbR.7M..9V4..&.f.....i..?r.c...endstream.endobj.19 0 obj.<</Annots [32 0 R 34 0 R 36 0 R 38 0 R 40 0 R 42 0 R 44 0 R 46 0 R 48 0 R 50 0 R 52 0 R 54 0 R 56 0 R 58 0 R 60 0 R 62 0 R 64 0 R

C:\ElitechLogWin\is-PNGP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1373710
Entropy (8bit):	4.55524192185406
Encrypted:	false
SSDEEP:	6144:hbD3OCes/IyBgBxF+PJFqiS1CCM8KPbfHxCUIHMVc66z+VbC1h6:RGoPH
MD5:	84AB210D707F87002A080B69B99A9679
SHA1:	4743795AD876299229B061ADEBD239FCBCCBC088
SHA-256:	0456ED4DA2E3D2CC7C93329569A80C929F665E4325264A32EEC84D1D35A873DE
SHA-512:	1E643875D80FBA7CA4731D7097C982BFD6BC0B31FF2C7A6C781603CE1FF7505E7AC968306CEAE77767C875E1B44B005365A742F87F5C8F1D60302EAAAAF8A540
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>NLog</name>.. </assembly>.. <members>.. <member name="T:JetBrains.Annotations.CanBeNullAttribute">.. <summary>.. Indicates that the value of the marked element could be <c>null</c> sometimes,.. so the check for <c>null</c> is necessary before its usage.. </summary>.. <example><code>.. [CanBeNull] public object Test() { return null; }.. public void UseTest() {.. var p = Test();.. var s = p.ToString(); // Warning: Possible 'System.NullReferenceException'.. }.. </code></example>.. </member>.. <member name="T:JetBrains.Annotations.NotNullAttribute">.. <summary>.. Indicates that the value of the marked element could never be <c>null</c>.. </summary>.. <example><code>.. [NotNull] public object Foo() {.. return null;

C:\ElitechLogWin\is-QK9HR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	2329326
Entropy (8bit):	7.833605385493755
Encrypted:	false
SSDEEP:	24576:J90Mwi5+ayHjvL8WJfp6T9zqC1yVbZTEOUKEEEEEEHVR7gdAJCOt85W2:J9fiDvwJJFsVVEONracCr5W2
MD5:	DACB9E09B8CF4FCE40E112931F986DCA
SHA1:	65CAA21B892A2BE09B803AC183147C6CB2F5CB69
SHA-256:	B1D02750157691A91DEF35AF84399E519748305E48DC9BB4CCDB351C9EA08F0E
SHA-512:	FEA8091A3B3941616AF6E25945F2CDE1E9F0801506D99B905FECE44F6C1670A87FC2E0FDD14D2305671C06A4C4043C0FCE5ECF37C51677ACFC289AF7DB3AD7ED
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091049+01'10') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091049+01'10') /Producer () /SourceModified (D:20231008091049+01'10') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT14 14 0 R /FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 215>>..stream..x....jB1....y.\.V.69MA.#z.a...{........_{t..F.M..i....T..1tN.?.p..........G G....\r[r?.._7.o.o...fC6.b._0.q....}\|r..!+9...0.>.E..z.y5..o.h.h.&JlHJ.!6......u!.../........O.WwbR.7M..9V4..&.f.....i..?r.c...endstream.endobj.19 0 obj.<</Annots [32 0 R 34 0 R 36 0 R 38 0 R 40 0 R 42 0 R 44 0 R 46 0 R 48 0 R 50 0 R 52 0 R 54 0 R 56 0 R 58 0 R 60 0 R 62 0 R 64 0 R

C:\ElitechLogWin\is-S32UM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	1629521
Entropy (8bit):	7.794730280439886
Encrypted:	false
SSDEEP:	24576:Z2wdGQnS0ispf9YPn/so8UNJJUIk2J0PEEEJfNmrhF93i/iQ:M8FnCHFjNJJh0ElkJlQ
MD5:	31EEAF66E0AE0C487DE1AC50C25096E4
SHA1:	9CA36CD3C0B7FCA5143C0EDCAB42BEB997AD6F5E
SHA-256:	1A8BCEEA036DC138A13C96F77AA3AFB8451AA3D3F9181B6DFD2F7BA6F2EEB9D6
SHA-512:	195E26482F83200A4CD48AB9C23D5453671375C50CF29C42B939687F7EFA7B3185A272B6333E97003104DBE93CE5CE1D7C7FBFD78E4EB060C0B3E00586E24364
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091224+01'12') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091224+01'12') /Producer () /SourceModified (D:20231008091224+01'12') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 283>>..stream..x..R.J.1.}....,8.\&......\|P.~.h.P....T[...H..=9..s2...d.K....u.6...h...7o...>.!1\|)..2.e....i!u....,.h.#X. ....Y[X~....K{...K.H.kuKd.]^..#''<.SA.+h .I.Q.5.p.fY=^ .G..d..MzPS.....$V.ju.[..$uq&)a.....BaS..N.>....WT...l.@n.c...u.....H...cO.?.:.C..E..<...<...m.U...;.[i........endstream.endobj.14 0 obj.<</Annots [22 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 4

C:\ElitechLogWin\is-U1RFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13460
Entropy (8bit):	4.655725288707219
Encrypted:	false
SSDEEP:	96:GyicYjvhngezYjvhnr11JwPTmhU/ZQRIqVnYjvhngeYnYjvhnr1BKQp946+1Fh4y:GQ2vPz2v51LMJuRD2vPO2v51liYqp
MD5:	12C7B0C346B425AC37EB5C6D14389FAC
SHA1:	124E90890689CCD26AF25F0B3DE8C86DC96F421E
SHA-256:	F47DE51A346632D16DC9850FBC8FB1C2542A9C10A48E395C652395F7F058955F
SHA-512:	CADE6CDEB193531D2D7F4F119ABC2D6BCDC67661123FE455E4C0FAE6BB4DFEE88C80C62F2CF998441212971B1E9D51AD8E29B63F859BFAAB79053A0C90EB0529
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Crc32.NET</name>.. </assembly>.. <members>.. <member name="T:Force.Crc32.Crc32CAlgorithm">.. <summary>.. Implementation of CRC-32C (Castagnoli)... This class supports several convenient static methods returning the CRC as UInt32... </summary>.. </member>.. <member name="M:Force.Crc32.Crc32CAlgorithm.#ctor">.. <summary>.. Initializes a new instance of the <see cref="T:Force.Crc32.Crc32CAlgorithm"/> class. .. </summary>.. </member>.. <member name="M:Force.Crc32.Crc32CAlgorithm.#ctor(System.Boolean)">.. <summary>.. Initializes a new instance of the <see cref="T:Force.Crc32.Crc32CAlgorithm"/> class. .. </summary>.. <param name="isBigEndian">Should return bytes result as big endian or little endian</param>.. </member>.. <member name="M:Force.Crc32.Crc32CAlgor

C:\ElitechLogWin\is-UK8OS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	1629521
Entropy (8bit):	7.794730280439886
Encrypted:	false
SSDEEP:	24576:Z2wdGQnS0ispf9YPn/so8UNJJUIk2J0PEEEJfNmrhF93i/iQ:M8FnCHFjNJJh0ElkJlQ
MD5:	31EEAF66E0AE0C487DE1AC50C25096E4
SHA1:	9CA36CD3C0B7FCA5143C0EDCAB42BEB997AD6F5E
SHA-256:	1A8BCEEA036DC138A13C96F77AA3AFB8451AA3D3F9181B6DFD2F7BA6F2EEB9D6
SHA-512:	195E26482F83200A4CD48AB9C23D5453671375C50CF29C42B939687F7EFA7B3185A272B6333E97003104DBE93CE5CE1D7C7FBFD78E4EB060C0B3E00586E24364
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091224+01'12') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091224+01'12') /Producer () /SourceModified (D:20231008091224+01'12') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 283>>..stream..x..R.J.1.}....,8.\&......\|P.~.h.P....T[...H..=9..s2...d.K....u.6...h...7o...>.!1\|)..2.e....i!u....,.h.#X. ....Y[X~....K{...K.H.kuKd.]^..#''<.SA.+h .I.Q.5.p.fY=^ .G..d..MzPS.....$V.ju.[..$uq&)a.....BaS..N.>....WT...l.@n.c...u.....H...cO.?.:.C..E..<...<...m.U...;.[i........endstream.endobj.14 0 obj.<</Annots [22 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 4

C:\ElitechLogWin\is-VJMDN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4063232
Entropy (8bit):	6.170184411696085
Encrypted:	false
SSDEEP:	49152:xXeg4pT+JdEHfhPe9IkC2zBu7IGgtyqtd5QHqGm7XL5V6R23c9GAYb3kT:xYHfhuIYcEd5Uv
MD5:	CA60CB8F0577E6E98134162D12BCC6B0
SHA1:	40002FAB71A25F1494A47C3206B4EB8C2E11F56D
SHA-256:	8F2C180B833AB7E36FBF69EFD1E8BDF7AFDE2771C4D387DA2D095229B4F29BD3
SHA-512:	8D9816E2D789E7FDCC4050658CA40D36AF23EA55497F4E32EF549E407B39DFEE96CA98CD0D0C423621C5007C55FDBDE1D3F76E6F2B29A5DD3021DBD93FC5EFC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......X...........!......=.. ........=.. ....>...... .......................@>.......>...@.................................l.=.O.....>...................... >...................................................... ............... ..H............text.....=.. ....=................. ..`.rsrc.........>.......=.............@..@.reloc....... >.......=.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\itextsharp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4063232
Entropy (8bit):	6.170184411696085
Encrypted:	false
SSDEEP:	49152:xXeg4pT+JdEHfhPe9IkC2zBu7IGgtyqtd5QHqGm7XL5V6R23c9GAYb3kT:xYHfhuIYcEd5Uv
MD5:	CA60CB8F0577E6E98134162D12BCC6B0
SHA1:	40002FAB71A25F1494A47C3206B4EB8C2E11F56D
SHA-256:	8F2C180B833AB7E36FBF69EFD1E8BDF7AFDE2771C4D387DA2D095229B4F29BD3
SHA-512:	8D9816E2D789E7FDCC4050658CA40D36AF23EA55497F4E32EF549E407B39DFEE96CA98CD0D0C423621C5007C55FDBDE1D3F76E6F2B29A5DD3021DBD93FC5EFC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......X...........!......=.. ........=.. ....>...... .......................@>.......>...@.................................l.=.O.....>...................... >...................................................... ............... ..H............text.....=.. ....=................. ..`.rsrc.........>.......=.............@..@.reloc....... >.......=.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\itextsharp.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3166756
Entropy (8bit):	4.624419518720948
Encrypted:	false
SSDEEP:	49152:pRj8IeK+hJoIZy9K01FStXe5yEUBw8Tx/IcoGVc:ZFShC
MD5:	9352880121E419EA991F850EEB98FBD7
SHA1:	F7CEEA17E4FECF52CE9AFDB1921AD330C578F5A1
SHA-256:	9994314DC43C6091F335DC6645293C06034227BE09FDF3A689EE91B99A067F76
SHA-512:	7269F88B29C1FF9F69B903D31FEA5F0C4F7D22C29E434B3283A1714B78CD41F4C46841A4D2F786F917E6D9D197523B811446DC344B7F6D502B9EBD8B3EDC0586
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>itextsharp</name>.. </assembly>.. <members>.. <member name="T:iTextSharp.text.Anchor">.. <summary>.. An Anchor can be a reference or a destination of a reference... </summary>.. <remarks>.. An Anchor is a special kind of <see cref="T:iTextSharp.text.Phrase"/>... It is constructed in the same way... </remarks>.. <seealso cref="T:iTextSharp.text.Element"/>.. <seealso cref="T:iTextSharp.text.Phrase"/>.. </member>.. <member name="T:iTextSharp.text.Phrase">.. <summary>.. A Phrase is a series of Chunks... </summary>.. <remarks>.. A Phrase has a main Font, but some chunks.. within the phrase can have a Font that differs from the.. main Font. All the Chunks in a Phrase.. have the same leading... </remarks>..

C:\ElitechLogWin\locales\de.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	46740
Entropy (8bit):	5.876220242343995
Encrypted:	false
SSDEEP:	768:HrJZexc3k6aP2Eq4lRt0K4Td/JYZRcV9MdOraYgG86pgRgf:Hr906c2Eq4ln0K4gZqVGdeaYgG3MA
MD5:	C5AC165D44C2959E885CA735A2FD5B84
SHA1:	9B090C241B9691B2F3E5028D3ECCF6395AC2F26F
SHA-256:	7ED35C2E47E588293B4AAC85558B228C4BA8358CBCAF3DD39120A2E593152F93
SHA-512:	4E66AA7F1AB717AF2DEE4FBA0854B6F2D0EC60B663A1E3539801DD0D2F21334A0AD1E6E69DC2209A50210BEC4D4FCEDFF45E69D10D6FB504446E27544E6EA574
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\en.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	43172
Entropy (8bit):	5.8677682392315305
Encrypted:	false
SSDEEP:	768:HrAYVUcOxtRLT1Eq4lRt0K4Td/b1PeS7r/7L7wly1:HrAYFOXtT1Eq4ln0K4xDXn7wly1
MD5:	109CB95E029968C0D7377C77491D38DC
SHA1:	ABED1DCB7BD8F2AFADE52E2ED20540F5FED1DF84
SHA-256:	73D817E05EB5E761C08B957DC101D659BBCD023FA97AAA69EE0A603D763D40C7
SHA-512:	B86F1DB8EDE266EC04089FB7610EE127849642131AA95891B736F8E0628FA03528790133CF3B8E8D327F322595C98521AE1BA3233A911FD1CECAC636633B3360
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\es.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	46994
Entropy (8bit):	5.832065931859638
Encrypted:	false
SSDEEP:	768:HrMUh0sTW/zHEq4lRt0K4Td/k2hpcr05x285DHE:Hr10YwHEq4ln0K4zhpcY5x2yDk
MD5:	AB6EFFA5C2D89C2D1669A62252811C46
SHA1:	3C45167439035717A12D4D4FBD6CB998E783566C
SHA-256:	B397D723632566849AAD9A46287C23BF7255E9548B7FB75E1A92DBDB097026B2
SHA-512:	0D3590F6886DF1AD58334722E2A8795F41C0856B8702EE73FFB97AE2790F5F15C63145EECCC0D8F85F7BDF3F316781170C2E713DAD07D11E158BC6EFBD6D1A39
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\fr.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	48774
Entropy (8bit):	5.845722646765543
Encrypted:	false
SSDEEP:	768:HrgRvDf3fXj/Eq4lRt0K4Td/xnQ3Ygm/cUcu4Tyq3WMR5WmZYLdK4m:Hrgtf3fLEq4ln0K4s3A/cuq3WM71iJI
MD5:	43E160B0D9924524A1E24E6E18BA9DDD
SHA1:	779B01E591B406666012824738BB9523774BB805
SHA-256:	893CD177232A48FD19468264610448F7F215515A78A4553465AB098A8A9C6C43
SHA-512:	CF6F4A7EA5AD0BDC8463DD0DEA80F31CAEECDADB20391BF62F92020AC3920ACB1756C56D1B9D965D5D50A77A6ED9C40E75D1DD8DC4D1F266BA22D22BDAB19AF7
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-0U79H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	43172
Entropy (8bit):	5.8677682392315305
Encrypted:	false
SSDEEP:	768:HrAYVUcOxtRLT1Eq4lRt0K4Td/b1PeS7r/7L7wly1:HrAYFOXtT1Eq4ln0K4xDXn7wly1
MD5:	109CB95E029968C0D7377C77491D38DC
SHA1:	ABED1DCB7BD8F2AFADE52E2ED20540F5FED1DF84
SHA-256:	73D817E05EB5E761C08B957DC101D659BBCD023FA97AAA69EE0A603D763D40C7
SHA-512:	B86F1DB8EDE266EC04089FB7610EE127849642131AA95891B736F8E0628FA03528790133CF3B8E8D327F322595C98521AE1BA3233A911FD1CECAC636633B3360
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-15IDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	40613
Entropy (8bit):	5.761626324873094
Encrypted:	false
SSDEEP:	768:HrrjgHG1QNC6IEq4lRt0K4Td/NInIC/54Cgw5gJS+0LfTVQS/4:HrQHfNClEq4ln0K44nICB4cCJS+0LfKb
MD5:	0E9F2D1A99EBA0E52B0851FAA4F280D0
SHA1:	EC1D4FB2B3039BF5F22A7521A444849ED6B435B9
SHA-256:	6750B63DC7F2BBB5F61754B9E0BEF3264895A7B1309C08E7F112864E1DC8F54E
SHA-512:	1B9DB09A0D4B3D5D209A9520B294CE271926D30B6478E3EF3304C217C454656AE411EC98E1701A9E4286FACD39F0810FC1A5E7D3140CDBC5FADB2AB090EB5DAC
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-1CAND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	46446
Entropy (8bit):	5.858413976390321
Encrypted:	false
SSDEEP:	768:HrvG5JszjwEq4lRt0K4Td/wGVaiQv2Dt6B:HrKJszkEq4ln0K4dValO8B
MD5:	74A144DCF6B85AB4B61E1B4C17A7FB0D
SHA1:	8853A360216CDF459DABF1077A976E432663D016
SHA-256:	642C4E7342CC4B7DAF9DC80A80998821F6982FEEBAAB2E4AC04BE649FD0F717A
SHA-512:	359DE894CADC1604B67EE7F48219C7D5C12D6A41097C01A9219D52896866A338F2206D1FE164EE4DB48B528DB54474918012A0F1A4B6C0857A033EDD7DE5D4F9
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-7C05R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	40646
Entropy (8bit):	5.738734776245266
Encrypted:	false
SSDEEP:	384:HrgVJQ7D10pDxd/3ePt/1cEq4rVvRGWp0spX7soWQPuPA25p5uOBXGXq/roQ6uDe:HrQAWDxkVqEq4lRt0K4Td//59B2+0cyz
MD5:	BE243760BC54F809C92B464168C8E49D
SHA1:	44876D350B9A8EFBB399C06D46F74B4D733D1095
SHA-256:	564780BD53A7EE0CE88855F4EFC0F3794C4C63B63349A109D8C8BFD085A19CE8
SHA-512:	09EEB87EFC5C77E835D0FE2DDCA7752693FD9EDC0C76654AABA2C4AC1E3632D5A8BC3F97AE8F7CAEFC5211BFD276736AC29FCB779AA13A1C6102B182EAC9009A
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-CBI41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	48774
Entropy (8bit):	5.845722646765543
Encrypted:	false
SSDEEP:	768:HrgRvDf3fXj/Eq4lRt0K4Td/xnQ3Ygm/cUcu4Tyq3WMR5WmZYLdK4m:Hrgtf3fLEq4ln0K4s3A/cuq3WM71iJI
MD5:	43E160B0D9924524A1E24E6E18BA9DDD
SHA1:	779B01E591B406666012824738BB9523774BB805
SHA-256:	893CD177232A48FD19468264610448F7F215515A78A4553465AB098A8A9C6C43
SHA-512:	CF6F4A7EA5AD0BDC8463DD0DEA80F31CAEECDADB20391BF62F92020AC3920ACB1756C56D1B9D965D5D50A77A6ED9C40E75D1DD8DC4D1F266BA22D22BDAB19AF7
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-D1H7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	46994
Entropy (8bit):	5.832065931859638
Encrypted:	false
SSDEEP:	768:HrMUh0sTW/zHEq4lRt0K4Td/k2hpcr05x285DHE:Hr10YwHEq4ln0K4zhpcY5x2yDk
MD5:	AB6EFFA5C2D89C2D1669A62252811C46
SHA1:	3C45167439035717A12D4D4FBD6CB998E783566C
SHA-256:	B397D723632566849AAD9A46287C23BF7255E9548B7FB75E1A92DBDB097026B2
SHA-512:	0D3590F6886DF1AD58334722E2A8795F41C0856B8702EE73FFB97AE2790F5F15C63145EECCC0D8F85F7BDF3F316781170C2E713DAD07D11E158BC6EFBD6D1A39
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\is-FOICQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	46740
Entropy (8bit):	5.876220242343995
Encrypted:	false
SSDEEP:	768:HrJZexc3k6aP2Eq4lRt0K4Td/JYZRcV9MdOraYgG86pgRgf:Hr906c2Eq4ln0K4gZqVGdeaYgG3MA
MD5:	C5AC165D44C2959E885CA735A2FD5B84
SHA1:	9B090C241B9691B2F3E5028D3ECCF6395AC2F26F
SHA-256:	7ED35C2E47E588293B4AAC85558B228C4BA8358CBCAF3DD39120A2E593152F93
SHA-512:	4E66AA7F1AB717AF2DEE4FBA0854B6F2D0EC60B663A1E3539801DD0D2F21334A0AD1E6E69DC2209A50210BEC4D4FCEDFF45E69D10D6FB504446E27544E6EA574
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\pt.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	46446
Entropy (8bit):	5.858413976390321
Encrypted:	false
SSDEEP:	768:HrvG5JszjwEq4lRt0K4Td/wGVaiQv2Dt6B:HrKJszkEq4ln0K4dValO8B
MD5:	74A144DCF6B85AB4B61E1B4C17A7FB0D
SHA1:	8853A360216CDF459DABF1077A976E432663D016
SHA-256:	642C4E7342CC4B7DAF9DC80A80998821F6982FEEBAAB2E4AC04BE649FD0F717A
SHA-512:	359DE894CADC1604B67EE7F48219C7D5C12D6A41097C01A9219D52896866A338F2206D1FE164EE4DB48B528DB54474918012A0F1A4B6C0857A033EDD7DE5D4F9
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\zh-TW.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	40613
Entropy (8bit):	5.761626324873094
Encrypted:	false
SSDEEP:	768:HrrjgHG1QNC6IEq4lRt0K4Td/NInIC/54Cgw5gJS+0LfTVQS/4:HrQHfNClEq4ln0K44nICB4cCJS+0LfKb
MD5:	0E9F2D1A99EBA0E52B0851FAA4F280D0
SHA1:	EC1D4FB2B3039BF5F22A7521A444849ED6B435B9
SHA-256:	6750B63DC7F2BBB5F61754B9E0BEF3264895A7B1309C08E7F112864E1DC8F54E
SHA-512:	1B9DB09A0D4B3D5D209A9520B294CE271926D30B6478E3EF3304C217C454656AE411EC98E1701A9E4286FACD39F0810FC1A5E7D3140CDBC5FADB2AB090EB5DAC
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\locales\zh.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 658 messages, Project-Id-Version: ElitechLog
Category:	dropped
Size (bytes):	40646
Entropy (8bit):	5.738734776245266
Encrypted:	false
SSDEEP:	384:HrgVJQ7D10pDxd/3ePt/1cEq4rVvRGWp0spX7soWQPuPA25p5uOBXGXq/roQ6uDe:HrQAWDxkVqEq4lRt0K4Td//59B2+0cyz
MD5:	BE243760BC54F809C92B464168C8E49D
SHA1:	44876D350B9A8EFBB399C06D46F74B4D733D1095
SHA-256:	564780BD53A7EE0CE88855F4EFC0F3794C4C63B63349A109D8C8BFD085A19CE8
SHA-512:	09EEB87EFC5C77E835D0FE2DDCA7752693FD9EDC0C76654AABA2C4AC1E3632D5A8BC3F97AE8F7CAEFC5211BFD276736AC29FCB779AA13A1C6102B182EAC9009A
Malicious:	false
Preview:	....................m...<).......6.......6.......6.......6.......7.......7.......7.......7......"7......+7......37......F7......Y7......g7......v7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......#8......08......:8..C...T8.......8..3....8.......8.......8.......8.......8.......8.......9.......9.......9.......9......"9......'9......,9......69......@9......F9......M9......Q9......T9......e9......p9......\|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:....../:..5...=:......s:.......:.......:.......:.......:..2....:.......;......$;......(;......,;......3;......C;......P;......i;......p;.......;.......;.......;.......;..$....;.......<.......<.......<.......<......"<......><......Z<......j<......t<......x<.......<.......<.......<.......<.......<.......<.......<.......<.......<.......<..6....<......1=......>=......K=......X=......n=......{=.......=.......=.......=.......=.......=.......=.......>.......>......

C:\ElitechLogWin\pt.pdf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	1629521
Entropy (8bit):	7.794730280439886
Encrypted:	false
SSDEEP:	24576:Z2wdGQnS0ispf9YPn/so8UNJJUIk2J0PEEEJfNmrhF93i/iQ:M8FnCHFjNJJh0ElkJlQ
MD5:	31EEAF66E0AE0C487DE1AC50C25096E4
SHA1:	9CA36CD3C0B7FCA5143C0EDCAB42BEB997AD6F5E
SHA-256:	1A8BCEEA036DC138A13C96F77AA3AFB8451AA3D3F9181B6DFD2F7BA6F2EEB9D6
SHA-512:	195E26482F83200A4CD48AB9C23D5453671375C50CF29C42B939687F7EFA7B3185A272B6333E97003104DBE93CE5CE1D7C7FBFD78E4EB060C0B3E00586E24364
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091224+01'12') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091224+01'12') /Producer () /SourceModified (D:20231008091224+01'12') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 283>>..stream..x..R.J.1.}....,8.\&......\|P.~.h.P....T[...H..=9..s2...d.K....u.6...h...7o...>.!1\|)..2.e....i!u....,.h.#X. ....Y[X~....K{...K.H.kuKd.]^..#''<.SA.+h .I.Q.5.p.fY=^ .G..d..MzPS.....$V.ju.[..$uq&)a.....BaS..N.>....WT...l.@n.c...u.....H...cO.?.:.C..E..<...<...m.U...;.[i........endstream.endobj.14 0 obj.<</Annots [22 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 4

C:\ElitechLogWin\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	InnoSetup Log ElitechLogWin V6.4.6 {43B523E1-27F6-432D-BAE3-1BAE1392BDCC}, version 0x418, 48815 bytes, 724536\37\user\376, C:\ElitechLogWin\376\377\377\007 \003
Category:	dropped
Size (bytes):	48815
Entropy (8bit):	3.94098198979423
Encrypted:	false
SSDEEP:	768:rIVYB4DYbaiDIFKv0BGevaLGuhgFzOP2h9iapiEYTF3llThm8qu8Wl7GcHKQOnW8:yiDIFKv0BGevsGuhgFzOP2h9iapiEYTq
MD5:	C1FB533BCE8980C1A69703F221477228
SHA1:	7C58241E74277FF2A0249668A1BA04EC5F0E1D75
SHA-256:	662978DE23E72CEDF1A44D2B00CB779C32097442C05B979D81641B1FB5E39621
SHA-512:	5DE9937871FA514F2FB974AB44BE0B9146575D10AC5EFE21C94471529D04D0944D1075EF9031E9CE28332F45A73728F06A6E4E454E7C23DD309703468C74FC2C
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{43B523E1-27F6-432D-BAE3-1BAE1392BDCC}}.........................................................................................ElitechLogWin V6.4.6........................................................................................................................%...........................................................................................................................v4.4......[........7.2.4.5.3.6......j.o.n.e.s......C.:.\.E.l.i.t.e.c.h.L.o.g.W.i.n................,./.... ......G.......IFPS....6...F...........................................................................................................................................................BOOLEAN..............TEXECWAIT.........TMSGBOXTYPE.........TUNINSTALLSTEP.........TLABEL....TLABEL.........TBITMAPIMAGE....TBITMAPIMAGE.........TEDIT....TEDIT.........TBUTTON....TBUTTON.........TNEWSTATICTEXT....TNEWSTATICTEXT.........TOBJECT....TOBJECT...

C:\ElitechLogWin\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1202385
Entropy (8bit):	6.367633063809205
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxytm:3qTytRFk6ek1L1
MD5:	321A206D27DE7ECE191C8AD9F09E5B72
SHA1:	B678673E1CE3D76F521B4365354AC779E2A80BE6
SHA-256:	1A07C9E9B358B1E0A6E04010093A20382B5E3B6514BEC22EC1CB74F8D5803A2F
SHA-512:	19554EDA2941467C8F2FDAF95D3A64AEBE3AB0095FE765C1AEA6247BFF3B4B5FD714FF291B53F60A2C27AC7333FF241BECE084A81751F95FF0E295B86A6414E8
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\ElitechLogWin\x64\SQLite.Interop.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1522688
Entropy (8bit):	6.598017317555494
Encrypted:	false
SSDEEP:	24576:ZO+RYskaNAiqITCL2z8JPvrePq7gXIbuYXhKqDhHAvVoYv+sJ/dYpAnFu6IoRLf:C9aNnz85p7nXhKq1HAvuYm2hu67R
MD5:	B84A47B0CF19A8E7A8A5137A3819E154
SHA1:	A190B79735FD9FBDD130475955C98642712F6A0B
SHA-256:	AA4A2B413DFFB9B721E357855A969AF3ED5EEF582DF8EEDFBB93E9399649F514
SHA-512:	5BB4FFB1A65B3B85935A1CFBA8090D27183661C7C6C5563EF83734F937366497096EC0EBADC95B7EA118E63F034F3098457093DC001C899D3ED01E4BF3369808
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W-.6C..6C..6C....6C.....6C.....6C..N..6C..6B.;6C....6C.....6C.....6C.....6C.Rich.6C.................PE..d...@..Y.........." .....H...........(...............................................n....@.........................................p9...,...,..<....p..<...........................0d...............................................`...............................text....G.......H.................. ..`.rdata..@....`.......L..............@..@.data...xV...p...<...T..............@....pdata..............................@..@text....]...........................@.. data.....c.......d..................@..@.rsrc...<....p......................@..@.reloc..v...........................@..B................................................................................................................................................................................

C:\ElitechLogWin\x64\is-P7DP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1522688
Entropy (8bit):	6.598017317555494
Encrypted:	false
SSDEEP:	24576:ZO+RYskaNAiqITCL2z8JPvrePq7gXIbuYXhKqDhHAvVoYv+sJ/dYpAnFu6IoRLf:C9aNnz85p7nXhKq1HAvuYm2hu67R
MD5:	B84A47B0CF19A8E7A8A5137A3819E154
SHA1:	A190B79735FD9FBDD130475955C98642712F6A0B
SHA-256:	AA4A2B413DFFB9B721E357855A969AF3ED5EEF582DF8EEDFBB93E9399649F514
SHA-512:	5BB4FFB1A65B3B85935A1CFBA8090D27183661C7C6C5563EF83734F937366497096EC0EBADC95B7EA118E63F034F3098457093DC001C899D3ED01E4BF3369808
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W-.6C..6C..6C....6C.....6C.....6C..N..6C..6B.;6C....6C.....6C.....6C.....6C.Rich.6C.................PE..d...@..Y.........." .....H...........(...............................................n....@.........................................p9...,...,..<....p..<...........................0d...............................................`...............................text....G.......H.................. ..`.rdata..@....`.......L..............@..@.data...xV...p...<...T..............@....pdata..............................@..@text....]...........................@.. data.....c.......d..................@..@.rsrc...<....p......................@..@.reloc..v...........................@..B................................................................................................................................................................................

C:\ElitechLogWin\x86\SQLite.Interop.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1141248
Entropy (8bit):	6.854102955260552
Encrypted:	false
SSDEEP:	24576:k3/SHu5WhsKfScMiASYfqpaVfBLisPSVFvFevynqEqLT9oyO:kPSHuEOj/fqcBjPSPFev8gmy
MD5:	5E99E9D7B9629BC21074718C1F974215
SHA1:	4466E57C7B7EBF8450022888376BDDCE8F694B54
SHA-256:	8DE21CAA05E042E9B88BCCD4CBCAF4805C457616F5989A4A75AA3F8E10A6B2FE
SHA-512:	7E93BEA5FF1029C854F5928B6CD0D6A94A2688F17838217ED02B12CEF20839B915B4C28EE3EC10A2B42A3B4913B9EEA4AB3C1E278D36499C9936803AEEDF0AA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..E..WE..WE..W^.6W\..W^..W~..W^.7W)..WLb.W@..WE..W...W^.3WD..W^..WD..W^..WD..W^..WD..WRichE..W........................PE..L...I..Y...........!................%'....................................................@.........................`....-..\|...<.... ..<....................0...n.. ...............................`...@............................................text.............................. ..`.rdata..............................@..@.data....7.......$..................@....rsrc...<.... ......................@..@.reloc...t...0...v..................@..B................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\x86\is-4IMP3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1141248
Entropy (8bit):	6.854102955260552
Encrypted:	false
SSDEEP:	24576:k3/SHu5WhsKfScMiASYfqpaVfBLisPSVFvFevynqEqLT9oyO:kPSHuEOj/fqcBjPSPFev8gmy
MD5:	5E99E9D7B9629BC21074718C1F974215
SHA1:	4466E57C7B7EBF8450022888376BDDCE8F694B54
SHA-256:	8DE21CAA05E042E9B88BCCD4CBCAF4805C457616F5989A4A75AA3F8E10A6B2FE
SHA-512:	7E93BEA5FF1029C854F5928B6CD0D6A94A2688F17838217ED02B12CEF20839B915B4C28EE3EC10A2B42A3B4913B9EEA4AB3C1E278D36499C9936803AEEDF0AA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..E..WE..WE..W^.6W\..W^..W~..W^.7W)..WLb.W@..WE..W...W^.3WD..W^..WD..W^..WD..W^..WD..WRichE..W........................PE..L...I..Y...........!................%'....................................................@.........................`....-..\|...<.... ..<....................0...n.. ...............................`...@............................................text.............................. ..`.rdata..............................@..@.data....7.......$..................@....rsrc...<.... ......................@..@.reloc...t...0...v..................@..B................................................................................................................................................................................................................................................................................................................

C:\ElitechLogWin\zh-TW.pdf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	2329326
Entropy (8bit):	7.833605385493755
Encrypted:	false
SSDEEP:	24576:J90Mwi5+ayHjvL8WJfp6T9zqC1yVbZTEOUKEEEEEEHVR7gdAJCOt85W2:J9fiDvwJJFsVVEONracCr5W2
MD5:	DACB9E09B8CF4FCE40E112931F986DCA
SHA1:	65CAA21B892A2BE09B803AC183147C6CB2F5CB69
SHA-256:	B1D02750157691A91DEF35AF84399E519748305E48DC9BB4CCDB351C9EA08F0E
SHA-512:	FEA8091A3B3941616AF6E25945F2CDE1E9F0801506D99B905FECE44F6C1670A87FC2E0FDD14D2305671C06A4C4043C0FCE5ECF37C51677ACFC289AF7DB3AD7ED
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091049+01'10') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091049+01'10') /Producer () /SourceModified (D:20231008091049+01'10') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT14 14 0 R /FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 215>>..stream..x....jB1....y.\.V.69MA.#z.a...{........_{t..F.M..i....T..1tN.?.p..........G G....\r[r?.._7.o.o...fC6.b._0.q....}\|r..!+9...0.>.E..z.y5..o.h.h.&JlHJ.!6......u!.../........O.WwbR.7M..9V4..&.f.....i..?r.c...endstream.endobj.19 0 obj.<</Annots [32 0 R 34 0 R 36 0 R 38 0 R 40 0 R 42 0 R 44 0 R 46 0 R 48 0 R 50 0 R 52 0 R 54 0 R 56 0 R 58 0 R 60 0 R 62 0 R 64 0 R

C:\ElitechLogWin\zh.pdf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	2329326
Entropy (8bit):	7.833605385493755
Encrypted:	false
SSDEEP:	24576:J90Mwi5+ayHjvL8WJfp6T9zqC1yVbZTEOUKEEEEEEHVR7gdAJCOt85W2:J9fiDvwJJFsVVEONracCr5W2
MD5:	DACB9E09B8CF4FCE40E112931F986DCA
SHA1:	65CAA21B892A2BE09B803AC183147C6CB2F5CB69
SHA-256:	B1D02750157691A91DEF35AF84399E519748305E48DC9BB4CCDB351C9EA08F0E
SHA-512:	FEA8091A3B3941616AF6E25945F2CDE1E9F0801506D99B905FECE44F6C1670A87FC2E0FDD14D2305671C06A4C4043C0FCE5ECF37C51677ACFC289AF7DB3AD7ED
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<</Author (..b...) /Comments () /Company () /CreationDate (D:20231008091049+01'10') /Creator (...W.P.S. e.[W) /Keywords () /ModDate (D:20231008091049+01'10') /Producer () /SourceModified (D:20231008091049+01'10') /Subject (..."R....[X. ..u\(. g\r... ..gP) /Title (...oN.O.u\(..f.Nf) /Trapped /False>>.endobj.13 0 obj.<</AIS false /BM /Normal /CA 1 /Type /ExtGState /ca 1>>.endobj.6 0 obj.<</Contents 7 0 R /MediaBox [0 0 521.35 736.55] /Parent 2 0 R /Resources <</ExtGState <</GS13 13 0 R>> /Font <</FT14 14 0 R /FT8 8 0 R>>>> /Type /Page>>.endobj.7 0 obj.<</Filter /FlateDecode /Length 215>>..stream..x....jB1....y.\.V.69MA.#z.a...{........_{t..F.M..i....T..1tN.?.p..........G G....\r[r?.._7.o.o...fC6.b._0.q....}\|r..!+9...0.>.E..z.y5..o.h.h.&JlHJ.!6......u!.../........O.WwbR.7M..9V4..&.f.....i..?r.c...endstream.endobj.19 0 obj.<</Annots [32 0 R 34 0 R 36 0 R 38 0 R 40 0 R 42 0 R 44 0 R 46 0 R 48 0 R 50 0 R 52 0 R 54 0 R 56 0 R 58 0 R 60 0 R 62 0 R 64 0 R

C:\Program Files\DIFX\4A7292F75FEBBD3C\CP210xVCPInstaller_x64.exe

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1050104
Entropy (8bit):	5.617498652730841
Encrypted:	false
SSDEEP:	12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
MD5:	BE3C79033FA8302002D9D3A6752F2263
SHA1:	A01147731F2E500282ECA5ECE149BCC5423B59D6
SHA-256:	181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
SHA-512:	77097F220CC6D22112B314D3E42B6EEDB9CCD72BEB655B34656326C2C63FB9209977DDAC20E9C53C4EC7CCC8EA6910F400F050F4B0CB98C9F42F89617965AAEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m.......%...........................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElitechLogWin\ElitechLogWin.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 8 14:44:48 2024, mtime=Tue Oct 8 14:44:48 2024, atime=Thu Oct 19 19:53:28 2023, length=2235904, window=hide
Category:	dropped
Size (bytes):	660
Entropy (8bit):	4.547531244672069
Encrypted:	false
SSDEEP:	12:8m48HFB8wo1htMC9hkKRTjAd5iL/lhXeIBmV:8m431wkDAfiL7bBm
MD5:	F82A45D91BC6E6AA8764F83D8CE1A8DB
SHA1:	D8845BB54B3720A26D21CF835EC9C5F449F6037D
SHA-256:	1DD5B0CDE58D6FA9C8046711AE51D212D422B7926E54325BF760A91CFF2AFCA1
SHA-512:	6568938D84554307B8662CFD0A9E57B699D18F595AF0B6BCFACCE57AAE15E469C862CD486E912F13A5783AECD05AD41A1DF156F91CEA16C9650DF26D66B6F3A6
Malicious:	false
Preview:	L..................F.... ...;RL.......h......TnO......"..........................P.O. .:i.....+00.../C:\...................d.1.....HY.}..ELITEC~1..L......HY.}HY.}....z.......................R.E.l.i.t.e.c.h.L.o.g.W.i.n.....T.2...".SW.. .DL.exe..>......HY.}HY.}.....2........................D.L...e.x.e.......F...............-.......E...........(G=......C:\ElitechLogWin\DL.exe..&.....\.....\.....\.....\.....\.....\.E.l.i.t.e.c.h.L.o.g.W.i.n.\.D.L...e.x.e...C.:.\.E.l.i.t.e.c.h.L.o.g.W.i.n.`.......X.......724536...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElitechLogWin\Uninstall ElitechLogWin.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 8 14:44:47 2024, mtime=Tue Oct 8 14:44:47 2024, atime=Tue Oct 8 14:44:33 2024, length=1202385, window=hide
Category:	dropped
Size (bytes):	696
Entropy (8bit):	4.631321715284277
Encrypted:	false
SSDEEP:	12:8mV8MEf8wo1htMC9ianGcjArW4aL/lhPBmV:8mtj1wkDnG4AK4aL7PBm
MD5:	133AA05760A870F6D52AC7B6E32CF181
SHA1:	AC30C0D99D78D62F54C568DE925912BBF0A3BBBC
SHA-256:	B94DA63EE8B0D87D3EB10FD42E5708E210A4D72083F6A3F04C69AAB17565A856
SHA-512:	21406CB6385DBE28D151B47296DACD7D2D3A7F57F1370E442051F9E83DD9A177CE983FBCE332345A2B52FF5DD8A539DD1D36E2BBEAAB739C50A06558CB16893A
Malicious:	false
Preview:	L..................F.... .....G.......G......?.......X...........................P.O. .:i.....+00.../C:\...................d.1.....HY.}..ELITEC~1..L......HY.}HY.}....z.......................R.E.l.i.t.e.c.h.L.o.g.W.i.n.....f.2..X..HY.} .unins000.exe..J......HY.}HY.}..........................A]..u.n.i.n.s.0.0.0...e.x.e.......L...............-.......K...........(G=......C:\ElitechLogWin\unins000.exe..,.....\.....\.....\.....\.....\.....\.E.l.i.t.e.c.h.L.o.g.W.i.n.\.u.n.i.n.s.0.0.0...e.x.e...C.:.\.E.l.i.t.e.c.h.L.o.g.W.i.n.`.......X.......724536...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\Public\Desktop\ElitechLogWin.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Tue Oct 8 14:44:48 2024, mtime=Tue Oct 8 14:45:06 2024, atime=Thu Oct 19 19:53:28 2023, length=2235904, window=hide
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	2.8842105572821555
Encrypted:	false
SSDEEP:	12:8Z8XB8wo1htMC9hkKRTjAdgDiLc55MKly1/Llk5MflhXeIBmV:8ZR1wkDAyDiLOf+/LywbBm
MD5:	ACCE75EF2FCD1EF241EF6B316886590D
SHA1:	B50A7768A2401F2213BCABC0E0B1BCB231534134
SHA-256:	DAA856182B109F204E209369F6ECB688F3F90C4E01B01AF07A1FF63F55B39EDA
SHA-512:	A4FBBC3E4E7AD14B17C7D76655A053C056056884C4E6EDF8ED0B27092E0ECD543BB4C9013A6B267CC80062C774A3DC9C5C409627AAFF9FE54537E5EEE2910272
Malicious:	false
Preview:	L..................F.@.. ...;RL......._......TnO......"..........................P.O. .:i.....+00.../C:\...................d.1.....HY.}..ELITEC~1..L......HY.}HY.}....z.......................R.E.l.i.t.e.c.h.L.o.g.W.i.n.....T.2...".SW.. .DL.exe..>......HY.}HY.}.....2........................D.L...e.x.e.......F...............-.......E...........(G=......C:\ElitechLogWin\DL.exe........\.....\.....\.E.l.i.t.e.c.h.L.o.g.W.i.n.\.D.L...e.x.e...C.:.\.E.l.i.t.e.c.h.L.o.g.W.i.n...C.:.\.E.l.i.t.e.c.h.L.o.g.W.i.n.\.e.l.i.t.e.c.h...i.c.o.........%SystemDrive%\ElitechLogWin\elitech.ico.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.E.l.i.t.e.c.h.L.o.g.W.i.n.\.e.l.i.t.e.c.h...i.c.o............................................................................................................................

C:\Users\Public\Documents\EDataLog\data.db3 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	7.975466747723019
Encrypted:	false
SSDEEP:	384:HK6dHBbSLdc/1n5XiwAXY3ijcI6YEZ1XlwGR3o+a2Y9GDFqUSFTlb:Hn25k4YyjI9nNDD/Ulb
MD5:	7AE1034C7C7E11AFBD7F2E61A0ACF043
SHA1:	3BBB17FE83D6E8A6D7BF9ECFABC0452099E73022
SHA-256:	367FCFB6BD0D084C88A3D5F4A7E2A34492FB097C744D1DA16E5D2D6B749F6D1F
SHA-512:	7A1AB7E8ADA6524D9B63D58A07354A1631E9C9BA420DE7CC3347AB8965EC7156E086DD70E83B857F811D030BAED7F7FC0B3C80B2C18B4583CA560048715304E5
Malicious:	false
Preview:	pc!.i..?O.\|..3....U...-...^G0/7..D..2...NC. .F.....]8Y.Us..N./..5....(.qJ..Q..!...Ob..U.wg....e.....c.....L.~{......Y....d..#;\........R.N...+.....S.pb...(o.T...x...C...v&..d{x..,..rT.e{.\|....%..w.b..U....i.\|~..g..fk&L..G..h.E..;.Qb{-.............&.....u...... t.....!)..2.4^..+F....w..i..=S.'..$o.+G.b......-{k.Fx.J..]..h.0.y^'hr......t?...@..j..=..F.v....\w.<.m.'.........Zk..&...!.oa.}r%h.....e.a.`u.....T3....[...CK..-&\|.....\.t........F.....j..27../q!H..!...c.]..P../...M.......~..n....@I.5Ji..sG/v.o.ORE...K9.g+8...........([.9 w.'G.x=.\`>-vv.fc..7C.+..y..:..^.=.\.I..}...`}....)s.k..5.t..R.m.P6H..r.0..a.8.'O....... .n.....f).[\|....[.#.C.4..[....R........e.[-.Rn....c.q/..E..(.a..b....0...k..F{T0...o&..`v..fU....\|...t...,O.M..".>.+..y.]....c2N....%..s...&<+.w.0.<.F....\|...^..sYG.......vQ..q....p6mF..~......z3...u0..,....w...Kv&k.9.Wo.g!...Q\.Sf....G...<......q!............bPL\|...,.9V.>)."pNqZ....^...A.A.~............~.A.xm..'l.....~1....

C:\Users\Public\Documents\EDataLog\is-KSFCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	data
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	7.975466747723019
Encrypted:	false
SSDEEP:	384:HK6dHBbSLdc/1n5XiwAXY3ijcI6YEZ1XlwGR3o+a2Y9GDFqUSFTlb:Hn25k4YyjI9nNDD/Ulb
MD5:	7AE1034C7C7E11AFBD7F2E61A0ACF043
SHA1:	3BBB17FE83D6E8A6D7BF9ECFABC0452099E73022
SHA-256:	367FCFB6BD0D084C88A3D5F4A7E2A34492FB097C744D1DA16E5D2D6B749F6D1F
SHA-512:	7A1AB7E8ADA6524D9B63D58A07354A1631E9C9BA420DE7CC3347AB8965EC7156E086DD70E83B857F811D030BAED7F7FC0B3C80B2C18B4583CA560048715304E5
Malicious:	false
Preview:	pc!.i..?O.\|..3....U...-...^G0/7..D..2...NC. .F.....]8Y.Us..N./..5....(.qJ..Q..!...Ob..U.wg....e.....c.....L.~{......Y....d..#;\........R.N...+.....S.pb...(o.T...x...C...v&..d{x..,..rT.e{.\|....%..w.b..U....i.\|~..g..fk&L..G..h.E..;.Qb{-.............&.....u...... t.....!)..2.4^..+F....w..i..=S.'..$o.+G.b......-{k.Fx.J..]..h.0.y^'hr......t?...@..j..=..F.v....\w.<.m.'.........Zk..&...!.oa.}r%h.....e.a.`u.....T3....[...CK..-&\|.....\.t........F.....j..27../q!H..!...c.]..P../...M.......~..n....@I.5Ji..sG/v.o.ORE...K9.g+8...........([.9 w.'G.x=.\`>-vv.fc..7C.+..y..:..^.=.\.I..}...`}....)s.k..5.t..R.m.P6H..r.0..a.8.'O....... .n.....f).[\|....[.#.C.4..[....R........e.[-.Rn....c.q/..E..(.a..b....0...k..F{T0...o&..`v..fU....\|...t...,O.M..".>.+..y.]....c2N....%..s...&<+.w.0.<.F....\|...^..sYG.......vQ..q....p6mF..~......z3...u0..,....w...Kv&k.9.Wo.g!...Q\.Sf....G...<......q!............bPL\|...,.9V.>)."pNqZ....^...A.A.~............~.A.xm..'l.....~1....

C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp

Download File

Process:	C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.395287124443116
Encrypted:	false
SSDEEP:	24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
MD5:	90FC739C83CD19766ACB562C66A7D0E2
SHA1:	451F385A53D5FED15E7649E7891E05F231EF549A
SHA-256:	821BD11693BF4B4B2B9F3C196036E1F4902ABD95FB26873EA6C43E123B8C9431
SHA-512:	4CB11AD48B7585EF1B70FAC9E3C25610B2F64A16358CD51E32ADCB0B17A6AB1C934AEB10ADAA8E9DDF69B2E2F1D18FE2E87B49B39F89B05EA13AA3205E41296C
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TN1V0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\SETE36F.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	11333
Entropy (8bit):	6.787341487288969
Encrypted:	false
SSDEEP:	192:8beQEeyM/W84ewtxO2hECwkY8TE0rrr8RVcdh+3Ef5KYpBjSA6L24Y:8Kl8ilwk4C+3Ef5dpBjhR4Y
MD5:	BEFE6327722742CD1424B739BC8F5CFA
SHA1:	C3F899399BF59E9890C654670B15E364628DB4A9
SHA-256:	C135F73366AAC8FE95FE3285D05A3EFA76C0054DF677BAC3E308E7DC82A58BC0
SHA-512:	0E0158FF5C583714BABD8EA0FCDA4AB203A4EF747F57AE6BAD2A4C5C866B8F183D592495B9281E85CCFF589520942607BB7F412D641A25F3CD252F4DF63067B7
Malicious:	false
Preview:	0.,A..*.H........,20.,....1.0...+......0.....+.....7......0...0...+.....7.....%...$.L..L5.Af...140411202803Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0....R1.4.F.E.2.4.4.3.3.3.8.2.1.6.4.D.5.3.B.5.B.9.3.0.8.4.4.B.7.8.4.7.C.7.B.0.7.2.6.5...1..o0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........$C3..MS..0.KxG.re0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\SETE380.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\slabvcp.cat (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	11333
Entropy (8bit):	6.787341487288969
Encrypted:	false
SSDEEP:	192:8beQEeyM/W84ewtxO2hECwkY8TE0rrr8RVcdh+3Ef5KYpBjSA6L24Y:8Kl8ilwk4C+3Ef5dpBjhR4Y
MD5:	BEFE6327722742CD1424B739BC8F5CFA
SHA1:	C3F899399BF59E9890C654670B15E364628DB4A9
SHA-256:	C135F73366AAC8FE95FE3285D05A3EFA76C0054DF677BAC3E308E7DC82A58BC0
SHA-512:	0E0158FF5C583714BABD8EA0FCDA4AB203A4EF747F57AE6BAD2A4C5C866B8F183D592495B9281E85CCFF589520942607BB7F412D641A25F3CD252F4DF63067B7
Malicious:	false
Preview:	0.,A..*.H........,20.,....1.0...+......0.....+.....7......0...0...+.....7.....%...$.L..L5.Af...140411202803Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0....R1.4.F.E.2.4.4.3.3.3.8.2.1.6.4.D.5.3.B.5.B.9.3.0.8.4.4.B.7.8.4.7.C.7.B.0.7.2.6.5...1..o0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........$C3..MS..0.KxG.re0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\slabvcp.inf (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE224.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.814741197269295
Encrypted:	false
SSDEEP:	384:i6oIhnyUR2OZRy0m1KcQGd/V3nL7fVRQlQeddvuVyxxTWBU/T:iIZygU31Kcl/V3L7f4esv2+/T
MD5:	8C61B219882C9C9ECA09BEDB82B0DDB1
SHA1:	52A5AF0ACA9124C2AB39029761A7662ADC8C5861
SHA-256:	711681040D9CD93D603F55AB8D62371F5D51917C14818F27859E23E2D60EB18F
SHA-512:	67CCDB25B31DCB5FA4FC900898B7078F3932FA74C7159F93E592E6DD3054526ED37328C8A8466F0987901D4D432AB9735439AFFDAD5FFC4E9E4CF97253A54E54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d...=.ES.........."......J..........................................................#...........................................................(............P.......................1...............................................0...............................text...f........................... ..h.rdata.......0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE2A2.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.088944190023996
Encrypted:	false
SSDEEP:	1536:oaTuFs5UbmggODbmZJxRXOibxoCGxe14TNYy/PfBY0SttXpXcnxv86f1Sx:fks5Ubmm+xnxoCGxe14TNYy/PfBUtHAs
MD5:	2641655FAD6C1EA0F3677978E2BF28C1
SHA1:	09627D2AAF886E132136AD10C19282F809E06CA1
SHA-256:	E703CE74D09E901BF531589E181DCF95B9C63E09FE1B99E38DEA9EE47EE458BA
SHA-512:	C024E241D8E9768D28B854D61DD41A8C61094C106C616742D81A7DFC4BA7C3FF27A2433456DA952D193D34449A2E11374FAC92AD008CE8C35B67A74DDC1192BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xnu.Xnu.Xnu.Q...[nu.Q...[nu.Q...[nu.Q...Znu.Xnt.Dnu.....]nu.....Ynu.Q...Unu.Q...Znu.....Ynu.Q...Knu.Q...Ynu.Q...Ynu.RichXnu.........................PE..d...;.ES.........."..........,......................................................L.......................................................$...P...............................8....................................................................................text...?........................... ..h.rdata..............................@..H.data...t...........................@....pdata..............................@..HPAGESRP0#<... ...>.................. ..`PAGE....~....`....... .............. ..`PAGESER......p.......".............. ..`INIT.................&.............. ....rsrc................0..............@..B.reloc...............4..............@..B........................................................

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\SETE2F1.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\WdfCoinstaller01009.dll (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\silabenm.sys (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.814741197269295
Encrypted:	false
SSDEEP:	384:i6oIhnyUR2OZRy0m1KcQGd/V3nL7fVRQlQeddvuVyxxTWBU/T:iIZygU31Kcl/V3L7f4esv2+/T
MD5:	8C61B219882C9C9ECA09BEDB82B0DDB1
SHA1:	52A5AF0ACA9124C2AB39029761A7662ADC8C5861
SHA-256:	711681040D9CD93D603F55AB8D62371F5D51917C14818F27859E23E2D60EB18F
SHA-512:	67CCDB25B31DCB5FA4FC900898B7078F3932FA74C7159F93E592E6DD3054526ED37328C8A8466F0987901D4D432AB9735439AFFDAD5FFC4E9E4CF97253A54E54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d...=.ES.........."......J..........................................................#...........................................................(............P.......................1...............................................0...............................text...f........................... ..h.rdata.......0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\x64\silabser.sys (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.088944190023996
Encrypted:	false
SSDEEP:	1536:oaTuFs5UbmggODbmZJxRXOibxoCGxe14TNYy/PfBY0SttXpXcnxv86f1Sx:fks5Ubmm+xnxoCGxe14TNYy/PfBUtHAs
MD5:	2641655FAD6C1EA0F3677978E2BF28C1
SHA1:	09627D2AAF886E132136AD10C19282F809E06CA1
SHA-256:	E703CE74D09E901BF531589E181DCF95B9C63E09FE1B99E38DEA9EE47EE458BA
SHA-512:	C024E241D8E9768D28B854D61DD41A8C61094C106C616742D81A7DFC4BA7C3FF27A2433456DA952D193D34449A2E11374FAC92AD008CE8C35B67A74DDC1192BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xnu.Xnu.Xnu.Q...[nu.Q...[nu.Q...[nu.Q...Znu.Xnt.Dnu.....]nu.....Ynu.Q...Unu.Q...Znu.....Ynu.Q...Knu.Q...Ynu.Q...Ynu.RichXnu.........................PE..d...;.ES.........."..........,......................................................L.......................................................$...P...............................8....................................................................................text...?........................... ..h.rdata..............................@..H.data...t...........................@....pdata..............................@..HPAGESRP0#<... ...>.................. ..`PAGE....~....`....... .............. ..`PAGESER......p.......".............. ..`INIT.................&.............. ....rsrc................0..............@..B.reloc...............4..............@..B........................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PORTSA64.DLL (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64104
Entropy (8bit):	5.932012342855659
Encrypted:	false
SSDEEP:	768:mUzmxxqC8o2bshUK5AiPZhVWu19IWMytrEIfB2pYoste87b3IdclQ9za0:mYmxglnEJPVW49IW5tYIEateobWzv
MD5:	296618273185A983BD5B9E469AF2D972
SHA1:	95989164BE63DFD95C829788400BC32CB84AD65A
SHA-256:	4DD21860B264A5C4B4040F19F6EE41B886704EF44DA88BCADC5EC7060EBF9126
SHA-512:	BF6BCA479BB5018D417CCAAB20D881DEFBB154ADDB9CE073623FD4E9048F380A73DB50967D871677023A74D2FFDED3C0B2686F7972C55E25297A987FB1820380
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................................................................0..................../..............h(......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PT.DLL (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341PTA64.DLL (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56424
Entropy (8bit):	6.439469401329907
Encrypted:	false
SSDEEP:	768:6Jb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jfnb3IMoDlQ9za5G:AfOJbqbKdmv04Tfnb77z7
MD5:	7C40C2737E1A567B4E1FC62952BC90CE
SHA1:	18BDDB57C4B2F818DBCA82E6BFD0E7547D6836F5
SHA-256:	1687B96846734B1E44F4581F90C0144962189847E78EF9151F025FE39DE1D53B
SHA-512:	E0C820F0F3EBEB4CD787DC68844A95E5BC187D6542C7DA9FCF6636B065443EEECA4C1C541D549EAC57500629B0D021596C555EFDA86AC586272F8316D7EA9FE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T.......h(..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341S64.SYS (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.300532218398393
Encrypted:	false
SSDEEP:	1536:L+D98L1mOgrk9w1qw6zZ8vjWxFzImYotsb8lCzD:CR4mOyJ1tjat3smCf
MD5:	BB4221657D3170F409F058690FD8DA0B
SHA1:	FCFECF503BAB0801C7BFDD417A6AB4E0758D8177
SHA-256:	FA525D2F23BCD50F4DA42B6C38A0D87E93FEAFF672A44083473CE19EC633B483
SHA-512:	771D5591F87A62E2D0E2E126F863A4E537CE7E4D7B347E6B29B21446923AEBE7F15C41E5FA253600A3CBD50A3FFC44D21AB91D7D2F16F37B4E8258B5287DE527
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P.......V......................................................L#..P....0..`...............H(...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341SER.CAT (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	data
Category:	dropped
Size (bytes):	16315
Entropy (8bit):	7.0158931388032935
Encrypted:	false
SSDEEP:	192:/yv54p+ddKXaNaA4Og/PBJllnEX8hyFIFIOcDF1agjEwOXP6hYCEJpq21eX01k9E:QrBwEsP6/k6h3Ypl8R9z/Cx
MD5:	09D2102BACD78C7C0A53F63E1CE3DB07
SHA1:	2F66B041A4FCA2ADFDF89F88A1DE156CD330B67F
SHA-256:	20D39AF89440A1C85016FB064CA49A40D92C874546CB4A0551023DCB64B85D51
SHA-512:	B0DD37814FB96378A8BF07B34A57D6501DA54FD2E6A52D19F86AE88C6014C9F8C18491BFA6140ED552D50B0DF54328B92E465FBC76738B48616C379DF6BDCB74
Malicious:	false
Preview:	0.?....H........?.0.?....1.0...`.H.e......0.....+.....7......0...0...+.....7.......&m@.T.i.....220302065955Z0...+.....7.....0...0.... .%p-T...v.iH...2R..d.?....U.k.G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .%p-T...v.iH...2R..d.?....U.k.G.0.... .." ...t^.h.iJ..k..............1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........c.h.3.4.1.s.9.8...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .." ...t^.h.iJ..k..............0....&.e...v..~.....o1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0....&.MI.z^.dc.9.[..G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........c.h.3.4.1

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341SER.INF (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD13C.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	data
Category:	dropped
Size (bytes):	16315
Entropy (8bit):	7.0158931388032935
Encrypted:	false
SSDEEP:	192:/yv54p+ddKXaNaA4Og/PBJllnEX8hyFIFIOcDF1agjEwOXP6hYCEJpq21eX01k9E:QrBwEsP6/k6h3Ypl8R9z/Cx
MD5:	09D2102BACD78C7C0A53F63E1CE3DB07
SHA1:	2F66B041A4FCA2ADFDF89F88A1DE156CD330B67F
SHA-256:	20D39AF89440A1C85016FB064CA49A40D92C874546CB4A0551023DCB64B85D51
SHA-512:	B0DD37814FB96378A8BF07B34A57D6501DA54FD2E6A52D19F86AE88C6014C9F8C18491BFA6140ED552D50B0DF54328B92E465FBC76738B48616C379DF6BDCB74
Malicious:	false
Preview:	0.?....H........?.0.?....1.0...`.H.e......0.....+.....7......0...0...+.....7.......&m@.T.i.....220302065955Z0...+.....7.....0...0.... .%p-T...v.iH...2R..d.?....U.k.G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .%p-T...v.iH...2R..d.?....U.k.G.0.... .." ...t^.h.iJ..k..............1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........c.h.3.4.1.s.9.8...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .." ...t^.h.iJ..k..............0....&.e...v..~.....o1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0....&.MI.z^.dc.9.[..G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........c.h.3.4.1

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD14D.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD15D.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56424
Entropy (8bit):	6.439469401329907
Encrypted:	false
SSDEEP:	768:6Jb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jfnb3IMoDlQ9za5G:AfOJbqbKdmv04Tfnb77z7
MD5:	7C40C2737E1A567B4E1FC62952BC90CE
SHA1:	18BDDB57C4B2F818DBCA82E6BFD0E7547D6836F5
SHA-256:	1687B96846734B1E44F4581F90C0144962189847E78EF9151F025FE39DE1D53B
SHA-512:	E0C820F0F3EBEB4CD787DC68844A95E5BC187D6542C7DA9FCF6636B065443EEECA4C1C541D549EAC57500629B0D021596C555EFDA86AC586272F8316D7EA9FE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T.......h(..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD17D.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD19E.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.300532218398393
Encrypted:	false
SSDEEP:	1536:L+D98L1mOgrk9w1qw6zZ8vjWxFzImYotsb8lCzD:CR4mOyJ1tjat3smCf
MD5:	BB4221657D3170F409F058690FD8DA0B
SHA1:	FCFECF503BAB0801C7BFDD417A6AB4E0758D8177
SHA-256:	FA525D2F23BCD50F4DA42B6C38A0D87E93FEAFF672A44083473CE19EC633B483
SHA-512:	771D5591F87A62E2D0E2E126F863A4E537CE7E4D7B347E6B29B21446923AEBE7F15C41E5FA253600A3CBD50A3FFC44D21AB91D7D2F16F37B4E8258B5287DE527
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P.......V......................................................L#..P....0..`...............H(...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\SETD1CE.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64104
Entropy (8bit):	5.932012342855659
Encrypted:	false
SSDEEP:	768:mUzmxxqC8o2bshUK5AiPZhVWu19IWMytrEIfB2pYoste87b3IdclQ9za0:mYmxglnEJPVW49IW5tYIEateobWzv
MD5:	296618273185A983BD5B9E469AF2D972
SHA1:	95989164BE63DFD95C829788400BC32CB84AD65A
SHA-256:	4DD21860B264A5C4B4040F19F6EE41B886704EF44DA88BCADC5EC7060EBF9126
SHA-512:	BF6BCA479BB5018D417CCAAB20D881DEFBB154ADDB9CE073623FD4E9048F380A73DB50967D871677023A74D2FFDED3C0B2686F7972C55E25297A987FB1820380
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................................................................0..................../..............h(......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\DPINST.LOG

Download File

Process:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4282
Entropy (8bit):	3.685554753989759
Encrypted:	false
SSDEEP:	48:llZNX9wnC97abv/j8cyV7BuQ63Erg2LKCbO9E7tJEmAyH2uEF:5fwCRabv/8luQ63io9YJTHHHc
MD5:	82B7C47496D250B7648B3330F9AF05FA
SHA1:	61728FD783405B7638DED2087672AE52EAC614DA
SHA-256:	C7D90754795DECD9443F3E00E773EF7E9C65B3CD03F4507A81842D5181EF303C
SHA-512:	AF1C859A4083A3647B05279D60C5B6F4C89E49F3D1CD3B80C8193B31C06ADAEB59F01D1411A9AEAC8D186B6CA1B81B93BE8E1FE29A0206B47F124DA13D73AA64
Malicious:	false
Preview:	..I.N.F.O.:. . . .............................................I.N.F.O.:. . . .1.0./.0.8./.2.0.2.4. .1.1.:.4.5.:.0.0.....I.N.F.O.:. . . .P.r.o.d.u.c.t. .V.e.r.s.i.o.n. .2...1...0...0.......I.N.F.O.:. . . .V.e.r.s.i.o.n.:. .6...2...9.2.0.0. .....I.N.F.O.:. . . .P.l.a.t.f.o.r.m. .I.D.:. .2. .(.N.T.).....I.N.F.O.:. . . .S.e.r.v.i.c.e. .P.a.c.k.:. .0...0.....I.N.F.O.:. . . .S.u.i.t.e.:. .0.x.0.1.0.0.,. .P.r.o.d.u.c.t. .T.y.p.e.:. .1.....I.N.F.O.:. . . .A.r.c.h.i.t.e.c.t.u.r.e.:. .A.M.D.6.4.......I.N.F.O.:. . . .I.n.t.e.r.a.c.t.i.v.e. .W.i.n.d.o.w.s. .S.t.a.t.i.o.n.....I.N.F.O.:. . . .C.o.m.m.a.n.d. .L.i.n.e.:. .'.".C.:.\.E.l.i.t.e.c.h.L.o.g.W.i.n.\.D.r.i.v.e.r.s.\.C.P.2.1.0.x.\.C.P.2.1.0.x.V.C.P.I.n.s.t.a.l.l.e.r._.x.6.4...e.x.e.". ./.S.'.....I.N.F.O.:. . . .D.P.I.n.s.t. .i.s. .n.o.t. .m.u.l.t.i.-.l.i.n.g.u.a.l.......I.N.F.O.:. . . .............................................I.N.F.O.:. . . .C.u.r.r.e.n.t. .w.o.

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\Windows\INF\oem5.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	56544
Entropy (8bit):	5.3166225136350995
Encrypted:	false
SSDEEP:	768:Own95cdyYloiwQ+QxbxHit8EnM+iIZtjD/mSH7bg3k6Ba:O+5cdyeoiwQ+QxbxHit8EnM+iIZt4NBa
MD5:	DE1A94F92B89C48D225988F88B9BEE39
SHA1:	9726C95DFE6A2F0F33AE71AEEAF045A66E46A133
SHA-256:	6C333C9858721D3AB31286CF7110B696146E4AE466189048E1ED1A30C9D7230D
SHA-512:	DAA702A5F7BB6F5B961158148EC823589F1268A13A181FD569857DCF2D186702B5087FB11D2EB9E1554836F9D2BFF39961E4C4889A21AA063E458F6EE18BB555
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PORTSA64.DLL (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64104
Entropy (8bit):	5.932012342855659
Encrypted:	false
SSDEEP:	768:mUzmxxqC8o2bshUK5AiPZhVWu19IWMytrEIfB2pYoste87b3IdclQ9za0:mYmxglnEJPVW49IW5tYIEateobWzv
MD5:	296618273185A983BD5B9E469AF2D972
SHA1:	95989164BE63DFD95C829788400BC32CB84AD65A
SHA-256:	4DD21860B264A5C4B4040F19F6EE41B886704EF44DA88BCADC5EC7060EBF9126
SHA-512:	BF6BCA479BB5018D417CCAAB20D881DEFBB154ADDB9CE073623FD4E9048F380A73DB50967D871677023A74D2FFDED3C0B2686F7972C55E25297A987FB1820380
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................................................................0..................../..............h(......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PT.DLL (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341PTA64.DLL (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56424
Entropy (8bit):	6.439469401329907
Encrypted:	false
SSDEEP:	768:6Jb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jfnb3IMoDlQ9za5G:AfOJbqbKdmv04Tfnb77z7
MD5:	7C40C2737E1A567B4E1FC62952BC90CE
SHA1:	18BDDB57C4B2F818DBCA82E6BFD0E7547D6836F5
SHA-256:	1687B96846734B1E44F4581F90C0144962189847E78EF9151F025FE39DE1D53B
SHA-512:	E0C820F0F3EBEB4CD787DC68844A95E5BC187D6542C7DA9FCF6636B065443EEECA4C1C541D549EAC57500629B0D021596C555EFDA86AC586272F8316D7EA9FE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T.......h(..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341S64.SYS (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.300532218398393
Encrypted:	false
SSDEEP:	1536:L+D98L1mOgrk9w1qw6zZ8vjWxFzImYotsb8lCzD:CR4mOyJ1tjat3smCf
MD5:	BB4221657D3170F409F058690FD8DA0B
SHA1:	FCFECF503BAB0801C7BFDD417A6AB4E0758D8177
SHA-256:	FA525D2F23BCD50F4DA42B6C38A0D87E93FEAFF672A44083473CE19EC633B483
SHA-512:	771D5591F87A62E2D0E2E126F863A4E537CE7E4D7B347E6B29B21446923AEBE7F15C41E5FA253600A3CBD50A3FFC44D21AB91D7D2F16F37B4E8258B5287DE527
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P.......V......................................................L#..P....0..`...............H(...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341SER.CAT (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	16315
Entropy (8bit):	7.0158931388032935
Encrypted:	false
SSDEEP:	192:/yv54p+ddKXaNaA4Og/PBJllnEX8hyFIFIOcDF1agjEwOXP6hYCEJpq21eX01k9E:QrBwEsP6/k6h3Ypl8R9z/Cx
MD5:	09D2102BACD78C7C0A53F63E1CE3DB07
SHA1:	2F66B041A4FCA2ADFDF89F88A1DE156CD330B67F
SHA-256:	20D39AF89440A1C85016FB064CA49A40D92C874546CB4A0551023DCB64B85D51
SHA-512:	B0DD37814FB96378A8BF07B34A57D6501DA54FD2E6A52D19F86AE88C6014C9F8C18491BFA6140ED552D50B0DF54328B92E465FBC76738B48616C379DF6BDCB74
Malicious:	false
Preview:	0.?....H........?.0.?....1.0...`.H.e......0.....+.....7......0...0...+.....7.......&m@.T.i.....220302065955Z0...+.....7.....0...0.... .%p-T...v.iH...2R..d.?....U.k.G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .%p-T...v.iH...2R..d.?....U.k.G.0.... .." ...t^.h.iJ..k..............1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........c.h.3.4.1.s.9.8...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .." ...t^.h.iJ..k..............0....&.e...v..~.....o1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0....&.MI.z^.dc.9.[..G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........c.h.3.4.1

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\CH341SER.INF (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD5FF.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	16315
Entropy (8bit):	7.0158931388032935
Encrypted:	false
SSDEEP:	192:/yv54p+ddKXaNaA4Og/PBJllnEX8hyFIFIOcDF1agjEwOXP6hYCEJpq21eX01k9E:QrBwEsP6/k6h3Ypl8R9z/Cx
MD5:	09D2102BACD78C7C0A53F63E1CE3DB07
SHA1:	2F66B041A4FCA2ADFDF89F88A1DE156CD330B67F
SHA-256:	20D39AF89440A1C85016FB064CA49A40D92C874546CB4A0551023DCB64B85D51
SHA-512:	B0DD37814FB96378A8BF07B34A57D6501DA54FD2E6A52D19F86AE88C6014C9F8C18491BFA6140ED552D50B0DF54328B92E465FBC76738B48616C379DF6BDCB74
Malicious:	false
Preview:	0.?....H........?.0.?....1.0...`.H.e......0.....+.....7......0...0...+.....7.......&m@.T.i.....220302065955Z0...+.....7.....0...0.... .%p-T...v.iH...2R..d.?....U.k.G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .%p-T...v.iH...2R..d.?....U.k.G.0.... .." ...t^.h.iJ..k..............1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........c.h.3.4.1.s.9.8...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .." ...t^.h.iJ..k..............0....&.e...v..~.....o1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$c.h.3.4.1.p.o.r.t.s.a.6.4...d.l.l...0....&.MI.z^.dc.9.[..G.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........c.h.3.4.1

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD62F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9299
Entropy (8bit):	5.8502168329382425
Encrypted:	false
SSDEEP:	192:hL6lCs/xMhpevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSMQYQLhQfQYh6AT5wN:QCs/xMhpevOsbEQQekF2TvyhVFuDISMO
MD5:	56009741AD41557F3E809F1775BDF812
SHA1:	466088EC3BC3A2AB757CBFCDC6E28992ACF12A4D
SHA-256:	8EF3F56E2188549B0E10FE7F7E8AFF2EBA27435A0FC8B906671FFE926DD67340
SHA-512:	8ABC61664B614F98042C357920516F8C7CA45448A64B45F12184F9CDAC50DC1A020A50AB9F4DDFFE03026B7F9AC84B9172FD56FF13DD62D5964402E675DAE3D7
Malicious:	false
Preview:	; CH341SER.INF..; Driver for CH340/CH341 (USB=>SERIAL chip) V3.7..; WDM&VXD for Windows 98/Me/2000/XP/Vista/7/8/8.1/10/11/SERVER 2003/2008/2012/2016/2019/2022..; Copyright (C) W.ch 2001-2022..;....[Version]..Signature = "$Chicago$"..Class = Ports..ClassGuid = {4D36E978-E325-11CE-BFC1-08002BE10318}..Provider = %WinChipHead%..DriverVer = 01/18/2022, 3.7.2022.01..CatalogFile =CH341SER.CAT......[ControlFlags]..ExcludeFromSelect = USB\VID_1A86&PID_7523..ExcludeFromSelect = USB\VID_1A86&PID_5523..ExcludeFromSelect = USB\VID_1A86&PID_7522..ExcludeFromSelect = USB\VID_1A86&PID_E523..ExcludeFromSelect = USB\VID_4348&PID_5523..ExcludeFromSelect = USB\VID_4348&PID_5523&REV_0250..ExcludeFromSelect = USBSERPORT\SER5523..ExcludeFromSelect = CH341PORT\SER5523....[Manufacturer]..%WinChipHead% = WinChipHead,NT,NTamd64,NTia64,NTARM64....[WinChipHead]..%CH340SER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_7523..%CH341ASER.DeviceDesc% = CH341SER_Install, USB\VID_1A86&PID_5523..%CH340KS

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD66E.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56424
Entropy (8bit):	6.439469401329907
Encrypted:	false
SSDEEP:	768:6Jb6OdI4oHCOE6dJjHqnbKdmCS12393K4E0rgp+2Jfnb3IMoDlQ9za5G:AfOJbqbKdmv04Tfnb77z7
MD5:	7C40C2737E1A567B4E1FC62952BC90CE
SHA1:	18BDDB57C4B2F818DBCA82E6BFD0E7547D6836F5
SHA-256:	1687B96846734B1E44F4581F90C0144962189847E78EF9151F025FE39DE1D53B
SHA-512:	E0C820F0F3EBEB4CD787DC68844A95E5BC187D6542C7DA9FCF6636B065443EEECA4C1C541D549EAC57500629B0D021596C555EFDA86AC586272F8316D7EA9FE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...${.${.${.$z..${.....${.....${.....${.....${.C+%.${.....${.Rich.${.........PE..d......b.........." .........>................@.....................................................................................0..........................T.......h(..........@................................................................................text.............................. ..`.data..../..........................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD6FC.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD75A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.300532218398393
Encrypted:	false
SSDEEP:	1536:L+D98L1mOgrk9w1qw6zZ8vjWxFzImYotsb8lCzD:CR4mOyJ1tjat3smCf
MD5:	BB4221657D3170F409F058690FD8DA0B
SHA1:	FCFECF503BAB0801C7BFDD417A6AB4E0758D8177
SHA-256:	FA525D2F23BCD50F4DA42B6C38A0D87E93FEAFF672A44083473CE19EC633B483
SHA-512:	771D5591F87A62E2D0E2E126F863A4E537CE7E4D7B347E6B29B21446923AEBE7F15C41E5FA253600A3CBD50A3FFC44D21AB91D7D2F16F37B4E8258B5287DE527
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..%..%..%..$..%.=^...%.=X..%.=H..%.0.{..%.=]..%.Rich.%.........................PE..d......b.........."..........,.......".......................................P.......V......................................................L#..P....0..`...............H(...@.......................................................................................text...~........................... ..h.rdata..L...........................@..H.data...............................@....pdata..............................@..HINIT....d.... ...................... ....rsrc...`....0......................@..B.reloc..<....@......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{4c235721-279b-e440-9ea0-d7fb75483a24}\SETD7AA.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64104
Entropy (8bit):	5.932012342855659
Encrypted:	false
SSDEEP:	768:mUzmxxqC8o2bshUK5AiPZhVWu19IWMytrEIfB2pYoste87b3IdclQ9za0:mYmxglnEJPVW49IW5tYIEateobWzv
MD5:	296618273185A983BD5B9E469AF2D972
SHA1:	95989164BE63DFD95C829788400BC32CB84AD65A
SHA-256:	4DD21860B264A5C4B4040F19F6EE41B886704EF44DA88BCADC5EC7060EBF9126
SHA-512:	BF6BCA479BB5018D417CCAAB20D881DEFBB154ADDB9CE073623FD4E9048F380A73DB50967D871677023A74D2FFDED3C0B2686F7972C55E25297A987FB1820380
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...T...(..."-.E..."-.V..."-.U..."-.X.......U..."-.U...RichT...................PE..d.....b.........." .........L.......~........@.....................................................................................0..................../..............h(......8....................................................................................text.............................. ..`.data...............................@....pdata..............................@..@.rsrc..../.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\SETE7D4.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11333
Entropy (8bit):	6.787341487288969
Encrypted:	false
SSDEEP:	192:8beQEeyM/W84ewtxO2hECwkY8TE0rrr8RVcdh+3Ef5KYpBjSA6L24Y:8Kl8ilwk4C+3Ef5dpBjhR4Y
MD5:	BEFE6327722742CD1424B739BC8F5CFA
SHA1:	C3F899399BF59E9890C654670B15E364628DB4A9
SHA-256:	C135F73366AAC8FE95FE3285D05A3EFA76C0054DF677BAC3E308E7DC82A58BC0
SHA-512:	0E0158FF5C583714BABD8EA0FCDA4AB203A4EF747F57AE6BAD2A4C5C866B8F183D592495B9281E85CCFF589520942607BB7F412D641A25F3CD252F4DF63067B7
Malicious:	false
Preview:	0.,A..*.H........,20.,....1.0...+......0.....+.....7......0...0...+.....7.....%...$.L..L5.Af...140411202803Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0....R1.4.F.E.2.4.4.3.3.3.8.2.1.6.4.D.5.3.B.5.B.9.3.0.8.4.4.B.7.8.4.7.C.7.B.0.7.2.6.5...1..o0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........$C3..MS..0.KxG.re0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\SETE7E5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\slabvcp.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11333
Entropy (8bit):	6.787341487288969
Encrypted:	false
SSDEEP:	192:8beQEeyM/W84ewtxO2hECwkY8TE0rrr8RVcdh+3Ef5KYpBjSA6L24Y:8Kl8ilwk4C+3Ef5dpBjhR4Y
MD5:	BEFE6327722742CD1424B739BC8F5CFA
SHA1:	C3F899399BF59E9890C654670B15E364628DB4A9
SHA-256:	C135F73366AAC8FE95FE3285D05A3EFA76C0054DF677BAC3E308E7DC82A58BC0
SHA-512:	0E0158FF5C583714BABD8EA0FCDA4AB203A4EF747F57AE6BAD2A4C5C866B8F183D592495B9281E85CCFF589520942607BB7F412D641A25F3CD252F4DF63067B7
Malicious:	false
Preview:	0.,A..*.H........,20.,....1.0...+......0.....+.....7......0...0...+.....7.....%...$.L..L5.Af...140411202803Z0...+.....7.....0...0....R0.5.6.3.9.9.F.A.A.C.B.9.F.C.4.9.F.3.C.F.7.8.B.F.C.3.D.9.F.2.F.4.6.3.E.5.0.1.2.E...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........c.....I..x.....c...0R..+.....7...1D0B...F.i.l.e.......0w.d.f.c.o.i.n.s.t.a.l.l.e.r.0.1.0.0.9...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0....R1.4.F.E.2.4.4.3.3.3.8.2.1.6.4.D.5.3.B.5.B.9.3.0.8.4.4.B.7.8.4.7.C.7.B.0.7.2.6.5...1..o0<..+.....7...1.0,...F.i.l.e........s.i.l.a.b.e.n.m...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........$C3..MS..0.KxG.re0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\slabvcp.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.568267099533436
Encrypted:	false
SSDEEP:	96:7OvOAhHaqZJeMhdhpTCs1ojH4SvDivhacp1t1h0tHXBiKLc9/lOdFKuzg:iOAhHaUJeMhdhpTCsuz4SvDivhacpH1P
MD5:	33AE925DB013D95DD5EA91A9597A8020
SHA1:	B97004A400E30DCF940971EFA7A0C13C6B0A4B66
SHA-256:	9AE433C70B360CF6E1A4219BDC00014AED4257BCB64BF08CB85331E33EE63D85
SHA-512:	CDC40E9D91ABB9AC9C897AF70BB3B769F746B126EE3BC9A2B6981E0AD0A9ED7B362DB4B8AE3EFB8248E10BC913B708B8275F93F9BA90CD12543C761A16461296
Malicious:	false
Preview:	;/++..;..;Module Name:..;..; SLABVCP.INF..;..; Copyright 2013, Silicon Laboratories..;..;Abstract:..; Installation INF for Silicon Laboratories CP210x device using KDMF Version 1.9..;..;--/....[Version]..Signature="$WINDOWS NT$"..Class=Ports..ClassGuid={4D36E978-E325-11CE-BFC1-08002BE10318}..Provider=%Provider%..DriverVer=03/19/2014,6.7.0.0..CatalogFile=slabvcp.cat......; ================= Device section =====================....[Manufacturer]..%MfgName%=SiLabs, NTamd64....[SiLabs]..%USB\VID_10C4&PID_EA60.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA60..%USB\VID_10C4&PID_EA70&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_00..%USB\VID_10C4&PID_EA70&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA70&Mi_01..%USB\VID_10C4&PID_EA71&Mi_00.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_00..%USB\VID_10C4&PID_EA71&Mi_01.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_01..%USB\VID_10C4&PID_EA71&Mi_02.DeviceDesc%=silabser.Dev, USB\VID_10C4&PID_EA71&Mi_02..%USB\VID_

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE745.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.814741197269295
Encrypted:	false
SSDEEP:	384:i6oIhnyUR2OZRy0m1KcQGd/V3nL7fVRQlQeddvuVyxxTWBU/T:iIZygU31Kcl/V3L7f4esv2+/T
MD5:	8C61B219882C9C9ECA09BEDB82B0DDB1
SHA1:	52A5AF0ACA9124C2AB39029761A7662ADC8C5861
SHA-256:	711681040D9CD93D603F55AB8D62371F5D51917C14818F27859E23E2D60EB18F
SHA-512:	67CCDB25B31DCB5FA4FC900898B7078F3932FA74C7159F93E592E6DD3054526ED37328C8A8466F0987901D4D432AB9735439AFFDAD5FFC4E9E4CF97253A54E54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d...=.ES.........."......J..........................................................#...........................................................(............P.......................1...............................................0...............................text...f........................... ..h.rdata.......0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE755.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.088944190023996
Encrypted:	false
SSDEEP:	1536:oaTuFs5UbmggODbmZJxRXOibxoCGxe14TNYy/PfBY0SttXpXcnxv86f1Sx:fks5Ubmm+xnxoCGxe14TNYy/PfBUtHAs
MD5:	2641655FAD6C1EA0F3677978E2BF28C1
SHA1:	09627D2AAF886E132136AD10C19282F809E06CA1
SHA-256:	E703CE74D09E901BF531589E181DCF95B9C63E09FE1B99E38DEA9EE47EE458BA
SHA-512:	C024E241D8E9768D28B854D61DD41A8C61094C106C616742D81A7DFC4BA7C3FF27A2433456DA952D193D34449A2E11374FAC92AD008CE8C35B67A74DDC1192BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xnu.Xnu.Xnu.Q...[nu.Q...[nu.Q...[nu.Q...Znu.Xnt.Dnu.....]nu.....Ynu.Q...Unu.Q...Znu.....Ynu.Q...Knu.Q...Ynu.Q...Ynu.RichXnu.........................PE..d...;.ES.........."..........,......................................................L.......................................................$...P...............................8....................................................................................text...?........................... ..h.rdata..............................@..H.data...t...........................@....pdata..............................@..HPAGESRP0#<... ...>.................. ..`PAGE....~....`....... .............. ..`PAGESER......p.......".............. ..`INIT.................&.............. ....rsrc................0..............@..B.reloc...............4..............@..B........................................................

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\SETE775.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\WdfCoinstaller01009.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721576
Entropy (8bit):	7.978334410477683
Encrypted:	false
SSDEEP:	24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
MD5:	4DA5DA193E0E4F86F6F8FD43EF25329A
SHA1:	68A44D37FF535A2C454F2440E1429833A1C6D810
SHA-256:	18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
SHA-512:	B3D73ED5E45D6F2908B2F3086390DD28C1631E298756CEE9BDF26B185F0B77D1B8C03AD55E0495DBA982C5BED4A03337B130C76F7112F3E19821127D2CF36853
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.v...%...%...%.m+%...%.m:%...%...% ..%.m-%...%.m=%...%.m,%...%.m7%...%...%...%.m%...%.m/%...%Rich...%........................PE..d.....[J.........." .........0............................................................@.........................................`................p..l!...`..,....,...............................................................................................text...L........................... ..`.data....J..........................@....pdata..,....`......................@..@.rsrc...l!...p..."..................@..@.reloc.............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabenm.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.814741197269295
Encrypted:	false
SSDEEP:	384:i6oIhnyUR2OZRy0m1KcQGd/V3nL7fVRQlQeddvuVyxxTWBU/T:iIZygU31Kcl/V3L7f4esv2+/T
MD5:	8C61B219882C9C9ECA09BEDB82B0DDB1
SHA1:	52A5AF0ACA9124C2AB39029761A7662ADC8C5861
SHA-256:	711681040D9CD93D603F55AB8D62371F5D51917C14818F27859E23E2D60EB18F
SHA-512:	67CCDB25B31DCB5FA4FC900898B7078F3932FA74C7159F93E592E6DD3054526ED37328C8A8466F0987901D4D432AB9735439AFFDAD5FFC4E9E4CF97253A54E54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."..eL.eL.eL.eM.eL...7.eL...1.eL....eL....eL...!.eL....eL....eL....eL.Rich.eL.........................PE..d...=.ES.........."......J..........................................................#...........................................................(............P.......................1...............................................0...............................text...f........................... ..h.rdata.......0......................@..H.data........@......................@....pdata.......P....... ..............@..HPAGE....M....`.......".............. ..`PAGESENM.............<.............. ..`INIT....d............P.............. ....rsrc................X..............@..B........................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9dbe3dcc-aac2-3347-bacd-266adbab13bb}\x64\silabser.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.088944190023996
Encrypted:	false
SSDEEP:	1536:oaTuFs5UbmggODbmZJxRXOibxoCGxe14TNYy/PfBY0SttXpXcnxv86f1Sx:fks5Ubmm+xnxoCGxe14TNYy/PfBUtHAs
MD5:	2641655FAD6C1EA0F3677978E2BF28C1
SHA1:	09627D2AAF886E132136AD10C19282F809E06CA1
SHA-256:	E703CE74D09E901BF531589E181DCF95B9C63E09FE1B99E38DEA9EE47EE458BA
SHA-512:	C024E241D8E9768D28B854D61DD41A8C61094C106C616742D81A7DFC4BA7C3FF27A2433456DA952D193D34449A2E11374FAC92AD008CE8C35B67A74DDC1192BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xnu.Xnu.Xnu.Q...[nu.Q...[nu.Q...[nu.Q...Znu.Xnt.Dnu.....]nu.....Ynu.Q...Unu.Q...Znu.....Ynu.Q...Knu.Q...Ynu.Q...Ynu.RichXnu.........................PE..d...;.ES.........."..........,......................................................L.......................................................$...P...............................8....................................................................................text...?........................... ..h.rdata..............................@..H.data...t...........................@....pdata..............................@..HPAGESRP0#<... ...>.................. ..`PAGE....~....`....... .............. ..`PAGESER......p.......".............. ..`INIT.................&.............. ....rsrc................0..............@..B.reloc...............4..............@..B........................................................

C:\Windows\System32\Drivers\CH341S98.SYS (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	49000
Entropy (8bit):	7.195874710869751
Encrypted:	false
SSDEEP:	768:DiesSVTZm2ULz4A27wTDvJb35j05sN9zDkb38ZPZ9z/1e:DNDmYwTtbpQyvzDkbsz/A
MD5:	37F0CACF04978F4F3166ED1510A98DB7
SHA1:	B62B0BBA39ABFE493D462BD409F2D31B4A2A4A39
SHA-256:	05EA22E94C933A16B283467BDD7AF2C9F978E9C386BCA5FEC8EBE7255EA6B7FB
SHA-512:	41D5DF8A26856C02F6333D364819F32E7EB9529DE71FE1ADEE8A1FDFB44E1632C66403CD2ADF00B50A51A7C149A9D4B6E36794EB789F4E41033062B10C7CE655
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I......}t...............................<..U...X>..<....C..`............L...r..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\Windows\System32\Drivers\CH341SER.SYS (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\SETDCE5.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDD06.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDD85.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDD95.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDE05.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDE25.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDED3.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETDF03.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETE2BE.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETE2DE.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETE37C.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETE38D.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\SETE3CC.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\Windows\System32\SETE44B.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4554
Entropy (8bit):	5.38434561341136
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3hpTpbCpEpDk+psNVpsL1:QO00eO00erMwmkB1kAIrN4B
MD5:	B49D4F3392B81A34D44EC47C139DEFE1
SHA1:	60F725E22F280192779229EAF838E0800B7B8859
SHA-256:	6BE66C7D290CD2FE80559F666ABEA6B128218476C5220150D1666ADBE7FCC7C8
SHA-512:	944FDD211E1B613533857DF8AE27A3F38B142C766AA90667BFB20157327278D1B45F10856A71CC4FBA9C15E7FCF6044A03D03E1BBEFB1B03961BC80B4C5693C7
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SETDCC5.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\drivers\SETDD64.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\drivers\SETDDE4.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\drivers\SETDEB2.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\drivers\SETE2AD.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\drivers\SETE35C.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\System32\drivers\SETE40C.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	49000
Entropy (8bit):	7.195874710869751
Encrypted:	false
SSDEEP:	768:DiesSVTZm2ULz4A27wTDvJb35j05sN9zDkb38ZPZ9z/1e:DNDmYwTtbpQyvzDkbsz/A
MD5:	37F0CACF04978F4F3166ED1510A98DB7
SHA1:	B62B0BBA39ABFE493D462BD409F2D31B4A2A4A39
SHA-256:	05EA22E94C933A16B283467BDD7AF2C9F978E9C386BCA5FEC8EBE7255EA6B7FB
SHA-512:	41D5DF8A26856C02F6333D364819F32E7EB9529DE71FE1ADEE8A1FDFB44E1632C66403CD2ADF00B50A51A7C149A9D4B6E36794EB789F4E41033062B10C7CE655
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I......}t...............................<..U...X>..<....C..`............L...r..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\Windows\System32\drivers\SETE49A.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	49000
Entropy (8bit):	7.195874710869751
Encrypted:	false
SSDEEP:	768:DiesSVTZm2ULz4A27wTDvJb35j05sN9zDkb38ZPZ9z/1e:DNDmYwTtbpQyvzDkbsz/A
MD5:	37F0CACF04978F4F3166ED1510A98DB7
SHA1:	B62B0BBA39ABFE493D462BD409F2D31B4A2A4A39
SHA-256:	05EA22E94C933A16B283467BDD7AF2C9F978E9C386BCA5FEC8EBE7255EA6B7FB
SHA-512:	41D5DF8A26856C02F6333D364819F32E7EB9529DE71FE1ADEE8A1FDFB44E1632C66403CD2ADF00B50A51A7C149A9D4B6E36794EB789F4E41033062B10C7CE655
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I......}t...............................<..U...X>..<....C..`............L...r..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\Windows\Temp\OLDDD52.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\Temp\OLDDD72.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDDD92.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDDDD2.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\Temp\OLDDDF2.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDDE12.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDDE90.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\Temp\OLDDEC0.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDDEF0.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDE29A.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\Temp\OLDE2AB.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDE2CB.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDE349.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53856
Entropy (8bit):	6.6764425960622935
Encrypted:	false
SSDEEP:	1536:lXcnMopetEcOgeWSr9sPY5fCYs6q/ZRrnTqHc+O2b4Dozs:EMopaEcbehr9sPFTbTqHc+O2IoA
MD5:	738FF3B21A5C8035ED431DDE499B0EDF
SHA1:	FB0BB5D0DA30B75966089C252C1638B52A9D2BD3
SHA-256:	26AF8C3A4E2B648C0F0D096E5E052A454A2DF2F5403500B8DFB8FD6A4979B4F6
SHA-512:	BEE9064F6745639024FC456EBCB4AAC9B87EECC05792B71B5C438A2B6E814E5CB3164C58E42B8BB42A64773C359370518B0C1982AD91B7D0272E8B0699FA03FE
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................6..OW..OW..OW..OW...W...t..FW..._.NW...X.NW...X.NW...X.NW..RichOW..........................PE..L......b.......................................................................................................................d.......8...............`(......L...@...................................................<............................text...\........................... ..h.rdata..X...........................@..H.data...@...........................@...INIT....................

C:\Windows\Temp\OLDE36A.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDE37A.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\OLDE437.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

C:\Windows\Temp\OLDE476.tmp

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (native) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	49000
Entropy (8bit):	7.195874710869751
Encrypted:	false
SSDEEP:	768:DiesSVTZm2ULz4A27wTDvJb35j05sN9zDkb38ZPZ9z/1e:DNDmYwTtbpQyvzDkbsz/A
MD5:	37F0CACF04978F4F3166ED1510A98DB7
SHA1:	B62B0BBA39ABFE493D462BD409F2D31B4A2A4A39
SHA-256:	05EA22E94C933A16B283467BDD7AF2C9F978E9C386BCA5FEC8EBE7255EA6B7FB
SHA-512:	41D5DF8A26856C02F6333D364819F32E7EB9529DE71FE1ADEE8A1FDFB44E1632C66403CD2ADF00B50A51A7C149A9D4B6E36794EB789F4E41033062B10C7CE655
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4.Y.Z.Y.Z.Y.Z.Y.[...Z...I.Z.Z...I.X.Z...\.X.Z.Y.Z.\.Z.RichY.Z.................PE..L....`nF...........#.....>..........X=.......;...... ... ...................@I......}t...............................<..U...X>..<....C..`............L...r..`F..\|...p...8............................................................................text....9...... 9.................. ..h.data........;.......;..............@....edata..U....<..`....<..............@..@INIT........@=......@=.............. ....rsrc...`....C..`....C..............@..B.reloc......`F......`F..............@..B.........B...B......f?...?...?...?...?...?...?...@...@..6@..R@..n@..\|@...@...@...@...@..X?...A...A..&A..<A..NA..^A..vA...A...A...A...A...A...B...B..4B..JB..fB..F?...@..<?...................`nF................@I.......`nF................PJ.......`nF.................b..................>0.s.E=s;8\F.O../J?.

C:\Windows\system32\CH341PORTS.DLL (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51776
Entropy (8bit):	5.975093773653744
Encrypted:	false
SSDEEP:	768:GqDaOxPpFSE2RdgxOGdlBLSCHh5B2pYo3Uamb3YrD:GqDzxPzSE2ROxOGLoCBmd6bSD
MD5:	15A6692948DAD7BD3AC9ECF1C37D12D6
SHA1:	CC81FD61A95B88E88926444A659D99B4A63B26D0
SHA-256:	4276870423FD58F605800BB97A1E41F82DBFADD8CAC8279AED475972195C7073
SHA-512:	99A7670C11B29434E59DC022B95DAEC12D12220287A019FCF393CAE95A785B996D37D9CD865BC781FD7D0898F95343A16856F99DE7E2A87A5D1C0A7CAFBCC2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..oo.<o.<o.<6.<c.<..<n.<o.<..<...<l.<...<n.<...<n.<...<e.<...<n.<...<n.<Richo.<................PE..L.....b...........!.....`...D.......a.......p....@..................................I...............................m.......b..........X/..............@$......d....................................................................................text...q^.......`.................. ..`.data........p.......d..............@....rsrc...X/.......0...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\system32\CH341PT.DLL (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38992
Entropy (8bit):	6.833987991832126
Encrypted:	false
SSDEEP:	768:ZMEkglK8Gg/axr0GQQ6mJC0eTWWxF5wKjnmEvStb3EvxLVNe9zSC:aE/UexFtnZ6tbonNazSC
MD5:	060E5A252884FD5FA69576B506A5E0C3
SHA1:	8CB306D9FA8498A3FD4C3CA3AB1477882606C471
SHA-256:	B5FBFEFC6E8BA8D4FE571BFB46F48DC160C0427508D758EB54B827C9CD1A1968
SHA-512:	137FF2BDF0ADEE5B3C781C8C32F12C724D0DE3F40CF492E54F030CD30BB8635AAB1CFC889E67E104C88456AADE098E2556F30309A3FDDDC431070187CF807D43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.n.C.n.C.n...}.K.n...a.A.n.C.o.v.n...3.@.n..1.B.n...2.B.n...1.G.n...0.B.n...4.B.n.RichC.n.........................PE..L......b...........!.....`...2...............p....@.................................J................................h......@c..x....................p..P(...........................................................................................text...u^.......`.................. ..`.data....'...p.......d..............@....rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\system32\CH341SER.VXD (copy)

Download File

Process:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
File Type:	MS-DOS executable, LE executable for MS Windows (VxD)
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	5.450760869632819
Encrypted:	false
SSDEEP:	384:GzXpHVPakjq16uZuDxqLOvCxXEAjT90DVBAMBTaU:05Hr+EGlXbT9uAQGU
MD5:	BE7438420F1DA854917F58CAD557476D
SHA1:	CAF1095963459AB66326CDC7ECAB29514938748F
SHA-256:	2A946F316EDD7E1185DEEAFDC2DE52B2D2843198BE098A724233C12F9CCD0DAE
SHA-512:	E35442704374A3B5E79BAD491F819AC82CE3054ED50AE1EEF0FC3ACBB6D3016BDBCDD63902236E247CB4B8279FF8FEC377AFA2753EBDBCA911D6D388D23A63DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;.A.U.A.U.A.U.G._.E.U.G.^.D.U.A.U.\.U.RichA.U.........................LE......................................................................................p...\|...................u.......u................L..%............................................L..........D:......E ..........LCOD......... ..........ICOD.............................................................................................................................CH341SER........\........................"..."..."..."..."...)...a...a...v...v...v...............`.......C.......:...............!...D...e...e...o.....t...0..P..p$..L..`$..H.. $..D..0!..@... ..<... '....24.....0......,......(..@.'....2 .$........................P.........................................P...... ......0.............@...........................P...... ......@......P........'.......X......`.'....1l.8.\.`.d.h.l.p.x.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999923625617077
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ElitechLogWin V6.4.6.exe
File size:	65'387'183 bytes
MD5:	652fe95cae571a325a6280df4447331c
SHA1:	50881a81da3d08a290765d540642faa3399c06e0
SHA256:	fb04a9a86ca842cc76ea7a75a2ef18e85821370893f854f432e8965d1a919433
SHA512:	3fd7ccf71a7ea1f8308eff762e37837e8f54d2fbd2f7c0c276de7a3e458a525e05aab7c6a1c58217e6d05c9f8c2e341b0ab593e9e23a80785745e5260630199e
SSDEEP:	1572864:5yLzmxBGrS4JklnG+l+Mp/KwSoe1h+58I:VpIh/I
TLSH:	00E7338993E3C27CE417D174956B00287FA878A2B1E56E1D9D7CCD6E52BE3878830DC9
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4117dc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x57051F88 [Wed Apr 6 14:39:04 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	20dd26497880c05caed9305b3c8b9109

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 00410144h
call 00007FBE0CBF4B1Dh
xor eax, eax
push ebp
push 00411EBEh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00411E7Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [00415B48h]
call 00007FBE0CBFD263h
call 00007FBE0CBFCDB2h
cmp byte ptr [00412ADCh], 00000000h
je 00007FBE0CBFFD5Eh
call 00007FBE0CBFD378h
xor eax, eax
call 00007FBE0CBF2BB5h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FBE0CBF9DFBh
mov edx, dword ptr [ebp-14h]
mov eax, 00418658h
call 00007FBE0CBF318Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [00418658h]
mov dl, 01h
mov eax, dword ptr [0040C04Ch]
call 00007FBE0CBFA712h
mov dword ptr [0041865Ch], eax
xor edx, edx
push ebp
push 00411E26h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FBE0CBFD2D6h
mov dword ptr [00418664h], eax
mov eax, dword ptr [00418664h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FBE0CBFFD9Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19000	0xe04	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0xb200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1b000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19304	0x214	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf244	0xf400	a33e9ff7181115027d121cd377c28c8f	False	0.5481717469262295	data	6.3752135040515485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x11000	0xf64	0x1000	caec456c18277b579a94c9508daf36ec	False	0.55859375	data	5.732200666157372	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0xc88	0xe00	746954890499546d73dce0e994642192	False	0.2533482142857143	data	2.2967209087898324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x13000	0x56bc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x19000	0xe04	0x1000	e9b9c0328fd9628ad4d6ab8283dcb20e	False	0.321533203125	data	4.597812557707959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1a000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1b000	0x18	0x200	3dffc444ccc131c9dcee18db49ee6403	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0xb200	0xb200	2ba58ac6d953454e4dcbe36a72aeb7fe	False	0.17839273174157302	data	4.144480222996729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1c41c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1c544	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x1caac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x1cd94	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x1d63c	0x68	data			0.6538461538461539
RT_STRING	0x1d6a4	0xd4	data			0.5283018867924528
RT_STRING	0x1d778	0xa4	data			0.6524390243902439
RT_STRING	0x1d81c	0x2ac	data			0.45614035087719296
RT_STRING	0x1dac8	0x34c	data			0.4218009478672986
RT_STRING	0x1de14	0x294	data			0.4106060606060606
RT_RCDATA	0x1e0a8	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x26390	0x10	data			1.5
RT_RCDATA	0x263a0	0x150	data			0.8392857142857143
RT_RCDATA	0x264f0	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x2651c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x2655c	0x4f4	data	English	United States	0.27917981072555204
RT_MANIFEST	0x26a50	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 17:45:07.879901886 CEST	53	54201	162.159.36.2	192.168.2.4
Oct 8, 2024 17:45:08.420638084 CEST	62631	53	192.168.2.4	1.1.1.1
Oct 8, 2024 17:45:08.428343058 CEST	53	62631	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 17:45:08.420638084 CEST	192.168.2.4	1.1.1.1	0xe37e	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 17:45:08.428343058 CEST	1.1.1.1	192.168.2.4	0xe37e	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	11:44:33
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe"
Imagebase:	0x400000
File size:	65'387'183 bytes
MD5 hash:	652FE95CAE571A325A6280DF4447331C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:44:33
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PF8BI.tmp\ElitechLogWin V6.4.6.tmp" /SL5="$20444,64977810,121344,C:\Users\user\Desktop\ElitechLogWin V6.4.6.exe"
Imagebase:	0x400000
File size:	1'179'648 bytes
MD5 hash:	90FC739C83CD19766ACB562C66A7D0E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:44:54
Start date:	08/10/2024
Path:	C:\ElitechLogWin\Drivers\CH341\SETUP.EXE
Wow64 process (32bit):	true
Commandline:	"C:\ElitechLogWin\Drivers\CH341\SETUP.exe" /S
Imagebase:	0x400000
File size:	90'752 bytes
MD5 hash:	3A5073FC9D6E4A7102A97E8A971AE6DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:44:55
Start date:	08/10/2024
Path:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.exe
Wow64 process (32bit):	false
Commandline:	C:\ElitechLogWin\Drivers\CH341\DRVSETUP64\DRVSETUP64.EXE \s
Imagebase:	0x1000000
File size:	51'328 bytes
MD5 hash:	39F706639A8E235BFDFE9735E178E6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:44:58
Start date:	08/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	true
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{94a1b697-dd28-de4e-a85e-00e6b0e0107b}\CH341SER.INF" "9" "4a0278e77" "000000000000015C" "WinSta0\Default" "0000000000000164" "208" "C:\ElitechLogWin\Drivers\CH341\WIN 1X"
Imagebase:	0xa90000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:45:00
Start date:	08/10/2024
Path:	C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ElitechLogWin\Drivers\CP210x\CP210xVCPInstaller_x64.exe" /S
Imagebase:	0x7ff779870000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:45:02
Start date:	08/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "8" "C:\Users\user\AppData\Local\Temp\{2f13b34c-0ba8-f847-b9c7-ad55e9c92521}\slabvcp.inf" "9" "43ef4524b" "0000000000000168" "WinSta0\Default" "0000000000000118" "208" "c:\elitechlogwin\drivers\cp210x"
Imagebase:	0x7ff6a8dd0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.2%
Total number of Nodes:	1332
Total number of Limit Nodes:	15

Executed Functions

Function 00401970 Relevance: 49.6, APIs: 14, Strings: 14, Instructions: 563
stringwindowprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,00000000), ref: 004019B8
GetProcAddress.KERNEL32(00000000), ref: 004019BF
GetCurrentProcess.KERNEL32(?,?,00000000), ref: 004019D4
lstrlenA.KERNEL32(?,00000000), ref: 00401A49
WinExec.KERNEL32(?,00000001), ref: 00401BCA
MessageBoxA.USER32(00000000,Not found install application,please install by hand!,DriverSetup,00000030), ref: 00401BF1
MessageBoxA.USER32(00000000,0040F360,DriverSetup,00000030), ref: 00401C11
GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 00401C55
GetFileAttributesA.KERNEL32(?,?,?,00000000), ref: 00401C90
GetFileAttributesA.KERNEL32(?), ref: 00401CD3
GetUserDefaultLangID.KERNEL32(?,?,00000000), ref: 00401CE8
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00401EF9

Part of subcall function 004017D0: GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,?,?), ref: 004017FD

GetWindowsDirectoryA.KERNEL32(0041194C,00000064,?,?,?,?,?,?,00000000), ref: 00401E72
DialogBoxParamA.USER32(?,00000082,00000000,00402040,00000000), ref: 00402024

Strings

\inf\drvidx.bin, xrefs: 00401EC6
Program Files (x86), xrefs: 00401C9B
\s, xrefs: 00401B99
\*.INF, xrefs: 00401D24
Not found install application,please install by hand!, xrefs: 00401BEB
No found *.inf!, xrefs: 00401D76
\SYSWOW64, xrefs: 00401C57
\inf\, xrefs: 00401E9B
\DRVSETUP64\DRVSETUP64.EXE, xrefs: 00401A10
\p, xrefs: 00401B83
\u, xrefs: 00401B8E
kernel32, xrefs: 004019A7
DriverSetup, xrefs: 00401BDE
IsWow64Process, xrefs: 004019A2

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: File$AttributesDirectoryMessageModuleWindowslstrlen$AddressCurrentDefaultDialogExecHandleLangNameParamProcProcessUser
String ID: \p$ \s$ \u$DriverSetup$IsWow64Process$No found *.inf!$Not found install application,please install by hand!$Program Files (x86)$\*.INF$\DRVSETUP64\DRVSETUP64.EXE$\SYSWOW64$\inf\$\inf\drvidx.bin$kernel32
API String ID: 1313208548-341060648
Opcode ID: 604a3cf0f1aab5af307e8e47ad9a26a98b912d5efa0e9f39b2c9b3cc64adc80a
Instruction ID: 6431effe882a2b5566dfd73682a64a313b7054338a0b89c3f047463bfcb62da1
Opcode Fuzzy Hash: 604a3cf0f1aab5af307e8e47ad9a26a98b912d5efa0e9f39b2c9b3cc64adc80a
Instruction Fuzzy Hash: E7F11876A0460016D728D6749C41AAB76C5ABC4370F148A3FFE6AE32D1EEBCD90CC25D

Function 0040A531 Relevance: 5.1, APIs: 4, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapReAlloc.KERNEL32(00000000,00000060,00000000,00000000,0040A2F9,00000000,?,?,?,00405B6C), ref: 0040A559
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0040A2F9,00000000,?,?,?,00405B6C), ref: 0040A58D
VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,00405B6C), ref: 0040A5A7
HeapFree.KERNEL32(00000000,?,?,00405B6C), ref: 0040A5BE

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 97401bc1249cf23c6485793da7e1e54288df11f0ae81f18ca45783f1628c1f60
Instruction ID: e00789c817f3a1008143e95e85cd6969e136b30464c6ef216b4e6dab4573745a
Opcode Fuzzy Hash: 97401bc1249cf23c6485793da7e1e54288df11f0ae81f18ca45783f1628c1f60
Instruction Fuzzy Hash: 90119E30200B01AFC7228F18EC49DA27BB6FB84764B10867EF166E21F0DB749816CB0C

Function 004073AD Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00407398,?,00000000,00000000,00405BE5,00000000,00000000), ref: 004073C2
TerminateProcess.KERNEL32(00000000,?,00407398,?,00000000,00000000,00405BE5,00000000,00000000), ref: 004073C9
ExitProcess.KERNEL32 ref: 0040744A

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4baaff5799d40b61fbbafacca7f2b6482ee88fece9bae45f0bc9bf61a5b01eaa
Instruction ID: a01dfff99c8a3b87665bf06212acc80de0f5a486b331f708d323a686e60efb06
Opcode Fuzzy Hash: 4baaff5799d40b61fbbafacca7f2b6482ee88fece9bae45f0bc9bf61a5b01eaa
Instruction Fuzzy Hash: E301A1319483109ADA20AB69FD45A597FA4BB84754B10C43FF540771E2CB786849DA2F

Function 00407D10 Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00405B5A,00000001), ref: 00407D21

Part of subcall function 00409E94: HeapAlloc.KERNEL32(00000000,00000140,00407D35), ref: 00409EA1

HeapDestroy.KERNEL32 ref: 00407D3F

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 717bce6ab466fe7ae81cccd2fe71f2ad94dcafb2022a8e870850e6281594cee9
Instruction ID: 1119edc1993662220c0b4fda66fe7cf28edf0de8ed9f510e6f0c221ebb045d17
Opcode Fuzzy Hash: 717bce6ab466fe7ae81cccd2fe71f2ad94dcafb2022a8e870850e6281594cee9
Instruction Fuzzy Hash: 36E02B30A55300ABEB000B30EE1977635D4AF48782F00843EF904D90F1F774CD40D509

Function 00409E07 Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(00000008,?,?,?,?,00407C61,00000001,00000074,?,00405B6C), ref: 00409E5C

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 49002222601b882654b9e5b34cd0166298b64114735109ee27fcde83ee9781d8
Instruction ID: ff5d35b8a4ec4bbc7e8ff7d21122a74019472bdb4801230e31ab5af0d1f43a1b
Opcode Fuzzy Hash: 49002222601b882654b9e5b34cd0166298b64114735109ee27fcde83ee9781d8
Instruction Fuzzy Hash: 2F019C33A0061066D621A265EC41B5F2204DBD17B5F1A013BFD98773D3EB3D5C0181DD

Non-executed Functions

Function 004030D0 Relevance: 79.2, APIs: 30, Strings: 15, Instructions: 496
windowsleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UpdateWindow.USER32 ref: 004030ED
MessageBoxA.USER32(00000000,0041037C,DriverSetup,00000030), ref: 00403120
MessageBoxA.USER32(00000000,Not Found *.inf.,DriverSetup,00000030), ref: 00403151
lstrlenA.KERNEL32(00411ACC,?,00000000,74DF0F00), ref: 004031C2
MessageBoxA.USER32(00000000,Driver install failure.,DriverSetup,00000010), ref: 0040321D
Sleep.KERNEL32(000003E8,?,?,00000000,74DF0F00), ref: 00403228

Strings

newdev.DLL, xrefs: 004032C3
Driver install failure., xrefs: 00403217
Not Found *.inf., xrefs: 0040314B
XjA, xrefs: 00403665
Driver Pre-install failure!, xrefs: 004035E3
The drive is successfully Pre-installed in advance!, xrefs: 0040363A
Driver install failure!, xrefs: 004034E3
Driver install success!, xrefs: 0040350E
newdev.DLL not found., xrefs: 00403419
UpdateDriverForPlugAndPlayDevices() not found., xrefs: 0040347E
Driver install success.,please plug the device!, xrefs: 00403269
No device is found!, xrefs: 004036C3
UpdateDriverForPlugAndPlayDevicesA, xrefs: 004032D6
XjA, xrefs: 00403671
DriverSetup, xrefs: 00403115, 00403146, 00403212, 00403252, 00403264, 004033C4, 004033E3, 00403414, 0040344E, 00403479, 004034B3, 004034DE, 00403509, 0040356E, 004035B7, 004035DE, 0040360E, 00403635, 00403697, 004036BE, 004036F2

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Message$SleepUpdateWindowlstrlen
String ID: Driver Pre-install failure!$Driver install failure!$Driver install failure.$Driver install success!$Driver install success.,please plug the device!$DriverSetup$No device is found!$Not Found *.inf.$The drive is successfully Pre-installed in advance!$UpdateDriverForPlugAndPlayDevices() not found.$UpdateDriverForPlugAndPlayDevicesA$XjA$XjA$newdev.DLL$newdev.DLL not found.
API String ID: 1918260183-3025233629
Opcode ID: 261cd0c13ec22c5e082170656b970c8e06e458e2721a3746daa14239d186c609
Instruction ID: b914ae296fd03a88aef5e4d476894dc9bba8c58298c5cebb77b49e09d745a66a
Opcode Fuzzy Hash: 261cd0c13ec22c5e082170656b970c8e06e458e2721a3746daa14239d186c609
Instruction Fuzzy Hash: AEE16B7678030026DB305F68EC11FE63B489744B22F544137FF80BA2D1CABE9B8A865C

Function 00401100 Relevance: 79.2, APIs: 11, Strings: 34, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00401146
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004011B4
GetFileAttributesA.KERNEL32(?), ref: 004011F9
GetFileAttributesA.KERNEL32(?), ref: 00401244

Strings

64bit windows 8, xrefs: 004015EA
64bit Windows Server 2012 R2, xrefs: 0040165C
64bit windows SERVER2008 R2, xrefs: 0040150C
64bit Windows Server 2012, xrefs: 004015B4
%d.%d.%4d %s, xrefs: 00401177
32bit Windows Server 2012 R2, xrefs: 00401643
32bit windows vista, xrefs: 00401481
64bit windows vista, xrefs: 0040149A
32bit windows SERVER2008, xrefs: 0040144B
64bit New Windows, xrefs: 0040177D
32bit Windows Server 2012, xrefs: 0040159B
64bit windows SERVER2003, xrefs: 004013E5
32bit Windows 8.1, xrefs: 00401679
32bit windows 8, xrefs: 004015D1
32bit windows SERVER2003, xrefs: 004013CC
32bit Windows 10, xrefs: 0040172B
32bit Windows Server 2016, xrefs: 004016F8
64bit windows XP, xrefs: 004013AF
32bit windows 7, xrefs: 00401529
64bit Windows 10, xrefs: 00401741
Windows NT4.0, xrefs: 004012A1
Windows 95, xrefs: 0040127F
32bit New Windows, xrefs: 00401767
64bit Windows Server 2016, xrefs: 00401711
64bit Windows 8.1, xrefs: 00401692
32bit windows XP, xrefs: 0040132C
Program Files (x86), xrefs: 00401204
Windows 98, xrefs: 004012BF
Windows 2000, xrefs: 0040130E
64bit windows SERVER2008, xrefs: 00401464
\SYSWOW64, xrefs: 004011BA
64bit windows 7, xrefs: 00401542
32bit windows SERVER2008 R2, xrefs: 004014F3
Windows ME, xrefs: 004012E1

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: AttributesFile$DirectoryVersionWindows
String ID: %d.%d.%4d %s$32bit New Windows$32bit Windows 10$32bit Windows 8.1$32bit Windows Server 2012$32bit Windows Server 2012 R2$32bit Windows Server 2016$32bit windows 7$32bit windows 8$32bit windows SERVER2003$32bit windows SERVER2008$32bit windows SERVER2008 R2$32bit windows XP$32bit windows vista$64bit New Windows$64bit Windows 10$64bit Windows 8.1$64bit Windows Server 2012$64bit Windows Server 2012 R2$64bit Windows Server 2016$64bit windows 7$64bit windows 8$64bit windows SERVER2003$64bit windows SERVER2008$64bit windows SERVER2008 R2$64bit windows XP$64bit windows vista$Program Files (x86)$Windows 2000$Windows 95$Windows 98$Windows ME$Windows NT4.0$\SYSWOW64
API String ID: 4278976621-3679722151
Opcode ID: fd6336e97c3121be119b59b6f0cf54ff3447d737c1ca6f65235b75b16fb05512
Instruction ID: 952bb7eab497e5dbe505b4f3e63052c08b20888ce6cd787e6787f4e392b9944e
Opcode Fuzzy Hash: fd6336e97c3121be119b59b6f0cf54ff3447d737c1ca6f65235b75b16fb05512
Instruction Fuzzy Hash: 5AF1467194834097D730DEA0C881BAB77A6AB91308F540D3FE94ABB2D1E77E940D875B

Function 00404930 Relevance: 39.0, APIs: 20, Strings: 2, Instructions: 490
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403720: GetPrivateProfileSectionA.KERNEL32(Manufacturer,?,00002710,?), ref: 004037B2
Part of subcall function 00403720: GetPrivateProfileSectionA.KERNEL32(?,?,00002710,?), ref: 00403844

SetupOpenInfFileA.SETUPAPI(004119C8,00000000,00000002,00000000), ref: 00404A25
SetupDiGetActualSectionToInstallA.SETUPAPI(?,?,?,000000C8,00000000,00000000), ref: 00404AA9
GetPrivateProfileSectionA.KERNEL32(?,?,000000C8,004119C8), ref: 00404AC9
lstrlenA.KERNEL32(?), ref: 00404B79
lstrlenA.KERNEL32(00000000), ref: 00404B95
lstrlenA.KERNEL32(?), ref: 00404C1C
GetPrivateProfileSectionA.KERNEL32(?,?,000000C8,004119C8), ref: 00404C51
lstrlenA.KERNEL32(?), ref: 00404C66
lstrlenA.KERNEL32(?), ref: 00404C72
GetPrivateProfileStringA.KERNEL32(DestinationDirs,?,00000000,?,00000104,004119C8), ref: 00404D19
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00404D57
lstrlenA.KERNEL32(00000000), ref: 00404DA3
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404DD6
lstrlenA.KERNEL32(00000000), ref: 00404E22
DeleteFileA.KERNEL32(?), ref: 00404ECA
lstrlenA.KERNEL32(?), ref: 00404ED8
lstrlenA.KERNEL32(?), ref: 00404EDD
lstrlenA.KERNEL32(?), ref: 00404EEC
SetupCloseInfFile.SETUPAPI(?), ref: 00404EFB
lstrlenA.KERNEL32(?), ref: 00404F06

Strings

CopyFiles, xrefs: 00404AD8
DestinationDirs, xrefs: 00404D14

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: lstrlen$PrivateProfileSection$FileSetup$Directory$ActualCloseDeleteInstallOpenStringSystemWindows
String ID: CopyFiles$DestinationDirs
API String ID: 170937881-536176823
Opcode ID: e5730c2f4b05e78732e8ec513b9f7f87f2e3871c20b12bbf449bed06013d138d
Instruction ID: 93ee6c54ee880ee9378f1b83f719c4e6eacaf2fd1dabebe94e8a39c84d6c5959
Opcode Fuzzy Hash: e5730c2f4b05e78732e8ec513b9f7f87f2e3871c20b12bbf449bed06013d138d
Instruction Fuzzy Hash: 79F125726047445BD728C634CC11BEF76D6BBC4360F144B3EEA5AA72D0EEB49A09C785

Function 0040AEF7 Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

c, xrefs: 0040AFE6
9, xrefs: 0040AF66
9, xrefs: 0040B00C
9, xrefs: 0040AFB8
0, xrefs: 0040AFD3
E, xrefs: 0040AFE1
0, xrefs: 0040B165
1, xrefs: 0040B16F
-, xrefs: 0040B0F5
C, xrefs: 0040AFD8
1, xrefs: 0040B13C
0, xrefs: 0040B196
+, xrefs: 0040AFC9
e, xrefs: 0040AFEF
0, xrefs: 0040B098
0, xrefs: 0040B021
+, xrefs: 0040B0EC
9, xrefs: 0040B178
-, xrefs: 0040AFCE
9, xrefs: 0040B144
9, xrefs: 0040B188

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: c5308d4cae763bdf8981885db20a07e63c7e6d9dc7dbf70d8f188a0b689c200f
Instruction ID: a02184dc9f93bcb59d0ad612f1b48f37a56b8b704b8b0ccdad4f4e014039b48e
Opcode Fuzzy Hash: c5308d4cae763bdf8981885db20a07e63c7e6d9dc7dbf70d8f188a0b689c200f
Instruction Fuzzy Hash: BBE1CB71A5420A9EEB25CF64C8557FE7BB1EB04340F28407BD851BA2D1C37C8992CB9E

Function 00403980 Relevance: 26.6, APIs: 7, Strings: 8, Instructions: 352windowCOMMON

Download Yara Rule

APIs

GetPrivateProfileSectionA.KERNEL32(Manufacturer,?,000007D0,004119C8), ref: 00403A4D
MessageBoxA.USER32(00000000,0041040C,set,00000040), ref: 00403A6B
MessageBoxA.USER32(00000000,Get install information failure.,set,00000000), ref: 00403A91
GetPrivateProfileSectionA.KERNEL32(?,?,000007D0,004119C8), ref: 00403B63

Strings

Manufacturer, xrefs: 00403A48
DriverVer, xrefs: 00403D39
|__ , xrefs: 00403CF9
Version, xrefs: 00403D3E
|__ , xrefs: 00403C5F
Get install information failure., xrefs: 00403A8A
Strings, xrefs: 00403C1E, 00403CAE
set, xrefs: 00403A5F, 00403A85

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: MessagePrivateProfileSection
String ID: |__ $ |__ $DriverVer$Get install information failure.$Manufacturer$Strings$Version$set
API String ID: 2334184453-3092922378
Opcode ID: 4f4d5bc1981fe65f63e4c2ca3d0bc5fb97bb37919f14fd447e331e94933f9b9b
Instruction ID: 846fb8ad0f8615850dfcacc014c2ad355e1339d8d56d30943af575003a1a33e9
Opcode Fuzzy Hash: 4f4d5bc1981fe65f63e4c2ca3d0bc5fb97bb37919f14fd447e331e94933f9b9b
Instruction Fuzzy Hash: B4B1D4323446441BD7298578D852BEBB6C6FBC4360F940B3EFA6B972C0DEF85A09C645

Function 004048C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00401E63,?,?,?,?,?,?,00000000), ref: 004048C0
GetWindowsDirectoryA.KERNEL32(00411848,00000104,?,?,?,?,?,?,00000000), ref: 004048D5
MessageBoxA.USER32(00000000,Windows version or directory error,Initialize,00000010), ref: 00404914
EndDialog.USER32(00000000,00000081), ref: 00404926

Strings

Windows version or directory error, xrefs: 0040490E
Initialize, xrefs: 00404909

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: DialogDirectoryMessageVersionWindows
String ID: Initialize$Windows version or directory error
API String ID: 3597787831-767925351
Opcode ID: 0342cad855ba4ef92f9aa4c8edfe2bc1e45c27b60805c31edb45646bdb7d159d
Instruction ID: cd2646158004adc7ce60baa73e5a20e6022036334430b9993ce46f2cc9102228
Opcode Fuzzy Hash: 0342cad855ba4ef92f9aa4c8edfe2bc1e45c27b60805c31edb45646bdb7d159d
Instruction Fuzzy Hash: F8F0A7B0B907005BD7144BB0DE4ABDA33A1B785744F548639F703A66E0CEBC9445CB0C

Function 004056B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,\*.INF), ref: 004056C5
GetLastError.KERNEL32 ref: 004056D2

Strings

\*.INF, xrefs: 004056B9

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID: \*.INF
API String ID: 873889042-2401023718
Opcode ID: 7dce85409bb13674fa1c2b60cf5acc468295a7b3e0b1bf023371295da15181a9
Instruction ID: d3d6701efdcd5b9be430e0cfd2d45b115834b164818c5eafb2e5ee381adaedb7
Opcode Fuzzy Hash: 7dce85409bb13674fa1c2b60cf5acc468295a7b3e0b1bf023371295da15181a9
Instruction Fuzzy Hash: BB119372C006188BCB21AF69CC45ADF77B8EB05314F004577E95AF72D1DA389A548F99

Function 00409018 Relevance: 4.7, APIs: 3, Instructions: 207timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D30: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00409E3D,00000009,?,?,?,00407C61,00000001,00000074,?,00405B6C), ref: 00406D6D
Part of subcall function 00406D30: EnterCriticalSection.KERNEL32(?,?,?,00409E3D,00000009,?,?,?,00407C61,00000001,00000074,?,00405B6C), ref: 00406D88

Part of subcall function 00406D91: LeaveCriticalSection.KERNEL32(?,00409656,00000009,?,00000009,00000000,?,00409616,000000E0,00409603,?,00406D50,00000018,00000000,?), ref: 00406D9E

GetTimeZoneInformation.KERNEL32(0000000C,?,?,?,0000000B,0000000B,?,00409009,00406C89,00000000,?,74DF1D50,?,0040589F,?,?), ref: 00409066
WideCharToMultiByte.KERNEL32(00000220,00418174,000000FF,0000003F,00000000,74DF1D50,?,00409009,00406C89,00000000,?,74DF1D50,?,0040589F,?,?), ref: 004090FC
WideCharToMultiByte.KERNEL32(00000220,004181C8,000000FF,0000003F,00000000,74DF1D50,?,00409009,00406C89,00000000,?,74DF1D50,?,0040589F,?,?), ref: 00409135

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
String ID:
API String ID: 3442286286-0
Opcode ID: dff3a9661d735940b26f96998114a998f1c236b9adf3e707644dc5fa46744c15
Instruction ID: e4c9d311c7d3cb648d400b61545d332553ed6b3d2c08a689aaa9faee7ed9c457
Opcode Fuzzy Hash: dff3a9661d735940b26f96998114a998f1c236b9adf3e707644dc5fa46744c15
Instruction Fuzzy Hash: 6661F571904245BED7219F25EC42BAA3BA4EB06314F24857FF480A72E2D7B84D83C75D

Function 004044C0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetupDiGetDeviceRegistryPropertyA.SETUPAPI(00000000,?,0000000A,00000000,?,00000004,00000000), ref: 004044DA

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: DevicePropertyRegistrySetup
String ID:
API String ID: 3249385096-0
Opcode ID: 9a7b58a76361db688332eab75770cefd799ad593b2096d41368e05551df7581c
Instruction ID: 85bbce21c8dc92fd62d21fbfc1e83084569bb1b21b39b8f746e9264702306370
Opcode Fuzzy Hash: 9a7b58a76361db688332eab75770cefd799ad593b2096d41368e05551df7581c
Instruction Fuzzy Hash: 5FE046B0204301BBEA10CB61C988F6B73E8BBC4700F14882DB348C21A0D770E908CB66

Function 0040A6DD Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 91eca802715b07c7c691e61ce06bbd0d37aae7d07d8e0525e2f174787f340294
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 64B18E75A0030ADFDB15CF04C5D0AA9BBA1BF58318F14C5AEC84A6B382C735EE56CB94

Function 00402040 Relevance: 89.7, APIs: 37, Strings: 14, Instructions: 481
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendDlgItemMessageA.USER32(?,000003E8,00000146,00000000,00000000), ref: 00402124
SendDlgItemMessageA.USER32(?,000003E8,00000147,00000000,00000000), ref: 00402137
SendDlgItemMessageA.USER32(?,000003E8,00000148,00000000,?), ref: 00402151
SetDlgItemTextA.USER32(?,000003EB,004146C8), ref: 00402209
SetDlgItemTextA.USER32(00000000,000003F6,?), ref: 00402245
CloseHandle.KERNEL32(00000000), ref: 0040229B
CloseHandle.KERNEL32(00000000), ref: 004022C7
CreateThread.KERNEL32(00000000,00000000,Function_00002B10,00000000,00000000,?), ref: 004022E9
MessageBoxA.USER32(00000000,Creat thread for installing driver failure!,Setup,00000040), ref: 0040230F
DefWindowProcA.USER32(?,00000111,?,?), ref: 00402343
DialogBoxParamA.USER32(00000000,00000083,?,00402680,00000000), ref: 0040237D
GetDlgItem.USER32(00000000,000003EC), ref: 004023A1
ShowWindow.USER32(00000000), ref: 004023A8
LoadIconA.USER32(00000000,0000006B), ref: 00402448
SetWindowTextA.USER32(?,DriverSetup), ref: 004024C6
SendMessageA.USER32(00000000,00000080,00000001,00000000), ref: 004024E0
SendMessageA.USER32(00000000,00000080,00000000,00000000), ref: 004024F1
SetDlgItemTextA.USER32(?,000003EB,004146C8), ref: 00402504
SetDlgItemTextA.USER32(00000000,000003E9,INSTALL), ref: 00402524
SetDlgItemTextA.USER32(00000000,000003F8,Update), ref: 00402536
SetDlgItemTextA.USER32(00000000,000003EA,UNINSTALL), ref: 00402549
SetDlgItemTextA.USER32(00000000,000003F1,HELP), ref: 0040255C
SetDlgItemTextA.USER32(00000000,000003EC,!! Delete the driver files when uninstall the device.), ref: 0040256E
SetDlgItemTextA.USER32(00000000,000003F6,Select INF File :), ref: 00402581
SetDlgItemTextA.USER32(00000000,000003F7,Device Driver Install / UnInstall), ref: 00402594
CloseHandle.KERNEL32(00000000), ref: 0040264B
EndDialog.USER32(?,?), ref: 0040266A

Strings

Select INF File :, xrefs: 00402576
Select INF File(%d/%d):, xrefs: 00402260
(X64), xrefs: 0040246E
Device Driver Install / UnInstall, xrefs: 00402589
HELP, xrefs: 00402551
INSTALL, xrefs: 00402519
UNINSTALL, xrefs: 0040253E
%s%s, xrefs: 0040248A, 0040249B
Setup, xrefs: 00402304, 004023DE
!! Delete the driver files when uninstall the device., xrefs: 00402563
Update, xrefs: 0040252B
Creat thread for installing driver failure!, xrefs: 00402309
DriverSetup, xrefs: 00402492, 004024C0
Welcome to contact us if you have some question. Website: http://wch.cnEmail: tech@wch.cn, xrefs: 0040240B

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Item$Text$Message$Send$CloseHandleWindow$Dialog$CreateIconLoadParamProcShowThread
String ID: !! Delete the driver files when uninstall the device.$%s%s$(X64)$Creat thread for installing driver failure!$Device Driver Install / UnInstall$DriverSetup$HELP$INSTALL$Select INF File :$Select INF File(%d/%d):$Setup$UNINSTALL$Update$Welcome to contact us if you have some question. Website: http://wch.cnEmail: tech@wch.cn
API String ID: 2144551793-1150266790
Opcode ID: 80212eb2adf7bb281150db79cfdff3c484db4f7f081423922ba72a7b926642e2
Instruction ID: 142f063ef20434f002d848d96c3281b841c2883aa04e19cba0b485298a39693f
Opcode Fuzzy Hash: 80212eb2adf7bb281150db79cfdff3c484db4f7f081423922ba72a7b926642e2
Instruction Fuzzy Hash: 8CE144727903006BD3249B68ED46FEB3798E784710F148A3BFB45B62E0CEB99509875C

Function 00402980 Relevance: 52.6, APIs: 24, Strings: 6, Instructions: 150
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowExA.USER32(00000000,00000000,00000000,004100CC), ref: 004029AD
EnumChildWindows.USER32(00000000,004027D0,00000000), ref: 004029BB
FindWindowExA.USER32(00000000,00000000,00000000,004100C0), ref: 004029C8
EnumChildWindows.USER32(00000000,004027D0,00000000), ref: 004029D6
FindWindowExA.USER32(00000000,00000000,00000000,004100B0), ref: 004029E3
EnumChildWindows.USER32(00000000,004027D0,00000000), ref: 004029F1
FindWindowExA.USER32(00000000,00000000,00000000,004100A4), ref: 004029FE
EnumChildWindows.USER32(00000000,004027D0,00000000), ref: 00402A0C
FindWindowExA.USER32(00000000,00000000,00000000,00410090), ref: 00402A19
EnumChildWindows.USER32(00000000,004027D0,00000000), ref: 00402A27
FindWindowExA.USER32(00000000,00000000,00000000,00410078), ref: 00402A34
FindWindowExA.USER32(00000000,00000000,00000000,Hardware Installation), ref: 00402A55
EnumChildWindows.USER32(00000000,004028A0,00000000), ref: 00402A63
FindWindowExA.USER32(00000000,00000000,00000000,Software Installation), ref: 00402A70
EnumChildWindows.USER32(00000000,004028A0,00000000), ref: 00402A7E
FindWindowExA.USER32(00000000,00000000,00000000,Windows Security), ref: 00402A8B
EnumChildWindows.USER32(00000000,004028A0,00000000), ref: 00402A99
FindWindowExA.USER32(00000000,00000000,00000000,User Account Control), ref: 00402AA6
EnumChildWindows.USER32(00000000,004028A0,00000000), ref: 00402AB4
FindWindowExA.USER32(00000000,00000000,00000000,Security Alert - Driver Installation), ref: 00402AC1
EnumChildWindows.USER32(00000000,004028A0,00000000), ref: 00402ACF
FindWindowExA.USER32(00000000,00000000,00000000,Found New Hardware), ref: 00402ADC
EnumChildWindows.USER32(00000000,004028A0,00000000), ref: 00402AEA
Sleep.KERNEL32(00000001), ref: 00402AEE

Strings

Software Installation, xrefs: 00402A65
Security Alert - Driver Installation, xrefs: 00402AB6
Windows Security, xrefs: 00402A80
User Account Control, xrefs: 00402A9B
Found New Hardware, xrefs: 00402AD1
Hardware Installation, xrefs: 00402A4A

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: FindWindow$ChildEnumWindows$Sleep
String ID: Found New Hardware$Hardware Installation$Security Alert - Driver Installation$Software Installation$User Account Control$Windows Security
API String ID: 4103604691-2659945619
Opcode ID: a147a7466b10af817b46a21f4608e13d35999ddbc92ce163aac28aae9fcf110d
Instruction ID: 25b7631a761dcf0a7acce531af1cf1bf1aaaa416cc5d71cf20f292300e486b68
Opcode Fuzzy Hash: a147a7466b10af817b46a21f4608e13d35999ddbc92ce163aac28aae9fcf110d
Instruction Fuzzy Hash: 9E419674BC535A74FA70A2A25E4BF5B19484B84F81F350433BA04BA5C0CDECB481886D

Function 00402D60 Relevance: 42.3, APIs: 17, Strings: 7, Instructions: 287
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UpdateWindow.USER32 ref: 00402D94
lstrlenA.KERNEL32(00411ACC), ref: 00402D9F
SetupDiGetClassDevsA.SETUPAPI(00000000,00000000,00000000,00000004), ref: 00402DB2
SetupDiEnumDeviceInfo.SETUPAPI ref: 00402DF3
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(00000000,?,00000001,?,?,00000400,00000000), ref: 00402E27
lstrlenA.KERNEL32(?), ref: 00402E46
CharUpperA.USER32(?), ref: 00402E81
CharUpperA.USER32(00411ACC), ref: 00402E8A
lstrlenA.KERNEL32(00411ACC,00416A58,75C08FB0,74DF0F00), ref: 00402EAB
lstrlenA.KERNEL32(?), ref: 00403062
lstrlenA.KERNEL32(?), ref: 00403069
SetupDiEnumDeviceInfo.SETUPAPI(?,?,?), ref: 00403087
GetLastError.KERNEL32 ref: 00403096
SetupDiDestroyDeviceInfoList.SETUPAPI(00000000), ref: 004030A1

Strings

XjA, xrefs: 00402DDD
XjA, xrefs: 00402F38
driver uninstall failure., xrefs: 00402FD1
XjA, xrefs: 00402FB3
XjA, xrefs: 00402FE5
driver has uninstalled., xrefs: 00403013
XjA, xrefs: 0040302C

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Setuplstrlen$Device$Info$CharEnumUpper$ClassDestroyDevsErrorLastListPropertyRegistryUpdateWindow
String ID: driver has uninstalled.$ driver uninstall failure.$XjA$XjA$XjA$XjA$XjA
API String ID: 3201540815-1114971610
Opcode ID: 23b9e886a5b9009ba4d29850b0058fd9ac4a2da62c8b68b8ad50a262403893c5
Instruction ID: 8bfba057c24acd662a26ae40e24f4ba06a2fac78a4cddad7bf230c828621e619
Opcode Fuzzy Hash: 23b9e886a5b9009ba4d29850b0058fd9ac4a2da62c8b68b8ad50a262403893c5
Instruction Fuzzy Hash: E59137316042005BD7249F38D844BAB7BD9EBC4360F04463EFA5AA72D0DFB8DA098799

Function 00404F40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 173
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetClassDevsA.SETUPAPI(00000000,00000000,00000000,00000004), ref: 00404F91
SetupDiEnumDeviceInfo.SETUPAPI ref: 00404FC2
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(00000000,?,00000001,?,?,000003E8,00000000), ref: 0040500C
GetLastError.KERNEL32 ref: 00405016
GetLastError.KERNEL32 ref: 00405025
lstrlenA.KERNEL32(?), ref: 00405049
CharUpperA.USER32(?), ref: 00405060
CharUpperA.USER32(00000000,74DF0F00), ref: 00405072
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(00000000,?,0000000A,?,?,00000004,00000000), ref: 004050B0
lstrlenA.KERNEL32(?), ref: 004050BE
lstrlenA.KERNEL32(?), ref: 004050D4
lstrlenA.KERNEL32(?), ref: 004050DB

Strings

@, xrefs: 004050B6
, xrefs: 00405114

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Setuplstrlen$Device$CharErrorLastPropertyRegistryUpper$ClassDevsEnumInfo
String ID: $@
API String ID: 2626708782-1077428164
Opcode ID: 7ffaa48990634e67af43fc2874904b2b8905b532f8a79d1105680a1b7f69e6d6
Instruction ID: f4dc71421274bd3ee36d3a415299a9d16c33e330938a42da40e8093127f310c5
Opcode Fuzzy Hash: 7ffaa48990634e67af43fc2874904b2b8905b532f8a79d1105680a1b7f69e6d6
Instruction Fuzzy Hash: FC51D5719083416FD710DB64DC48BAB7BD8EB85304F44493DF685E7290EB78990DCBAA

Function 00403DB0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 226
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupOpenInfFileA.SETUPAPI(?,00000000,00000002,00000000), ref: 00403E47
SetupDiGetActualSectionToInstallA.SETUPAPI(00000000,?,?,00000064,00000000,00000000), ref: 00403EB6
SetupOpenFileQueue.SETUPAPI ref: 00403EBC
SetupInitDefaultQueueCallbackEx.SETUPAPI(00000000,00000000,00000000,00000000,00000000), ref: 00403EE4
SetupInstallFilesFromInfSectionA.SETUPAPI(?,00000000,00000000,?,?,00000004), ref: 00403F0B
SetupCommitFileQueueA.SETUPAPI(00000000,00000000,00404240,00000000), ref: 00403F23
lstrlenA.KERNEL32(004141DC), ref: 00403F3B

Strings

return:%x, xrefs: 00404050

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Setup$FileQueue$InstallOpenSection$ActualCallbackCommitDefaultFilesFromInitlstrlen
String ID: return:%x
API String ID: 684538943-614810456
Opcode ID: b9048dea6b2690dd87aeefc5747794b74790657242887ef6be7915935c5e24e3
Instruction ID: 516054ebf780a63a5b4d65d73401ef7181cb5bf216084edbc960cecf882a1388
Opcode Fuzzy Hash: b9048dea6b2690dd87aeefc5747794b74790657242887ef6be7915935c5e24e3
Instruction Fuzzy Hash: CB7126716043406FD3248F74DC45BAB7BE9ABC4310F104A3EFA56A72D0DEB49D098799

Function 00404290 Relevance: 27.2, APIs: 18, Instructions: 192
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetClassDevsA.SETUPAPI(00000000,00000000,00000000,00000004), ref: 004042E1
SetupDiEnumDeviceInfo.SETUPAPI ref: 00404312
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(00000000,?,00000001,?,00000000,00000000,00000000), ref: 00404344
GetLastError.KERNEL32 ref: 0040434A
GetLastError.KERNEL32 ref: 00404355
LocalFree.KERNEL32(00000000), ref: 00404369
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404376
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(00000000,0000001C,00000001,?,00000000,00000000,00000000), ref: 00404398
GetLastError.KERNEL32 ref: 004043A2
CharUpperA.USER32(00000001), ref: 004043DE
CharUpperA.USER32(00000000,00000000), ref: 004043F0

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Setup$DeviceErrorLast$CharLocalPropertyRegistryUpper$AllocClassDevsEnumFreeInfo
String ID:
API String ID: 110042632-0
Opcode ID: 8a2565f6faf77d4e909ce73d0b667701699dfa9714e727bf31070e4bae0c296e
Instruction ID: 1ae1a091b10f47265da7883bde0d4a56b4ec8c298cae32be2f8480788d8477b3
Opcode Fuzzy Hash: 8a2565f6faf77d4e909ce73d0b667701699dfa9714e727bf31070e4bae0c296e
Instruction Fuzzy Hash: 5851E4B19043016FD710DFA4DC84A6B77A9EFC5304F04493DFA45A3290EB78DD0A8B6A

Function 00402680 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000002), ref: 0040269D
SetDlgItemTextA.USER32(?,000003F4,00415A58), ref: 0040271E
SetWindowTextA.USER32(?,0040FB1C), ref: 00402749
SetDlgItemTextA.USER32(00000000,00000067,INSTALL), ref: 0040275D
SetDlgItemTextA.USER32(?,000003F4,00415A58), ref: 004027C1

Strings

INSTALL, xrefs: 00402755
XZA, xrefs: 004026FE
XZA, xrefs: 004027A5
Setup Program Overview , xrefs: 00402785
XZA, xrefs: 004026D8
1.You should put all the drive files(sys,dll) in the same directory at first, then select the installation file *.inf before installing or uninstalling the driver;2.Run the setup.exe file and click [INSTALL] to install driver in advance. Then the devices ins, xrefs: 004026EA
1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins, xrefs: 00402791
XZA, xrefs: 00402773

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Text$Item$DialogWindow
String ID: 1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins$1.You should put all the drive files(sys,dll) in the same directory at first, then select the installation file *.inf before installing or uninstalling the driver;2.Run the setup.exe file and click [INSTALL] to install driver in advance. Then the devices ins$INSTALL$Setup Program Overview $XZA$XZA$XZA$XZA
API String ID: 71988532-2086700456
Opcode ID: dec5643f1b9e11970002bb8ec7c0fd5e72cca1c36e42d48c43a1c501f337ad0c
Instruction ID: 41e55f841de4359911ecea24f3b6ce3ed61c692a8c58c80ff16a4da221cb2a78
Opcode Fuzzy Hash: dec5643f1b9e11970002bb8ec7c0fd5e72cca1c36e42d48c43a1c501f337ad0c
Instruction Fuzzy Hash: 1F31F632B5050457C7288538AE59AAB7786ABD4320F60873BF957A32D1CFFD8C46C20C

Function 00402B10 Relevance: 24.1, APIs: 16, Instructions: 78sleepthreadCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,000003E9), ref: 00402B28
EnableWindow.USER32(00000000), ref: 00402B31
GetDlgItem.USER32(00000000,000003EA), ref: 00402B41
EnableWindow.USER32(00000000), ref: 00402B44
GetDlgItem.USER32(00000000,000003F8), ref: 00402B54
EnableWindow.USER32(00000000), ref: 00402B57
Sleep.KERNEL32(00000064,?,74DF1D50,?,00401FEA,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00402B61
CreateThread.KERNEL32(00000000,00000000,00402980,00000000,00000000,74DF1D50), ref: 00402B7F

Part of subcall function 00401950: CM_Locate_DevNodeA.CFGMGR32(00000000,00000000,00000000,?,00402B8C,?,74DF1D50,?,00401FEA,00000000), ref: 0040195A
Part of subcall function 00401950: CM_Reenumerate_DevNode.CFGMGR32(?,00000000,?,00402B8C,?,74DF1D50,?,00401FEA,00000000), ref: 00401967

Part of subcall function 004030D0: UpdateWindow.USER32 ref: 004030ED
Part of subcall function 004030D0: MessageBoxA.USER32(00000000,0041037C,DriverSetup,00000030), ref: 00403120

Sleep.KERNEL32(0000000A,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00402BA2
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00402BA5
GetDlgItem.USER32(00000000,000003E9), ref: 00402BB9
EnableWindow.USER32(00000000), ref: 00402BBC
GetDlgItem.USER32(00000000,000003EA), ref: 00402BCC
EnableWindow.USER32(00000000), ref: 00402BCF
GetDlgItem.USER32(00000000,000003F8), ref: 00402BDE
EnableWindow.USER32(00000000), ref: 00402BE1

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Window$EnableItem$NodeSleep$CloseCreateHandleLocate_MessageReenumerate_ThreadUpdate
String ID:
API String ID: 3344006490-0
Opcode ID: 981e04bcee9d9993147d8a350d4d4f4bbf2b9e87e06c133c5b5e14195b77b2d6
Instruction ID: f49968352b0b4d2fd6f7fe26cfedc0ba6a8c57d9c8ee6a79ab25659a9763eb9c
Opcode Fuzzy Hash: 981e04bcee9d9993147d8a350d4d4f4bbf2b9e87e06c133c5b5e14195b77b2d6
Instruction Fuzzy Hash: AC1151B1B903047BE610B7B5DC8AF9B7B9CEB44B15F148526F304AB1E0CEF5A4048A68

Function 00404740 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(setupapi.dll,00000000,00000001,?,?), ref: 00404778
SetupDiBuildDriverInfoList.SETUPAPI(?,?,00000002), ref: 0040479E
SetLastError.KERNEL32 ref: 004047D2
SetupDiEnumDriverInfoA.SETUPAPI(?,?,00000002,?,?), ref: 004047EE
SetupDiGetDriverInfoDetailA.SETUPAPI ref: 0040481D
GetProcAddress.KERNEL32(00000000,SetupUninstallOEMInfA), ref: 00404829
CharUpperA.USER32(?), ref: 0040483D
FreeLibrary.KERNEL32(00000000), ref: 0040489A
SetupDiDestroyDriverInfoList.SETUPAPI(?,?,00000002), ref: 004048A4

Strings

OEM, xrefs: 00404854
SetupUninstallOEMInfA, xrefs: 00404823
setupapi.dll, xrefs: 00404772

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: DriverInfoSetup$LibraryList$AddressBuildCharDestroyDetailEnumErrorFreeLastLoadProcUpper
String ID: OEM$SetupUninstallOEMInfA$setupapi.dll
API String ID: 590685791-3303978262
Opcode ID: bf847e112dd727720201d3202880b121a94057b4a67ee426b6682b169e0b5990
Instruction ID: 725871100171c3654c033553b6793fa4ffe2bd27cec7b3f21b12a2cc85e9f614
Opcode Fuzzy Hash: bf847e112dd727720201d3202880b121a94057b4a67ee426b6682b169e0b5990
Instruction Fuzzy Hash: FE31B5B1504345AFE321DF50CC49FABB7E9EBC8704F04492DF649B7280DB7999098BA6

Function 00404070 Relevance: 19.7, APIs: 13, Instructions: 151filestringCOMMON

Download Yara Rule

APIs

SetupOpenInfFileA.SETUPAPI(?,00000000,00000002,00000000), ref: 004040DA
SetupDiGetActualSectionToInstallA.SETUPAPI(00000000,?,?,000000C8,00000000,00000000), ref: 00404142
SetupOpenFileQueue.SETUPAPI ref: 00404148
SetupInitDefaultQueueCallbackEx.SETUPAPI(00000000,00000000,00000000,00000000,00000000), ref: 0040416F
SetupInstallFilesFromInfSectionA.SETUPAPI(00000000,00000000,00000000,?,?,00000004), ref: 00404192
SetupCommitFileQueueA.SETUPAPI(00000000,00000000,00404240,00000000), ref: 004041A9
lstrlenA.KERNEL32(004141DC), ref: 004041C1
SetupTermDefaultQueueCallback.SETUPAPI(?,00000000), ref: 0040421C
SetupCloseFileQueue.SETUPAPI(?), ref: 00404223
SetupCloseInfFile.SETUPAPI(00000000), ref: 0040422A

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Setup$FileQueue$CallbackCloseDefaultInstallOpenSection$ActualCommitFilesFromInitTermlstrlen
String ID:
API String ID: 2008261147-0
Opcode ID: a75bcdd64cb1c0c880e96d570e4df8b5eb3cc93f5dc127e3884b30e888f23333
Instruction ID: fde32d3747e508b19271fa74d615d2a7d494316f82325d2c532e9b3c1001c77e
Opcode Fuzzy Hash: a75bcdd64cb1c0c880e96d570e4df8b5eb3cc93f5dc127e3884b30e888f23333
Instruction Fuzzy Hash: B541F6B16043406FD3209BB4DC48FAB7BA4ABD5350F044A3DFB41BB2E1DA7898498799

Function 00404520 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 149filestringCOMMON

Download Yara Rule

APIs

SetupDiBuildDriverInfoList.SETUPAPI(?,?,00000002), ref: 0040456F
SetLastError.KERNEL32 ref: 004045AB

Part of subcall function 004048C0: GetVersion.KERNEL32(00401E63,?,?,?,?,?,?,00000000), ref: 004048C0
Part of subcall function 004048C0: GetWindowsDirectoryA.KERNEL32(00411848,00000104,?,?,?,?,?,?,00000000), ref: 004048D5

SetupDiEnumDriverInfoA.SETUPAPI(?,?,00000002,00000000,?), ref: 004045E7
SetupDiGetDriverInfoDetailA.SETUPAPI(?,?,?,?,0000031D,00000000), ref: 00404619
lstrlenA.KERNEL32(?), ref: 0040464C
DeleteFileA.KERNEL32(?), ref: 004046AF
DeleteFileA.KERNEL32(?), ref: 004046B6
SetupDiDestroyDriverInfoList.SETUPAPI(?,?,00000002), ref: 00404728

Strings

PNF, xrefs: 00404679

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: DriverInfoSetup$DeleteFileList$BuildDestroyDetailDirectoryEnumErrorLastVersionWindowslstrlen
String ID: PNF
API String ID: 2551787110-1656254860
Opcode ID: ad1e8cab40450a098ced7023c5646fb9dda0d28ad9df6881d3fd9670dcc4884f
Instruction ID: 48873d9363ba3a481c365e5eb12679a711b7d5ca76576b388bdccd5d355c99bf
Opcode Fuzzy Hash: ad1e8cab40450a098ced7023c5646fb9dda0d28ad9df6881d3fd9670dcc4884f
Instruction Fuzzy Hash: 0551F6755483489BD734DF24D9197EBB7DAFBC8310F004A2DE646A72C0CF745A09CA96

Function 0040A9D3 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00408079,?,Microsoft Visual C++ Runtime Library,00012010,?,0040D520,?,0040D570,?,?,?,Runtime Error!Program: ), ref: 0040A9E5
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040A9FD
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0040AA0E
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040AA1B

Strings

MessageBoxA, xrefs: 0040A9F7
user32.dll, xrefs: 0040A9E0
GetLastActivePopup, xrefs: 0040AA10
GetActiveWindow, xrefs: 0040AA08

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: bc06b54f4b556ace4a7b9063d0212a9f20fd5249d1d750073b3c528c24a116d1
Instruction ID: 44fb1cb0eadc12cd0a73c3d06c22eeb39a2cadde9628296e21641b3fcc0449d6
Opcode Fuzzy Hash: bc06b54f4b556ace4a7b9063d0212a9f20fd5249d1d750073b3c528c24a116d1
Instruction Fuzzy Hash: 4C019E31B407119BCB419FB4AD80A9B3BE89B99740704443AB208E32E1DB78C859DF6D

Function 0040BD65 Relevance: 13.7, APIs: 9, Instructions: 221COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0040D5B0,00000001,0040D5B0,00000001,00000000,021B0E6C,00406C89,0000000C,?,?,?,0000000B,0000000B), ref: 0040BDA3
CompareStringA.KERNEL32(00000000,00000000,0040D5AC,00000001,0040D5AC,00000001,?,00409009), ref: 0040BDC0
CompareStringA.KERNEL32(?,00000000,00000000,00409009,?,0000000B,00000000,021B0E6C,00406C89,0000000C,?,?,?,0000000B,0000000B), ref: 0040BE1E
GetCPInfo.KERNEL32(0000000B,00000000,00000000,021B0E6C,00406C89,0000000C,?,?,?,0000000B,0000000B,?,00409009), ref: 0040BE6F
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,0000000B,00000000,00000000,?,00409009), ref: 0040BEEE
MultiByteToWideChar.KERNEL32(?,00000001,00000000,0000000B,?,?,?,00409009), ref: 0040BF4F
MultiByteToWideChar.KERNEL32(00000000,00000009,?,00000000,00000000,00000000,?,00409009), ref: 0040BF62
MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,?,00000000,?,00409009), ref: 0040BFAE
CompareStringW.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,00000000,?,00409009), ref: 0040BFC6

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: 26a3107d2876fd7aec60b1bd1fb614e0c60ad8672920f1c47e970a340401e79c
Instruction ID: 3e17981f195ba0b496dee4271c40c882e194cffb7a61001f7f43f9c5b236dfb1
Opcode Fuzzy Hash: 26a3107d2876fd7aec60b1bd1fb614e0c60ad8672920f1c47e970a340401e79c
Instruction Fuzzy Hash: A5718C7290024AABCF219F94DD45AEB7B76EF05314F14403BFA50B62A0C3399851DBDD

Function 00409680 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0040D5B0,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 004096C2
LCMapStringA.KERNEL32(00000000,00000100,0040D5AC,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 004096DE
LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00409727
MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 0040975F
MultiByteToWideChar.KERNEL32(00000000,00000001,00000020,00000001,00000100,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 004097B7
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 004097CD
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00409800
LCMapStringW.KERNEL32(?,00000100,00000100,00000100,?,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00409868

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 795a2475027cb13a26ca9334e06384fcae42a664f02d48edb202e12e24fda44a
Instruction ID: cacc716abb8486a8e5c7065b602f95abb1fa4a80c9f2787ffa888b079100442c
Opcode Fuzzy Hash: 795a2475027cb13a26ca9334e06384fcae42a664f02d48edb202e12e24fda44a
Instruction Fuzzy Hash: 20517C32910209BBCF229F94CD45ADF7BB5FB89754F10853AF914B22A1C3398D11DB69

Function 00403720 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 196stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileSectionA.KERNEL32(Manufacturer,?,00002710,?), ref: 004037B2
GetPrivateProfileSectionA.KERNEL32(?,?,00002710,?), ref: 00403844
lstrlenA.KERNEL32(?), ref: 00403871
lstrlenA.KERNEL32(?), ref: 004038F2
lstrlenA.KERNEL32(?), ref: 0040394A
lstrlenA.KERNEL32(?), ref: 00403959

Strings

Manufacturer, xrefs: 004037AD

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: lstrlen$PrivateProfileSection
String ID: Manufacturer
API String ID: 1041717675-624639268
Opcode ID: da8c46ec1e31ef81105fc2c4a457b7feaf62bea2e73c89bf3c8adc90b617cb29
Instruction ID: c58a2ba55e798f527a7a52b0f37e76ecf27144ae3984c89a0fc2af3c6c62d2fb
Opcode Fuzzy Hash: da8c46ec1e31ef81105fc2c4a457b7feaf62bea2e73c89bf3c8adc90b617cb29
Instruction Fuzzy Hash: 475134722042445BD728DA78C845BABBBC6FBC4350F444E6EF69ADB2C1EE749A08C745

Function 00402BF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004056B0: FindFirstFileA.KERNEL32(00000000,?,?,\*.INF), ref: 004056C5
Part of subcall function 004056B0: GetLastError.KERNEL32 ref: 004056D2

SendDlgItemMessageA.USER32(00000000,000003E8,00000143,00000000,?), ref: 00402CB8

Part of subcall function 0040577D: FindNextFileA.KERNEL32(?,?,00000001), ref: 00405791
Part of subcall function 0040577D: GetLastError.KERNEL32 ref: 0040579B

SendDlgItemMessageA.USER32(00000000,000003E8,0000014E,00000000,00000000), ref: 00402CE6
SetDlgItemTextA.USER32(00000000,000003F6,?), ref: 00402D21
GetDlgItem.USER32(00000000,000003E8), ref: 00402D33
SetFocus.USER32(00000000), ref: 00402D3A

Strings

Select INF File(%d/%d):, xrefs: 00402CFF
\*.INF, xrefs: 00402C42

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Item$ErrorFileFindLastMessageSend$FirstFocusNextText
String ID: Select INF File(%d/%d):$\*.INF
API String ID: 4211766293-1096616172
Opcode ID: e81d948edd7f1e226579184a7576a27b1bf27cc6aaedb323330037d2fcedb62c
Instruction ID: 3b4f061ef6871332f0d24ca78adebeafecbf26b995c85ba8c5399829c0c0d87b
Opcode Fuzzy Hash: e81d948edd7f1e226579184a7576a27b1bf27cc6aaedb323330037d2fcedb62c
Instruction Fuzzy Hash: 7D3128326043406BE320A778DC85FEB7799EBC4310F044A3EF759A72D0DEB959098799

Function 00407F55 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00407FC2
GetStdHandle.KERNEL32(000000F4,0040D520,00000000,?,00000000,?), ref: 00408098
WriteFile.KERNEL32(00000000), ref: 0040809F

Strings

<program name unknown>, xrefs: 00407FD2
Microsoft Visual C++ Runtime Library, xrefs: 0040806E
Runtime Error!Program: , xrefs: 00408028
..., xrefs: 00408014

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: b83d0c9408cda73e86a14d97990f25889c886a179cbaf70dba85ad471bd61941
Instruction ID: 964478384ab551669fe034355cfc1e31d609c047ec18d658513dbc3ed54c0270
Opcode Fuzzy Hash: b83d0c9408cda73e86a14d97990f25889c886a179cbaf70dba85ad471bd61941
Instruction Fuzzy Hash: 72318971E002186FDF14EAA08D45FDA736CAB45304F10457BF545F61C0EAB89A958A5E

Function 004028A0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000064), ref: 004028D0
SendMessageA.USER32(?,000000F5,00000000,00000000), ref: 0040295E

Strings

&Ask me again later, xrefs: 0040291C
&Yes, xrefs: 00402932
Yes, xrefs: 00402906
&Continue Anyway, xrefs: 004028DA
&Install this driver software anyway, xrefs: 004028F0

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: MessageSendTextWindow
String ID: &Ask me again later$&Continue Anyway$&Install this driver software anyway$&Yes$Yes
API String ID: 893732450-574706505
Opcode ID: aa97c72a09bec845908cf4d78c044120bdcbb1cf2ec764256aed422b77a4852e
Instruction ID: 0720f456970e214171b6efa0cc9c88ed41eee8f7162c862445864239dc6faaec
Opcode Fuzzy Hash: aa97c72a09bec845908cf4d78c044120bdcbb1cf2ec764256aed422b77a4852e
Instruction Fuzzy Hash: 5F1108B6704303B6D720A635EC46BEB7A989F51305F08483FBA44B11D1FAB8D15DC7AA

Function 00407954 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00405B92), ref: 0040796F
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00405B92), ref: 00407983
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00405B92), ref: 004079AF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00405B92), ref: 004079E7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00405B92), ref: 00407A09
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00405B92), ref: 00407A22
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00405B92), ref: 00407A35
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00407A73

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: cf9934ff443e1179492868b4d25f33dc69b1c208b02f948a3d8ea6718ddaa4b2
Instruction ID: 0a0f9f7a7fa0da1a6ade063561d17a3e2c2d7df68357f8cf6abf12d0be796c01
Opcode Fuzzy Hash: cf9934ff443e1179492868b4d25f33dc69b1c208b02f948a3d8ea6718ddaa4b2
Instruction Fuzzy Hash: BD31F4B2F0C1556FE7206FB99C8483FB69CE645358B11053BF541E3281E639AD428AAF

Function 00408EA1 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0040D5B0,00000001,00000000,?,00000100,00000000,00407098,00000001,00000020,00000100,?,00000000), ref: 00408EE0
GetStringTypeA.KERNEL32(00000000,00000001,0040D5AC,00000001,00000000,?,00000100,00000000,00407098,00000001,00000020,00000100,?,00000000), ref: 00408EFA
GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,00407098,00000001,00000020,00000100,?,00000000), ref: 00408F2E
MultiByteToWideChar.KERNEL32(00407098,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,00407098,00000001,00000020,00000100,?,00000000), ref: 00408F66
MultiByteToWideChar.KERNEL32(00407098,00000001,00000100,00000020,?,00000100,?,00000100,00000000,00407098,00000001,00000020,00000100,?), ref: 00408FBC
GetStringTypeW.KERNEL32(?,?,00000000,00000001,?,00000100,?,00000100,00000000,00407098,00000001,00000020,00000100,?), ref: 00408FCE

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: b65a0a350cf6096cdf6e89c04119841f9798d715ffcbfc3f3a04b92bdb0fc232
Instruction ID: bbc840a3adb46632348ca831fc7566e1ed19ce3b8032169c7dc745f25e2cab6d
Opcode Fuzzy Hash: b65a0a350cf6096cdf6e89c04119841f9798d715ffcbfc3f3a04b92bdb0fc232
Instruction Fuzzy Hash: 0A416271A0021AAFCF209FA4CD45AEB7F7AFB05754F10443AFA05F2290D7388955CB95

Function 00407A86 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00407AE4
GetFileType.KERNEL32(?,?,00000000), ref: 00407B8F
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00407BF2
GetFileType.KERNEL32(00000000,?,00000000), ref: 00407C00
SetHandleCount.KERNEL32 ref: 00407C37

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 6d9b2754fb1311d8b1ee9ee5cc28e0e0105fc91b7bab978e81019e9cf03f61c6
Instruction ID: d02429bdde62c8a6a3a1d393936ce3db0c3bcc2dde627b7718d7ccc215725da7
Opcode Fuzzy Hash: 6d9b2754fb1311d8b1ee9ee5cc28e0e0105fc91b7bab978e81019e9cf03f61c6
Instruction Fuzzy Hash: 3351F671D082058BD724CF68C994A667BF0AB0532CF24867ED562AB3E1D738BD06C71A

Function 00407CA9 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,00406C38,004081D2,?,00405D3D,?,?,00000001,?,?,00000000,?,004064C8,?,?), ref: 00407CAB
TlsGetValue.KERNEL32(?,004064C8,?,?,?,00405F40,004051FD,?,004051FD), ref: 00407CB9
SetLastError.KERNEL32(00000000,?,004064C8,?,?,?,00405F40,004051FD,?,004051FD), ref: 00407D05

Part of subcall function 00409E07: HeapAlloc.KERNEL32(00000008,?,?,?,?,00407C61,00000001,00000074,?,00405B6C), ref: 00409E5C

TlsSetValue.KERNEL32(00000000,?,004064C8,?,?,?,00405F40,004051FD,?,004051FD), ref: 00407CDD
GetCurrentThreadId.KERNEL32 ref: 00407CEE

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 4605af82d1e251073a74c68fd83beaf779a3fadfd7d29c25aab00870ee9a2424
Instruction ID: cd53bbaa7c2573060f0d67f8cb665fb416b4944f9e748b4ec7a06b07d52b184d
Opcode Fuzzy Hash: 4605af82d1e251073a74c68fd83beaf779a3fadfd7d29c25aab00870ee9a2424
Instruction Fuzzy Hash: 63F02B31E083125BD7312BB0FE09A5B3B60DF01779F10813AF94AB72D1CF3898868699

Function 004065BF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00405189), ref: 004065C4
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 004065D4

Strings

KERNEL32, xrefs: 004065BF
IsProcessorFeaturePresent, xrefs: 004065CE

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: ec527347e80482a0062fa1ee27af2067c2bed5000e89c46dc1e1429c39a0339f
Instruction ID: 877d01a6e0e3378990da936c8492e9b978db9d31e41ee9acaa3b02cf6fdc86f6
Opcode Fuzzy Hash: ec527347e80482a0062fa1ee27af2067c2bed5000e89c46dc1e1429c39a0339f
Instruction Fuzzy Hash: 16C08050F4030177DD2027F07D09F1611084F44B02F150576740FF10C4CEBCC21A512D

Function 00409EFD Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00008000,00004000,00000000,?,?), ref: 0040A154
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0040A1AF
HeapFree.KERNEL32(00000000,?), ref: 0040A1C1

Strings

l[@, xrefs: 0040A08F, 0040A09B, 0040A118

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Free$Virtual$Heap
String ID: l[@
API String ID: 2016334554-2434739801
Opcode ID: 538ca68c92af6acbbae773d2ab4cfe8d97f06851583e286d076616ef7afcb3f3
Instruction ID: 739a1d4001d1a5912090dd9a6f8ed0fc6b75653c3dfb8b1d629603f2512e6c2e
Opcode Fuzzy Hash: 538ca68c92af6acbbae773d2ab4cfe8d97f06851583e286d076616ef7afcb3f3
Instruction Fuzzy Hash: 6EB162756006059FCB19CF54C590AA9BBA2FF94328F24C2AED8095F392CB35ED42CB44

Function 004081E5 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 004082AC

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3eecaaabc33dac8905579b25a7017e44cf1bb2eda3f454c057f815763fbd1b95
Instruction ID: d82302def427d2f486599da59098bd1bddce46c5ed2c87288cb1cc688ffc58aa
Opcode Fuzzy Hash: 3eecaaabc33dac8905579b25a7017e44cf1bb2eda3f454c057f815763fbd1b95
Instruction Fuzzy Hash: 0D51A431900618EFCB11DF68CA84B9D7BB0FF85754F1081BEE895AB291DB34DA41CB59

Function 00405AFC Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00405B22

Part of subcall function 00407D10: HeapCreate.KERNELBASE(00000000,00001000,00000000,00405B5A,00000001), ref: 00407D21
Part of subcall function 00407D10: HeapDestroy.KERNEL32 ref: 00407D3F

GetCommandLineA.KERNEL32 ref: 00405B82
GetStartupInfoA.KERNEL32(?), ref: 00405BAD
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00405BD0

Part of subcall function 00405C29: ExitProcess.KERNEL32 ref: 00405C46

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: ccfe17c0814c1aec0c2654282a2a445d96dde1e9f64c9fbd07deabc33df04d83
Instruction ID: 498653fb740d0c717c46bbd19413b379021def92734c9e2463d8acc6d331a3d6
Opcode Fuzzy Hash: ccfe17c0814c1aec0c2654282a2a445d96dde1e9f64c9fbd07deabc33df04d83
Instruction Fuzzy Hash: BF2173B0D44705AAD704AFB59D06AAE7B78EF04714F10453EF905BA2D1DB38A940CA59

Function 0040BF20 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,00000000,0000000B,?,?,?,00409009), ref: 0040BF4F
MultiByteToWideChar.KERNEL32(00000000,00000009,?,00000000,00000000,00000000,?,00409009), ref: 0040BF62
MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,?,00000000,?,00409009), ref: 0040BFAE
CompareStringW.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,00000000,?,00409009), ref: 0040BFC6

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 36f439c75cf480236db645e8b9e41b9c4b2534b61d40598764dc32c81dfd1b79
Instruction ID: ffd8366bcbcaaa1c1e143a0c82af1235329a0ff117fa03d35c7230f609230cec
Opcode Fuzzy Hash: 36f439c75cf480236db645e8b9e41b9c4b2534b61d40598764dc32c81dfd1b79
Instruction Fuzzy Hash: 97211A3291024AEBCF218F94CD459DEBFB6FF48764F114126FA14B21A0C3369961DF95

Function 00406DA6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00406D30: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00409E3D,00000009,?,?,?,00407C61,00000001,00000074,?,00405B6C), ref: 00406D6D
Part of subcall function 00406D30: EnterCriticalSection.KERNEL32(?,?,?,00409E3D,00000009,?,?,?,00407C61,00000001,00000074,?,00405B6C), ref: 00406D88

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00405B9C), ref: 00406DF7

Part of subcall function 00406D91: LeaveCriticalSection.KERNEL32(?,00409656,00000009,?,00000009,00000000,?,00409616,000000E0,00409603,?,00406D50,00000018,00000000,?), ref: 00406D9E

Strings

PA, xrefs: 00406DDE
@A, xrefs: 00406DEB

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: @A$PA
API String ID: 1866836854-2392466446
Opcode ID: 79dc4e32e92bc2029696fcbd9f7731d10769b566b07d03ba221adcf795ff9c24
Instruction ID: c9c1754f57b489b328545c56ae63df6116947d022d108b00bccaa3b625593017
Opcode Fuzzy Hash: 79dc4e32e92bc2029696fcbd9f7731d10769b566b07d03ba221adcf795ff9c24
Instruction Fuzzy Hash: 4E4157719083515EEB11DB35D8907EA7BE19B04318F26807FE147BB2D2C67D4CA68B8D

Function 00406FF9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 0040700D

Strings

, xrefs: 00407032
, xrefs: 00407056

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ceb36168243400076eb4ecb8b2b6bc413e0718a97eab0f2d2abfcd6be7f5541a
Instruction ID: 3e34a72b8d7123df06a238c6c651f93233db02f8981f125d7fca6e15d6203c72
Opcode Fuzzy Hash: ceb36168243400076eb4ecb8b2b6bc413e0718a97eab0f2d2abfcd6be7f5541a
Instruction Fuzzy Hash: CF41693180C2581EEB129724DD69FFB3FAEAB01704F1404F6D585EA2D2C2795D49CBAB

Function 004018B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 004017D0: GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,?,?), ref: 004017FD

GetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 004018E4

Strings

\SYSWOW64, xrefs: 004018B5
\WIN 1X, xrefs: 004018FA

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: CurrentDirectoryFileModuleName
String ID: \SYSWOW64$\WIN 1X
API String ID: 3981628254-402779332
Opcode ID: a79679cc715edcaafdaa24dbcdb911023d006a551c3a9962d22581963942d8b4
Instruction ID: 2e56cedcf43f1bf53a087a47f07679fefe44113145c9425cd5397c80b2d64c94
Opcode Fuzzy Hash: a79679cc715edcaafdaa24dbcdb911023d006a551c3a9962d22581963942d8b4
Instruction Fuzzy Hash: 9B014C76B1050027D71C21796C52B2B26C9AB95372F14433FF526E32E1DEB98D01826D

Function 00406D07 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00407C48,?,00405B6C), ref: 00406D14
InitializeCriticalSection.KERNEL32(?,00407C48,?,00405B6C), ref: 00406D1C
InitializeCriticalSection.KERNEL32(?,00407C48,?,00405B6C), ref: 00406D24
InitializeCriticalSection.KERNEL32(?,00407C48,?,00405B6C), ref: 00406D2C

Memory Dump Source

Source File: 00000003.00000002.1940764541.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1940734097.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940799088.000000000040D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940828875.000000000040F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940848709.0000000000410000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940865946.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940952724.0000000000418000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1940999036.000000000041A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SETUP.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: edbd1f750ed7b5b62e071fc0b291e78c439fb6d2de8ad03014791094b20e332c
Instruction ID: 5c32dca5d10aa55fd06e24519c228f6dc5f04657c6334898b77f8ce249f57e67
Opcode Fuzzy Hash: edbd1f750ed7b5b62e071fc0b291e78c439fb6d2de8ad03014791094b20e332c
Instruction Fuzzy Hash: 41C0023180903CABCB223B65FD048DA3FA6EB083A0325C077E14852034CAB21CA4EFD8

Analysis Process: DRVSETUP64.exePID: 7588, Parent PID: 7560COMMON

Execution Graph

Execution Coverage:	25.7%
Dynamic/Decrypted Code Coverage:	41.2%
Signature Coverage:	19.8%
Total number of Nodes:	536
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01007400 Relevance: 152.6, APIs: 53, Strings: 34, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01007434
memset.MSVCRT ref: 0100744F
GetVersionExA.KERNEL32 ref: 01007461
sprintf.MSVCRT ref: 01007492
memset.MSVCRT ref: 010074B8
GetWindowsDirectoryA.KERNEL32 ref: 010074CC
GetFileAttributesA.KERNEL32 ref: 01007503
GetFileAttributesA.KERNEL32 ref: 01007553
sprintf.MSVCRT ref: 0100759D
sprintf.MSVCRT ref: 010075C2

Strings

Windows 98, xrefs: 010075D4
32bit Windows Server 2012, xrefs: 010078EA
64bit windows vista, xrefs: 010077D0
\SYSWOW64, xrefs: 010074E5
64bit Windows Server 2012, xrefs: 01007906
32bit windows SERVER2008 R2, xrefs: 01007831
64bit New Windows, xrefs: 01007AFD
Program Files (x86), xrefs: 0100752C
32bit Windows 8.1, xrefs: 010079DF
32bit New Windows, xrefs: 01007ADC
64bit windows 7, xrefs: 01007889
32bit windows 7, xrefs: 0100786D
64bit Windows 8.1, xrefs: 010079FB
Windows 2000, xrefs: 01007626
32bit Windows Server 2012 R2, xrefs: 010079A3
64bit windows 8, xrefs: 01007942
64bit Windows Server 2016, xrefs: 01007A84
64bit windows SERVER2003, xrefs: 0100770B
32bit Windows Server 2016, xrefs: 01007A68
64bit windows SERVER2008, xrefs: 01007794
32bit Windows 10, xrefs: 01007AA1
64bit windows XP, xrefs: 010076CF
%d.%d.%4d %s, xrefs: 01007484
Windows 95, xrefs: 0100758E
64bit Windows 10, xrefs: 01007ABA
Windows NT4.0, xrefs: 010075B3
32bit windows SERVER2008, xrefs: 01007778
32bit windows vista, xrefs: 010077B4
Windows ME, xrefs: 010075F9
64bit Windows Server 2012 R2, xrefs: 010079BF
64bit windows SERVER2008 R2, xrefs: 0100784D
32bit windows SERVER2003, xrefs: 010076EF
32bit windows XP, xrefs: 01007647
32bit windows 8, xrefs: 01007926

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memsetsprintf$AttributesFile$DirectoryVersionWindows
String ID: %d.%d.%4d %s$32bit New Windows$32bit Windows 10$32bit Windows 8.1$32bit Windows Server 2012$32bit Windows Server 2012 R2$32bit Windows Server 2016$32bit windows 7$32bit windows 8$32bit windows SERVER2003$32bit windows SERVER2008$32bit windows SERVER2008 R2$32bit windows XP$32bit windows vista$64bit New Windows$64bit Windows 10$64bit Windows 8.1$64bit Windows Server 2012$64bit Windows Server 2012 R2$64bit Windows Server 2016$64bit windows 7$64bit windows 8$64bit windows SERVER2003$64bit windows SERVER2008$64bit windows SERVER2008 R2$64bit windows XP$64bit windows vista$Program Files (x86)$Windows 2000$Windows 95$Windows 98$Windows ME$Windows NT4.0$\SYSWOW64
API String ID: 424005284-3679722151
Opcode ID: 42d06470da39dbac4bfddb8d5c518caf1eb5d03a5931811eff46342657517602
Instruction ID: ff12e66370e28917dba7298f81e0f2fe73d125e25e4d952b4ba1eda1688d6294
Opcode Fuzzy Hash: 42d06470da39dbac4bfddb8d5c518caf1eb5d03a5931811eff46342657517602
Instruction Fuzzy Hash: 23023D35208A8591FB73DB18E8943E973A1F79D754FC08052C6DA43AA5EFBCD289CB11

Function 01005A30 Relevance: 112.4, APIs: 46, Strings: 18, Instructions: 446
windowlibrarysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UpdateWindow.USER32 ref: 01005A6C
MessageBoxA.USER32 ref: 01005AB0
MessageBoxA.USER32 ref: 01005ADD
GetVersion.KERNEL32 ref: 01005B09
GetWindowsDirectoryA.KERNEL32 ref: 01005B21
Sleep.KERNEL32 ref: 01005B5D
LoadLibraryA.KERNEL32 ref: 01005B8F
GetProcAddress.KERNEL32 ref: 01005BA8
GetLastError.KERNEL32 ref: 01005C0A
lstrlenA.KERNEL32 ref: 01005C3F
MessageBoxA.USER32 ref: 01005C94
MessageBoxA.USER32 ref: 01005F7C
MessageBoxA.USER32 ref: 01005FA1
MessageBoxA.USER32 ref: 01005FDC
MessageBoxA.USER32 ref: 01006004
MessageBoxA.USER32 ref: 0100602C
memset.MSVCRT ref: 0100604E
SetupCopyOEMInfA.SETUPAPI ref: 0100607F
MessageBoxA.USER32 ref: 010060B4
MessageBoxA.USER32 ref: 010060DC

Part of subcall function 01004B80: memset.MSVCRT ref: 01004BC3
Part of subcall function 01004B80: memset.MSVCRT ref: 01004BDF
Part of subcall function 01004B80: SetupOpenInfFileA.SETUPAPI ref: 01004C05

MessageBoxA.USER32 ref: 01006129
MessageBoxA.USER32 ref: 01006169
MessageBoxA.USER32 ref: 01006191
memset.MSVCRT ref: 010061B9

Part of subcall function 01005520: memset.MSVCRT ref: 01005565
Part of subcall function 01005520: UpdateWindow.USER32 ref: 01005571
Part of subcall function 01005520: lstrlenA.KERNEL32 ref: 0100557E
Part of subcall function 01005520: SetupDiGetClassDevsA.SETUPAPI ref: 0100559A

MessageBoxA.USER32 ref: 01006208
MessageBoxA.USER32 ref: 01006230
MessageBoxA.USER32 ref: 0100626B
MessageBoxA.USER32 ref: 01006293

Strings

newdev.DLL not found., xrefs: 01005EF4
Driver install success!, xrefs: 0100601F
C:\Windows, xrefs: 01005B0F
UpdateDriverForPlugAndPlayDevicesA, xrefs: 01005B9E
The drive is successfully Pre-installed in advance!, xrefs: 01006184
USB\VID_1A86&PID_7523, xrefs: 01005B63, 01005CE3
No device is found!, xrefs: 01006223
DriverSetup, xrefs: 01005AA2, 01005AC9, 01005C80, 01005D65, 01005DC7, 01005DE7, 01005E93, 01005EC6, 01005EED, 01005F68, 01005F8D, 01005FC8, 01005FF0, 01006018, 010060A0, 010060C8, 01006115, 01006155, 0100617D, 010061F4, 0100621C, 01006257, 0100627F
Initialize, xrefs: 01005CAB
Driver install success.,please plug the device!, xrefs: 01005DEE
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF, xrefs: 01005A74, 01005AF4, 01005BC6, 01005BEA, 01005D18, 01006065, 010060EC
Not Found *.inf., xrefs: 01005AD0
Driver install failure., xrefs: 01005D6C
newdev.DLL, xrefs: 01005B88
Driver Pre-install failure!, xrefs: 010060CF
UpdateDriverForPlugAndPlayDevices() not found., xrefs: 01005F94
Windows version or directory error, xrefs: 01005CB2
Driver install failure!, xrefs: 01005FF7

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Message$memset$Setup$UpdateWindowlstrlen$AddressClassCopyDevsDirectoryErrorFileLastLibraryLoadOpenProcSleepVersionWindows
String ID: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF$C:\Windows$Driver Pre-install failure!$Driver install failure!$Driver install failure.$Driver install success!$Driver install success.,please plug the device!$DriverSetup$Initialize$No device is found!$Not Found *.inf.$The drive is successfully Pre-installed in advance!$USB\VID_1A86&PID_7523$UpdateDriverForPlugAndPlayDevices() not found.$UpdateDriverForPlugAndPlayDevicesA$Windows version or directory error$newdev.DLL$newdev.DLL not found.
API String ID: 1338830609-3589554543
Opcode ID: 59957ff79675702d9ab8559fda70132829290ec3fc2735484e1463d86be38dcf
Instruction ID: db096297f47016f6fbde05f33d9eb262e2b51d1c26d878adbc55dd1600da90c0
Opcode Fuzzy Hash: 59957ff79675702d9ab8559fda70132829290ec3fc2735484e1463d86be38dcf
Instruction Fuzzy Hash: A7227874304B4691FB638B59EC587E92762FB4D784F844122EACA436E1DFBDC68AC701

Function 01003540 Relevance: 54.5, APIs: 22, Strings: 9, Instructions: 241
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01003576
memset.MSVCRT ref: 01003593
memset.MSVCRT ref: 010035B0
memset.MSVCRT ref: 010035CD
memset.MSVCRT ref: 010035EA
GetPrivateProfileSectionA.KERNEL32 ref: 01003615
MessageBoxA.USER32 ref: 01003641
MessageBoxA.USER32 ref: 01003667
strchr.MSVCRT ref: 010036A3
memcpy.MSVCRT ref: 010036DC
strchr.MSVCRT ref: 0100370A
GetPrivateProfileSectionA.KERNEL32 ref: 0100372E
strchr.MSVCRT ref: 01003741
strchr.MSVCRT ref: 01003767
memset.MSVCRT ref: 0100378B
memcpy.MSVCRT ref: 0100379B
memset.MSVCRT ref: 010037D0
GetPrivateProfileStringA.KERNEL32 ref: 010037FC

Strings

DriverVer, xrefs: 0100391D
|__ , xrefs: 010038E2
Version, xrefs: 01003924
Manufacturer, xrefs: 010035FE
|__ , xrefs: 01003842
set, xrefs: 0100362B, 01003654
Get install information failure., xrefs: 0100365B
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF, xrefs: 010035EF
Strings, xrefs: 010037E5, 01003879

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$strchr$PrivateProfile$MessageSectionmemcpy$String
String ID: |__ $ |__ $C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF$DriverVer$Get install information failure.$Manufacturer$Strings$Version$set
API String ID: 1176457451-3145957396
Opcode ID: b430a98bf0f82310accebd2a0219996accfbf6724981bf5e4318b4d46952b428
Instruction ID: f85fef7fd4bca13ba1031630f7a24ab595d1d75400f1d40c8af30cd4f1353ea4
Opcode Fuzzy Hash: b430a98bf0f82310accebd2a0219996accfbf6724981bf5e4318b4d46952b428
Instruction Fuzzy Hash: A8B1B272318AC085EB27CB25E4107DA7761FB99794F848206E6DE57AD5DF7CC20ACB00

Function 01002DE0 Relevance: 52.6, APIs: 24, Strings: 6, Instructions: 141
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowExA.USER32 ref: 01002E0A
EnumChildWindows.USER32 ref: 01002E22
FindWindowExA.USER32 ref: 01002E36
EnumChildWindows.USER32 ref: 01002E4E
FindWindowExA.USER32 ref: 01002E62
EnumChildWindows.USER32 ref: 01002E7A
FindWindowExA.USER32 ref: 01002E8E
EnumChildWindows.USER32 ref: 01002EA6
FindWindowExA.USER32 ref: 01002EBA
EnumChildWindows.USER32 ref: 01002ED2
FindWindowExA.USER32 ref: 01002EE6
FindWindowExA.USER32 ref: 01002F08
EnumChildWindows.USER32 ref: 01002F20
FindWindowExA.USER32 ref: 01002F34
EnumChildWindows.USER32 ref: 01002F4C
FindWindowExA.USER32 ref: 01002F60
EnumChildWindows.USER32 ref: 01002F78
FindWindowExA.USER32 ref: 01002F8C
EnumChildWindows.USER32 ref: 01002FA4
FindWindowExA.USER32 ref: 01002FB8
EnumChildWindows.USER32 ref: 01002FD0
FindWindowExA.USER32 ref: 01002FE4
EnumChildWindows.USER32 ref: 01002FFC
Sleep.KERNEL32 ref: 01003007

Strings

User Account Control, xrefs: 01002F7E
Found New Hardware, xrefs: 01002FD6
Security Alert - Driver Installation, xrefs: 01002FAA
Windows Security, xrefs: 01002F52
Software Installation, xrefs: 01002F26
Hardware Installation, xrefs: 01002F01

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: FindWindow$ChildEnumWindows$Sleep
String ID: Found New Hardware$Hardware Installation$Security Alert - Driver Installation$Software Installation$User Account Control$Windows Security
API String ID: 4103604691-2659945619
Opcode ID: 1dc6da3401bd3b6f1aa31af812fb590c58b583d7336b5cc62aae183315f79e02
Instruction ID: 3b7e32da0145e93df7366a4e2901ec96f673a1efc07daefae40f8fde59eba7a9
Opcode Fuzzy Hash: 1dc6da3401bd3b6f1aa31af812fb590c58b583d7336b5cc62aae183315f79e02
Instruction Fuzzy Hash: 6451A371311A2182FF1BDF79A829BD52392FB4D780FC49429A98A4A670DFBDC1C9C700

Function 01004E10 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 198
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01004E47
SetupDiGetClassDevsA.SETUPAPI ref: 01004E83
SetupDiEnumDeviceInfo.SETUPAPI ref: 01004ECC
SetupDiGetDeviceRegistryPropertyA.SETUPAPI ref: 01004F2F
GetLastError.KERNEL32 ref: 01004F40
GetLastError.KERNEL32 ref: 01004F4B
LocalFree.KERNEL32 ref: 01004F62
LocalAlloc.KERNEL32 ref: 01004F71
SetupDiGetDeviceRegistryPropertyA.SETUPAPI ref: 01004FA4
GetLastError.KERNEL32 ref: 01004FAE
CharUpperA.USER32 ref: 01004FF9
CharUpperA.USER32 ref: 0100500D
SetupDiGetDeviceRegistryPropertyA.SETUPAPI ref: 0100505E
SetupDiSetDeviceRegistryPropertyA.SETUPAPI ref: 010050A0
lstrlenA.KERNEL32 ref: 010050B2
lstrlenA.KERNEL32 ref: 010050D2
LocalFree.KERNEL32 ref: 010050EC
SetupDiEnumDeviceInfo.SETUPAPI ref: 01005105
GetLastError.KERNEL32 ref: 0100512B
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 01005136
SetLastError.KERNEL32 ref: 0100513E

Strings

@, xrefs: 01005076
, xrefs: 01004EBE
, xrefs: 01005090

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Setup$Device$ErrorLast$PropertyRegistry$InfoLocal$CharEnumFreeUpperlstrlen$AllocClassDestroyDevsListmemset
String ID: $ $@
API String ID: 3964613432-2546599590
Opcode ID: bc96b4a6771157544a245e05172baeb9d97f783c878c24a2f18659ef01c2a556
Instruction ID: 45815152e52b6dffa48fe4af3f3ef6cc8cff8b1926c0f57b199c12c5bff11104
Opcode Fuzzy Hash: bc96b4a6771157544a245e05172baeb9d97f783c878c24a2f18659ef01c2a556
Instruction Fuzzy Hash: 2B817D72608B8186EB66CF15B4043EAB7A1F78AB84F444519EBCA43B98DF7CC155CB04

Function 01003230 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 163
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0100327F
memset.MSVCRT ref: 0100329C
memset.MSVCRT ref: 010032B9
memset.MSVCRT ref: 010032D6
GetPrivateProfileSectionA.KERNEL32 ref: 010032F3
strchr.MSVCRT ref: 01003333
strchr.MSVCRT ref: 01003368
GetPrivateProfileSectionA.KERNEL32 ref: 0100338C
lstrlenA.KERNEL32 ref: 010033E3
strchr.MSVCRT ref: 0100342B
strchr.MSVCRT ref: 01003442
memcpy.MSVCRT ref: 0100345D
lstrlenA.KERNEL32 ref: 01003465
lstrlenA.KERNEL32 ref: 010034B4
lstrlenA.KERNEL32 ref: 010034C2

Strings

CH341SER_Install, xrefs: 010033D1
Manufacturer, xrefs: 010032E3
USB\VID_1A86&PID_7523, xrefs: 010032BE

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: lstrlenmemsetstrchr$PrivateProfileSection$memcpy
String ID: CH341SER_Install$Manufacturer$USB\VID_1A86&PID_7523
API String ID: 3807774933-3756831888
Opcode ID: 36a6da675b92460df2d7b620326077fc87a6ac8d141c905f4ad80f33cc08bdec
Instruction ID: 53ee124e5723ce3756a3166aca6e971a2ab7ed91a65fc7a01dc34fa79bb1eeb9
Opcode Fuzzy Hash: 36a6da675b92460df2d7b620326077fc87a6ac8d141c905f4ad80f33cc08bdec
Instruction Fuzzy Hash: 17617E36608AC089EB22DF25E4583DAB7A1F79A784F488161DACD47A99DF7CC249C700

Function 01006B00 Relevance: 68.7, APIs: 22, Strings: 17, Instructions: 404
windowstringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 01006B6E
GetProcAddress.KERNEL32 ref: 01006B7E
GetCurrentProcess.KERNEL32 ref: 01006B90
memset.MSVCRT ref: 01006BC3

Part of subcall function 01007B80: memset.MSVCRT ref: 01007BB8
Part of subcall function 01007B80: GetModuleFileNameA.KERNEL32 ref: 01007BCA
Part of subcall function 01007B80: strrchr.MSVCRT ref: 01007BDA
Part of subcall function 01007B80: memset.MSVCRT ref: 01007C13
Part of subcall function 01007B80: memcpy.MSVCRT ref: 01007C24

lstrlenA.KERNEL32 ref: 01006C26
WinExec.KERNEL32 ref: 01006DB9
MessageBoxA.USER32 ref: 01006DE8
MessageBoxA.USER32 ref: 01006E10
memset.MSVCRT ref: 01006E35
GetWindowsDirectoryA.KERNEL32 ref: 01006E4E
GetFileAttributesA.KERNEL32 ref: 01006E85
GetFileAttributesA.KERNEL32 ref: 01006EDB
GetUserDefaultLangID.KERNEL32 ref: 01006EF7
memset.MSVCRT ref: 01006F20
_findfirst.MSVCRT ref: 01006F75
GetVersion.KERNEL32 ref: 01007066
GetWindowsDirectoryA.KERNEL32 ref: 0100707E
GetWindowsDirectoryA.KERNEL32 ref: 010070BC
lstrlenA.KERNEL32 ref: 0100712E
MessageBoxA.USER32 ref: 01007222
EndDialog.USER32 ref: 01007234
DialogBoxParamA.USER32 ref: 01007278

Strings

C:\Windows, xrefs: 0100706C
\u, xrefs: 01006D85
kernel32, xrefs: 01006B51
\SYSWOW64, xrefs: 01006E67
DriverSetup, xrefs: 01006DD4, 01006DFC
Initialize, xrefs: 0100720E
\inf\, xrefs: 010070EB
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF, xrefs: 01006FDA, 01006FED, 01007016, 01007038
Program Files (x86), xrefs: 01006EB4
Not found install application,please install by hand!, xrefs: 01006DDB
IsWow64Process, xrefs: 01006B74
\*.INF, xrefs: 01006F4F
\inf\drvidx.bin, xrefs: 01007115
\DRVSETUP64\DRVSETUP64.EXE, xrefs: 01006BED
\s, xrefs: 01006DA3
\p, xrefs: 01006D67
Windows version or directory error, xrefs: 01007215

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$DirectoryFileMessageWindows$AttributesDialogModulelstrlen$AddressCurrentDefaultExecHandleLangNameParamProcProcessUserVersion_findfirstmemcpystrrchr
String ID: \p$ \s$ \u$C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF$C:\Windows$DriverSetup$Initialize$IsWow64Process$Not found install application,please install by hand!$Program Files (x86)$Windows version or directory error$\*.INF$\DRVSETUP64\DRVSETUP64.EXE$\SYSWOW64$\inf\$\inf\drvidx.bin$kernel32
API String ID: 938042602-3964390571
Opcode ID: b1116b82711375004bb1b943e49c04efd78b51d5b3c2956530143525814eaecc
Instruction ID: 64177eabb5dc299ca440807ed88f6317c88e2819922235b34d88f3e5bcc8f193
Opcode Fuzzy Hash: b1116b82711375004bb1b943e49c04efd78b51d5b3c2956530143525814eaecc
Instruction Fuzzy Hash: E8128E35214B85D1FB62CB25E9143E937A1F34C7A1F840212EAEA536E4DFBDD69AC700

Function 01004B80 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 141
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01004BC3
memset.MSVCRT ref: 01004BDF

Part of subcall function 01007CA0: strrchr.MSVCRT ref: 01007CCD

SetupOpenInfFileA.SETUPAPI ref: 01004C05
SetupDiGetActualSectionToInstallA.SETUPAPI ref: 01004C9B
SetupOpenFileQueue.SETUPAPI ref: 01004CA1
SetupInitDefaultQueueCallbackEx.SETUPAPI ref: 01004CD1
SetupInstallFilesFromInfSectionA.SETUPAPI ref: 01004D01
SetupCommitFileQueueA.SETUPAPI ref: 01004D1F
lstrlenA.KERNEL32 ref: 01004D36
SetupTermDefaultQueueCallback.SETUPAPI ref: 01004D8C
SetupCloseFileQueue.SETUPAPI ref: 01004D95
SetupCloseInfFile.SETUPAPI ref: 01004D9E

Strings

CH341SER_Install, xrefs: 01004C4D

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Setup$FileQueue$CallbackCloseDefaultInstallOpenSectionmemset$ActualCommitFilesFromInitTermlstrlenstrrchr
String ID: CH341SER_Install
API String ID: 1093762225-1173522138
Opcode ID: 771e2301b8be8b58b5c8568d194c5088dda41264d3131f03c395fa73cf91207b
Instruction ID: b66b93caaa27ab56b0f3f4e46115261e6a417e31e8239d3c90cab25fd7e84cfb
Opcode Fuzzy Hash: 771e2301b8be8b58b5c8568d194c5088dda41264d3131f03c395fa73cf91207b
Instruction Fuzzy Hash: F851BE35308A8081EB66DF22B8483DA77A1F78DB94F484226DBDA57B94DF7CC185C704

Function 010062B0 Relevance: 27.1, APIs: 18, Instructions: 69
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 010062C2
EnableWindow.USER32 ref: 010062CD
GetDlgItem.USER32 ref: 010062DF
EnableWindow.USER32 ref: 010062EA
GetDlgItem.USER32 ref: 010062FC
EnableWindow.USER32 ref: 01006307
Sleep.KERNEL32 ref: 01006312
CreateThread.KERNEL32 ref: 0100633F
CM_Locate_DevNodeA.SETUPAPI ref: 01006352
CM_Reenumerate_DevNode.SETUPAPI ref: 0100635E

Part of subcall function 01005A30: UpdateWindow.USER32 ref: 01005A6C
Part of subcall function 01005A30: MessageBoxA.USER32 ref: 01005AB0

Sleep.KERNEL32 ref: 0100637A
CloseHandle.KERNEL32 ref: 01006383
GetDlgItem.USER32 ref: 01006395
EnableWindow.USER32 ref: 010063A3
GetDlgItem.USER32 ref: 010063B5
EnableWindow.USER32 ref: 010063C3
GetDlgItem.USER32 ref: 010063D5
EnableWindow.USER32 ref: 010063E3

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Window$EnableItem$NodeSleep$CloseCreateHandleLocate_MessageReenumerate_ThreadUpdate
String ID:
API String ID: 3344006490-0
Opcode ID: 5fd903b976f5b1453dc1dc9d4d09b3f55a232d309f92ec1789d2be98561d6a34
Instruction ID: b5ba18ae24e4a8ab3883f3094b4b921e21858790ce619a5bf1dc2e3b5bb84d64
Opcode Fuzzy Hash: 5fd903b976f5b1453dc1dc9d4d09b3f55a232d309f92ec1789d2be98561d6a34
Instruction Fuzzy Hash: 4831B974700B41C3FB06DB66E8583EA23A6FBCDB85F508125E98A87764DEBDC4998604

Function 010029A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32 ref: 01002A2D
memset.MSVCRT ref: 01002A69
memset.MSVCRT ref: 01002A86
_findfirst.MSVCRT ref: 01002AD3
CopyFileA.KERNEL32 ref: 01002B5F
memset.MSVCRT ref: 01002B72
_findnext.MSVCRT ref: 01002B7F
_findclose.MSVCRT ref: 01002B90

Strings

\Syswow64, xrefs: 01002A48
\*DLL.dll, xrefs: 01002AB5

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$CopyDirectoryFileWindows_findclose_findfirst_findnext
String ID: \*DLL.dll$\Syswow64
API String ID: 2308462801-2431234310
Opcode ID: 3533474ebb6224b62db7d7c1f55c8923e4c83f74fc7b5c07b30234f98ea03731
Instruction ID: 39bda9cade07b2478b5ef2e5a694511e4a92611aaa67f2605a4c762a7f0a2326
Opcode Fuzzy Hash: 3533474ebb6224b62db7d7c1f55c8923e4c83f74fc7b5c07b30234f98ea03731
Instruction Fuzzy Hash: 6F417136208B8181DB65CB25A8543EA77A1F7897B1F408316EAF947AD8EF7CC155C700

Function 01002A00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32 ref: 01002A2D
memset.MSVCRT ref: 01002A69
memset.MSVCRT ref: 01002A86

Part of subcall function 01007CA0: strrchr.MSVCRT ref: 01007CCD

_findfirst.MSVCRT ref: 01002AD3
CopyFileA.KERNEL32 ref: 01002B5F
memset.MSVCRT ref: 01002B72
_findnext.MSVCRT ref: 01002B7F
_findclose.MSVCRT ref: 01002B90

Strings

\Syswow64, xrefs: 01002A48
\*DLL.dll, xrefs: 01002AB5

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$CopyDirectoryFileWindows_findclose_findfirst_findnextstrrchr
String ID: \*DLL.dll$\Syswow64
API String ID: 1468732010-2431234310
Opcode ID: 35282dd75b0edc77c293dc3f90eaea291d8fd42d8f5de310c947f291cddd2d97
Instruction ID: 1b0acab760c45876b8cf37f10f976c235e8c8bc4a014da12c9f505d4ea2e44b8
Opcode Fuzzy Hash: 35282dd75b0edc77c293dc3f90eaea291d8fd42d8f5de310c947f291cddd2d97
Instruction Fuzzy Hash: 9F416F75208B8081DB66CB25E4443EA7361FB897B0F408312EAF947AD8EF7CC155C700

Function 010029DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01002A69
memset.MSVCRT ref: 01002A86
_findfirst.MSVCRT ref: 01002AD3
CopyFileA.KERNEL32 ref: 01002B5F
memset.MSVCRT ref: 01002B72
_findnext.MSVCRT ref: 01002B7F
_findclose.MSVCRT ref: 01002B90

Strings

\*DLL.dll, xrefs: 01002AB5

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$CopyFile_findclose_findfirst_findnext
String ID: \*DLL.dll
API String ID: 1759642172-3447407694
Opcode ID: 1c7472d3335895a2afd347d8d09af4639eb18e55de39019071e7590736823142
Instruction ID: 7925f32c3f0fc18b12537c8d2a0c057b83c9df5efe9692e7962c82bb6109a08d
Opcode Fuzzy Hash: 1c7472d3335895a2afd347d8d09af4639eb18e55de39019071e7590736823142
Instruction Fuzzy Hash: 1231A276204AC091EB268B25A8443EA7761FB997B0F449312EAF907AC8EF6CC145C700

Function 01007F30 Relevance: 12.1, APIs: 8, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 01007F46
__set_app_type.MSVCRT ref: 01008000
__setusermatherr.MSVCRT ref: 0100804F
_initterm.MSVCRT ref: 01008063
__getmainargs.MSVCRT ref: 0100809A
_initterm.MSVCRT ref: 010080AE
exit.MSVCRT ref: 0100814D
_cexit.MSVCRT ref: 01008153

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: _initterm$InfoStartup__getmainargs__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 2570035507-0
Opcode ID: 39fa8c6a57003c2c112c90e4417a6dae4c3a5d5c0bf8421d01e3ec91c66826aa
Instruction ID: 5c26fa711cbdfc81bda35dc84df104fd2242ca3dd5f00d56ef27ed66f6aeb0eb
Opcode Fuzzy Hash: 39fa8c6a57003c2c112c90e4417a6dae4c3a5d5c0bf8421d01e3ec91c66826aa
Instruction Fuzzy Hash: F1515DB1A08781C5F7A28F68E4943E977A4F745794F40826BE7DA536E4CBBCC495CB00

Function 01007CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01007B80: memset.MSVCRT ref: 01007BB8
Part of subcall function 01007B80: GetModuleFileNameA.KERNEL32 ref: 01007BCA
Part of subcall function 01007B80: strrchr.MSVCRT ref: 01007BDA
Part of subcall function 01007B80: memset.MSVCRT ref: 01007C13
Part of subcall function 01007B80: memcpy.MSVCRT ref: 01007C24

strrchr.MSVCRT ref: 01007CCD
GetCurrentDirectoryA.KERNEL32 ref: 01007CDD

Strings

\WIN 1X, xrefs: 01007CFE

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memsetstrrchr$CurrentDirectoryFileModuleNamememcpy
String ID: \WIN 1X
API String ID: 1732238558-3709528400
Opcode ID: 4e62774902319524438102c8fb0bc1701a68b31b9608420015a56cc40904c792
Instruction ID: ec991edd8c6aa41eceb90dc99e5ca3bc155a98f7d53228fffb6bd37998269171
Opcode Fuzzy Hash: 4e62774902319524438102c8fb0bc1701a68b31b9608420015a56cc40904c792
Instruction Fuzzy Hash: 4801A235704B4081EB169B2AA84435977A2B78DBF1F684325DBF9837D5DE7DD0818300

Function 010039D0 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDefaultQueueCallbackA.SETUPAPI ref: 010039E6

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: CallbackDefaultQueueSetup
String ID:
API String ID: 3923229828-0
Opcode ID: 63a6d84a8bbc509c2e7646c487fad4ae7c2d2cc4936932bf4b49f6f39a3f0395
Instruction ID: 3ab8ab93b4b6c2e2e8872aed623279f92e9fe9fbb2cfcf0fac965781f005737e
Opcode Fuzzy Hash: 63a6d84a8bbc509c2e7646c487fad4ae7c2d2cc4936932bf4b49f6f39a3f0395
Instruction Fuzzy Hash: DBC08C78F050018BDA5BA34A88C338C12E0B38C720FD00190C24440645D13E81EE4A00

Non-executed Functions

Function 01006400 Relevance: 108.8, APIs: 46, Strings: 16, Instructions: 350windowthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0100644F
memset.MSVCRT ref: 0100646C
DefWindowProcA.USER32 ref: 010064D0
DialogBoxParamA.USER32 ref: 010064FF
GetDlgItem.USER32 ref: 01006549
ShowWindow.USER32 ref: 01006557
CloseHandle.KERNEL32 ref: 010065F9
CreateThread.KERNEL32 ref: 01006626
MessageBoxA.USER32 ref: 01006656
memset.MSVCRT ref: 01006685
SendDlgItemMessageA.USER32 ref: 010066A2
SendDlgItemMessageA.USER32 ref: 010066C1
SendDlgItemMessageA.USER32 ref: 010066E8
SetDlgItemTextA.USER32 ref: 0100678C
sprintf.MSVCRT ref: 010067C9
SetDlgItemTextA.USER32 ref: 010067E0
LoadIconA.USER32 ref: 01006807
memset.MSVCRT ref: 01006829
sprintf.MSVCRT ref: 01006851
SetWindowTextA.USER32 ref: 0100685F
SendMessageA.USER32 ref: 010068D5
SendMessageA.USER32 ref: 010068ED
SetDlgItemTextA.USER32 ref: 01006902
SetDlgItemTextA.USER32 ref: 01006928
SetDlgItemTextA.USER32 ref: 01006941
SetDlgItemTextA.USER32 ref: 0100695A
SetDlgItemTextA.USER32 ref: 01006973
SetDlgItemTextA.USER32 ref: 0100698C
SetDlgItemTextA.USER32 ref: 010069A5
SetDlgItemTextA.USER32 ref: 010069BE
CloseHandle.KERNEL32 ref: 01006A91
EndDialog.USER32 ref: 01006AA8

Strings

Setup, xrefs: 01006593, 010065B9, 01006648
Update, xrefs: 01006935
Select INF File :, xrefs: 01006999
%s%s, xrefs: 01006845, 01006875
(X64), xrefs: 01006837, 01006867
DriverSetup, xrefs: 0100686E, 010068B2
Select INF File(%d/%d):, xrefs: 010067BD
UNINSTALL, xrefs: 0100694E
VUUU, xrefs: 0100656A
!! Delete the driver files when uninstall the device., xrefs: 01006980
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF, xrefs: 010066EE, 01006701, 0100672D, 01006758
HELP, xrefs: 01006967
Device Driver Install / UnInstall, xrefs: 010069B2
INSTALL, xrefs: 0100691C
Creat thread for installing driver failure!, xrefs: 0100664F
Welcome to contact us if you have some question. Website: http://wch.cnEmail: tech@wch.cn, xrefs: 010065C0

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Item$Text$Message$Send$memset$Window$CloseDialogHandlesprintf$CreateIconLoadParamProcShowThread
String ID: !! Delete the driver files when uninstall the device.$%s%s$(X64)$C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF$Creat thread for installing driver failure!$Device Driver Install / UnInstall$DriverSetup$HELP$INSTALL$Select INF File :$Select INF File(%d/%d):$Setup$UNINSTALL$Update$VUUU$Welcome to contact us if you have some question. Website: http://wch.cnEmail: tech@wch.cn
API String ID: 911698785-1586296145
Opcode ID: a513bd1c8d33f53c47cba3de7556bc523cbc1c97b8cc6f3f34ecd45f885b930b
Instruction ID: 4ecc1a55286add7a349212c79642a856ddecad35c6aac9a0366eaf038524a0fb
Opcode Fuzzy Hash: a513bd1c8d33f53c47cba3de7556bc523cbc1c97b8cc6f3f34ecd45f885b930b
Instruction Fuzzy Hash: B8023871204A81C2FB139B66E8543E93362F78DBA5F404212DADA476E4DFBDC6D9C341

Function 01003C60 Relevance: 77.4, APIs: 40, Strings: 4, Instructions: 422stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01003CA5
memset.MSVCRT ref: 01003CC2
memset.MSVCRT ref: 01003CDF
memset.MSVCRT ref: 01003CFA
memset.MSVCRT ref: 01003D15
memset.MSVCRT ref: 01003D32

Part of subcall function 01003230: memset.MSVCRT ref: 0100327F
Part of subcall function 01003230: memset.MSVCRT ref: 0100329C
Part of subcall function 01003230: memset.MSVCRT ref: 010032B9
Part of subcall function 01003230: memset.MSVCRT ref: 010032D6
Part of subcall function 01003230: GetPrivateProfileSectionA.KERNEL32 ref: 010032F3
Part of subcall function 01003230: strchr.MSVCRT ref: 01003333
Part of subcall function 01003230: strchr.MSVCRT ref: 01003368
Part of subcall function 01003230: GetPrivateProfileSectionA.KERNEL32 ref: 0100338C
Part of subcall function 01003230: lstrlenA.KERNEL32 ref: 010033E3

SetupOpenInfFileA.SETUPAPI ref: 01003D8F
memset.MSVCRT ref: 01003DE0
memset.MSVCRT ref: 01003DF3
SetupDiGetActualSectionToInstallA.SETUPAPI ref: 01003E41
GetPrivateProfileSectionA.KERNEL32 ref: 01003E60
strstr.MSVCRT ref: 01003E8A
strstr.MSVCRT ref: 01003E9F
strchr.MSVCRT ref: 01003F00
lstrlenA.KERNEL32 ref: 01003F36
strchr.MSVCRT ref: 01003F5D
lstrlenA.KERNEL32 ref: 01003F69
memcpy.MSVCRT ref: 01003FBE
lstrlenA.KERNEL32 ref: 01003FE8
memset.MSVCRT ref: 01003FFB
GetPrivateProfileSectionA.KERNEL32 ref: 01004019
lstrlenA.KERNEL32 ref: 0100402F
lstrlenA.KERNEL32 ref: 0100403F
strchr.MSVCRT ref: 01004061
memset.MSVCRT ref: 0100407A
memcpy.MSVCRT ref: 01004095
memset.MSVCRT ref: 010040DF
GetPrivateProfileStringA.KERNEL32 ref: 01004108
GetWindowsDirectoryA.KERNEL32 ref: 01004146
strchr.MSVCRT ref: 01004174
lstrlenA.KERNEL32 ref: 01004180
GetSystemDirectoryA.KERNEL32 ref: 0100423A
strchr.MSVCRT ref: 01004268
lstrlenA.KERNEL32 ref: 01004274

Part of subcall function 010072D0: memset.MSVCRT ref: 010072FD
Part of subcall function 010072D0: memset.MSVCRT ref: 0100731A
Part of subcall function 010072D0: lstrlenA.KERNEL32 ref: 01007322

DeleteFileA.KERNEL32 ref: 01004307
lstrlenA.KERNEL32 ref: 0100431D
lstrlenA.KERNEL32 ref: 01004328
lstrlenA.KERNEL32 ref: 0100433E
SetupCloseInfFile.SETUPAPI ref: 0100434F
lstrlenA.KERNEL32 ref: 01004358

Strings

DestinationDirs, xrefs: 010040F1
CH341SER_Install, xrefs: 01003DBD, 0100435E
CopyFiles, xrefs: 01003E80
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF, xrefs: 01003D40

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$lstrlen$strchr$PrivateProfileSection$FileSetup$Directorymemcpystrstr$ActualCloseDeleteInstallOpenStringSystemWindows
String ID: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF$CH341SER_Install$CopyFiles$DestinationDirs
API String ID: 1380773403-239341470
Opcode ID: de476002ce8c3ebecde7e1d848aad16d448121c14cf6d82c420c4f850504727e
Instruction ID: 012c2a88d65b858bab8690606f5ae3cc1491b53fe752bf6eb7cbbb132d6b25f3
Opcode Fuzzy Hash: de476002ce8c3ebecde7e1d848aad16d448121c14cf6d82c420c4f850504727e
Instruction Fuzzy Hash: FA02A532308AC595E722CB25A8543EEB7A1F799790F848315DBEA53AD9DF7CC249C700

Function 01005520 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 277stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01005565
UpdateWindow.USER32 ref: 01005571
lstrlenA.KERNEL32 ref: 0100557E
SetupDiGetClassDevsA.SETUPAPI ref: 0100559A
memset.MSVCRT ref: 010055C1
SetupDiEnumDeviceInfo.SETUPAPI ref: 010055E0
memset.MSVCRT ref: 01005620
SetupDiGetDeviceRegistryPropertyA.SETUPAPI ref: 01005656
lstrlenA.KERNEL32 ref: 01005677
CharUpperA.USER32 ref: 010056C3
CharUpperA.USER32 ref: 010056CF
lstrlenA.KERNEL32 ref: 01005703
lstrlenA.KERNEL32 ref: 0100595C
lstrlenA.KERNEL32 ref: 0100596D
GetLastError.KERNEL32 ref: 010059C8
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 010059D1

Strings

driver has uninstalled., xrefs: 010058F7
, xrefs: 010055D3
USB\VID_1A86&PID_7523, xrefs: 01005577, 01005685, 010056F6, 01005729, 0100581D, 0100586D, 01005949, 01005952
driver uninstall failure., xrefs: 01005866

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: lstrlen$Setup$Devicememset$CharInfoUpper$ClassDestroyDevsEnumErrorLastListPropertyRegistryUpdateWindow
String ID: $ driver has uninstalled.$ driver uninstall failure.$USB\VID_1A86&PID_7523
API String ID: 2250410049-2464932366
Opcode ID: 3f9910ce4881c9cbc25d909e33dc3e4a93ec36734334fc590ce8de430f70dcec
Instruction ID: 98918b6a90551ba6f9313e3f60d3c310c14603eafd1d621fa90e33caa438c41d
Opcode Fuzzy Hash: 3f9910ce4881c9cbc25d909e33dc3e4a93ec36734334fc590ce8de430f70dcec
Instruction Fuzzy Hash: 21D15D35305B81C5FB66CB25E8543AA77A5F7497A0F808216EAE9437E4DFBCC198CB40

Function 01004830 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 185stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01004873
memset.MSVCRT ref: 0100488E
memset.MSVCRT ref: 010048A8
memset.MSVCRT ref: 010048C3

Part of subcall function 01007CA0: strrchr.MSVCRT ref: 01007CCD

SetupOpenInfFileA.SETUPAPI ref: 010048E9
SetupDiGetActualSectionToInstallA.SETUPAPI ref: 0100497B
SetupOpenFileQueue.SETUPAPI ref: 01004981
SetupInitDefaultQueueCallbackEx.SETUPAPI ref: 010049B1
SetupInstallFilesFromInfSectionA.SETUPAPI ref: 010049E1
SetupCommitFileQueueA.SETUPAPI ref: 010049FF
lstrlenA.KERNEL32 ref: 01004A15
strrchr.MSVCRT ref: 01004A8E

Strings

return:%x, xrefs: 01004B09
CH341SER_Install, xrefs: 01004932
C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF, xrefs: 01004A82, 01004ACA

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Setup$memset$FileQueue$InstallOpenSectionstrrchr$ActualCallbackCommitDefaultFilesFromInitlstrlen
String ID: C:\ElitechLogWin\Drivers\CH341\WIN 1X\CH341SER.INF$CH341SER_Install$return:%x
API String ID: 1477454288-4146110298
Opcode ID: f8f19df1615594456e714ee48475bb04b5b31ac89be51965ab3bab77fd00abf9
Instruction ID: affff9012001daa8782365285b14e8490acb85629a31921f6550f57fcf4223b9
Opcode Fuzzy Hash: f8f19df1615594456e714ee48475bb04b5b31ac89be51965ab3bab77fd00abf9
Instruction Fuzzy Hash: 55818C35308BC085EB22DB26A8547DA77A1F78EB94F444221DBDA43B99DFBCC189C704

Function 01007E10 Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 01007E30
RtlLookupFunctionEntry.KERNEL32 ref: 01007E48
RtlVirtualUnwind.KERNEL32 ref: 01007E82
SetUnhandledExceptionFilter.KERNEL32 ref: 01007EE9
UnhandledExceptionFilter.KERNEL32 ref: 01007EF6
GetCurrentProcess.KERNEL32 ref: 01007EFC
TerminateProcess.KERNEL32 ref: 01007F0A

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: db5b5178bf3ff8feb64ce4718fea8badd758f5592c3f4cc6c365d766497a8801
Instruction ID: bed53b5b81979605c833d627ea33c5d8017907b99ea240a3b9114dd108fa55df
Opcode Fuzzy Hash: db5b5178bf3ff8feb64ce4718fea8badd758f5592c3f4cc6c365d766497a8801
Instruction Fuzzy Hash: EB31F336208B80D2EB01CB15F84438977A4F789B84F94011AEACD57B28DFBCD5DACB00

Function 01007D40 Relevance: 7.5, APIs: 5, Instructions: 40timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 01007D82
GetCurrentProcessId.KERNEL32 ref: 01007D8D
GetCurrentThreadId.KERNEL32 ref: 01007D99
GetTickCount.KERNEL32 ref: 01007DA5
QueryPerformanceCounter.KERNEL32 ref: 01007DB6

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 79a1aff6a1cf02e276ef40a98818737823d0a3eb140028d2a15dd9222b041779
Instruction ID: 4b646a673a137d8cb16028cbaaedfcf5cbdfd58d2ccb82d35cb1228191e1f528
Opcode Fuzzy Hash: 79a1aff6a1cf02e276ef40a98818737823d0a3eb140028d2a15dd9222b041779
Instruction Fuzzy Hash: BE011B35715B4082EB52DF15A944385B3A5FB5DBD1F886211EFDA037A8DBBCC4D48700

Function 01005190 Relevance: 47.4, APIs: 23, Strings: 4, Instructions: 162filewindowstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 010051CE
memset.MSVCRT ref: 010051EB
SetupDiBuildDriverInfoList.SETUPAPI ref: 010051FC
memset.MSVCRT ref: 01005230
SetLastError.KERNEL32 ref: 0100524D
GetVersion.KERNEL32 ref: 01005260
GetWindowsDirectoryA.KERNEL32 ref: 01005278
SetupDiEnumDriverInfoA.SETUPAPI ref: 010052C6
SetupDiGetDriverInfoDetailA.SETUPAPI ref: 010052FC
lstrlenA.KERNEL32 ref: 0100532E
memcpy.MSVCRT ref: 0100534A
DeleteFileA.KERNEL32 ref: 01005373
DeleteFileA.KERNEL32 ref: 01005381
GetVersion.KERNEL32 ref: 01005389
GetWindowsDirectoryA.KERNEL32 ref: 010053A1
memset.MSVCRT ref: 010053D8
MessageBoxA.USER32 ref: 01005413
EndDialog.USER32 ref: 01005425
SetupDiEnumDriverInfoA.SETUPAPI ref: 01005457
MessageBoxA.USER32 ref: 0100547D
EndDialog.USER32 ref: 0100548F
memset.MSVCRT ref: 010054AA
SetupDiDestroyDriverInfoList.SETUPAPI ref: 010054EE

Strings

C:\Windows, xrefs: 01005266, 0100538F
Initialize, xrefs: 010053FF, 01005469
PNF, xrefs: 01005362
Windows version or directory error, xrefs: 01005406, 01005470

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: DriverInfoSetupmemset$DeleteDialogDirectoryEnumFileListMessageVersionWindows$BuildDestroyDetailErrorLastlstrlenmemcpy
String ID: C:\Windows$Initialize$PNF$Windows version or directory error
API String ID: 805928874-4264738195
Opcode ID: eac29da7d496fb58285279c6e299e8ad263daa5ff1820f49cb6fc353746004b9
Instruction ID: 2d1e4316d519fd50e4e3d7e1cadad09cc6a7cb11bc1f8261b2ff817836719b0d
Opcode Fuzzy Hash: eac29da7d496fb58285279c6e299e8ad263daa5ff1820f49cb6fc353746004b9
Instruction Fuzzy Hash: 1A816971708B8182FB66CB21E8483DAB765F789B85F448115DAC943BD9DFBCC289CB00

Function 010043E0 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 153stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01004411
SetupDiGetClassDevsA.SETUPAPI ref: 01004443
SetupDiEnumDeviceInfo.SETUPAPI ref: 01004481
memset.MSVCRT ref: 010044B8
SetupDiGetDeviceRegistryPropertyA.SETUPAPI ref: 010044EA
GetLastError.KERNEL32 ref: 010044F4
GetLastError.KERNEL32 ref: 01004503
lstrlenA.KERNEL32 ref: 01004522
CharUpperA.USER32 ref: 01004543
CharUpperA.USER32 ref: 01004557
SetupDiGetDeviceRegistryPropertyA.SETUPAPI ref: 010045AE
lstrlenA.KERNEL32 ref: 010045BE
lstrlenA.KERNEL32 ref: 010045D8
lstrlenA.KERNEL32 ref: 010045E9
SetupDiEnumDeviceInfo.SETUPAPI ref: 01004605
SetupDiSetDeviceRegistryPropertyA.SETUPAPI ref: 01004635
GetLastError.KERNEL32 ref: 01004651
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 0100465C
SetLastError.KERNEL32 ref: 01004664

Strings

, xrefs: 01004628
, xrefs: 01004479

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Setup$Device$ErrorLastlstrlen$InfoPropertyRegistry$CharEnumUppermemset$ClassDestroyDevsList
String ID: $
API String ID: 2896759909-227171996
Opcode ID: 990c7505cc9344ec8fe7d9f548934e6fc79d0949f9c35170f61c85590a89c856
Instruction ID: 48551ae3a0372e4eb1ad580cd8c01100591d1f7bbeeeaf59b66ed3c816af92f2
Opcode Fuzzy Hash: 990c7505cc9344ec8fe7d9f548934e6fc79d0949f9c35170f61c85590a89c856
Instruction Fuzzy Hash: 14614072608AC186EB26CF25E4043EEB7A1F789B85F544115DBCA83B99DF7DC189CB04

Function 01003A00 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 118librarystringloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01003A44
memset.MSVCRT ref: 01003A61
LoadLibraryA.KERNEL32 ref: 01003A6D
SetupDiBuildDriverInfoList.SETUPAPI ref: 01003A89
memset.MSVCRT ref: 01003AAF
SetLastError.KERNEL32 ref: 01003AC6
SetupDiEnumDriverInfoA.SETUPAPI ref: 01003AEB
SetupDiGetDriverInfoDetailA.SETUPAPI ref: 01003B3B
GetProcAddress.KERNEL32 ref: 01003B4B
CharUpperA.USER32 ref: 01003B65
strrchr.MSVCRT ref: 01003B78
strstr.MSVCRT ref: 01003B8B
memset.MSVCRT ref: 01003BB3
SetupDiEnumDriverInfoA.SETUPAPI ref: 01003BE1
FreeLibrary.KERNEL32 ref: 01003C0A
SetupDiDestroyDriverInfoList.SETUPAPI ref: 01003C1C

Strings

OEM, xrefs: 01003B7E
SetupUninstallOEMInfA, xrefs: 01003B41
setupapi.dll, xrefs: 01003A66

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: DriverInfoSetup$memset$EnumLibraryList$AddressBuildCharDestroyDetailErrorFreeLastLoadProcUpperstrrchrstrstr
String ID: OEM$SetupUninstallOEMInfA$setupapi.dll
API String ID: 595251834-3303978262
Opcode ID: 7c8484584d067756567507281b056e82608a8b798848ad761b86dc74e5260106
Instruction ID: 232490aab7cc0081e024c5c973cf5c0b0f925a6f5fd66716bb66a3d1104f21b3
Opcode Fuzzy Hash: 7c8484584d067756567507281b056e82608a8b798848ad761b86dc74e5260106
Instruction Fuzzy Hash: D7517031319B8186EB66DF12F8447DAB7A9F788B84F845015EACA47B98DF7DC149CB00

Function 010046B0 Relevance: 29.8, APIs: 10, Strings: 7, Instructions: 81windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 010046D1
GetVersion.KERNEL32 ref: 010046EF
GetWindowsDirectoryA.KERNEL32 ref: 01004707
SetWindowTextA.USER32 ref: 0100473B
SetDlgItemTextA.USER32 ref: 01004754
MessageBoxA.USER32 ref: 01004787
EndDialog.USER32 ref: 01004799
memcpy.MSVCRT ref: 010047F6
SetDlgItemTextA.USER32 ref: 0100480A

Strings

C:\Windows, xrefs: 010046F5
INSTALL, xrefs: 01004748
1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins, xrefs: 010047E2
Setup Program Overview , xrefs: 010047D2
1.You should put all the drive files(sys,dll) in the same directory at first, then select the installation file *.inf before installing or uninstalling the driver;2.Run the setup.exe file and click [INSTALL] to install driver in advance. Then the devices ins, xrefs: 010047BF
Initialize, xrefs: 01004773
Windows version or directory error, xrefs: 0100477A

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Text$DialogItem$DirectoryMessageVersionWindowWindowsmemcpy
String ID: 1. Before operation,first select *.INF from the combo box, the corresponding driver file (SYS, DLL, etc.) should be placed in the same directory; 2. Click [Install] to pre-install the device driver. After plugging in the device, the OS will automatically ins$1.You should put all the drive files(sys,dll) in the same directory at first, then select the installation file *.inf before installing or uninstalling the driver;2.Run the setup.exe file and click [INSTALL] to install driver in advance. Then the devices ins$C:\Windows$INSTALL$Initialize$Setup Program Overview $Windows version or directory error
API String ID: 877676245-2530981276
Opcode ID: dd8bc82865743a538a2fa4695463eaca3a011bdb1ac7973c9591c67260a1b1b9
Instruction ID: 9fe62a5bf8a545000e956a13b3c9b39fd5cc0f0951c9dbce43b0b155a6b8d908
Opcode Fuzzy Hash: dd8bc82865743a538a2fa4695463eaca3a011bdb1ac7973c9591c67260a1b1b9
Instruction Fuzzy Hash: 303147B8604B05D2FF178B16E8443E52762B78E781F804152DAC9876E5EEBCC2DAC304

Function 01003040 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01003076
memset.MSVCRT ref: 01003093

Part of subcall function 01007CA0: strrchr.MSVCRT ref: 01007CCD

_findfirst.MSVCRT ref: 010030E8
SendDlgItemMessageA.USER32 ref: 0100311F
_findnext.MSVCRT ref: 0100312F
SendDlgItemMessageA.USER32 ref: 01003158
sprintf.MSVCRT ref: 01003181
SetDlgItemTextA.USER32 ref: 0100319B
sprintf.MSVCRT ref: 010031B8
SetDlgItemTextA.USER32 ref: 010031D2
GetDlgItem.USER32 ref: 010031E4
SetFocus.USER32 ref: 010031ED

Strings

\*.INF, xrefs: 010030C2
Select INF File(%d/%d):, xrefs: 010031A3

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: Item$MessageSendTextmemsetsprintf$Focus_findfirst_findnextstrrchr
String ID: Select INF File(%d/%d):$\*.INF
API String ID: 3048572605-1096616172
Opcode ID: 380088605e26e108428c00b0e22d9b91f2eaa6d52c29a9ce79305ffd66a764bc
Instruction ID: ff514e6ac8f989e3aa6c0ad42fdce590e4869c5a577b2b639808b07786c1ac2a
Opcode Fuzzy Hash: 380088605e26e108428c00b0e22d9b91f2eaa6d52c29a9ce79305ffd66a764bc
Instruction Fuzzy Hash: 78413A35704B81C6EB228B26E8407DE77A1F78D791F404212DAD947AE4DFBCC689C700

Function 01002CD0 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01002CFD
GetWindowTextA.USER32 ref: 01002D10
_stricmp.MSVCRT ref: 01002D22
_stricmp.MSVCRT ref: 01002D38
_stricmp.MSVCRT ref: 01002D4E
_stricmp.MSVCRT ref: 01002D64
_stricmp.MSVCRT ref: 01002D7A
SendMessageA.USER32 ref: 01002DAD

Strings

&Continue Anyway, xrefs: 01002D16
&Yes, xrefs: 01002D6E
&Ask me again later, xrefs: 01002D58
Yes, xrefs: 01002D42
&Install this driver software anyway, xrefs: 01002D2C

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: _stricmp$MessageSendTextWindowmemset
String ID: &Ask me again later$&Continue Anyway$&Install this driver software anyway$&Yes$Yes
API String ID: 2456620571-574706505
Opcode ID: 7f0502d38efa46cb1cdae7d4dc69e7b78b9ca81d659487f0fc303cf67b1fb468
Instruction ID: a7f8a144b26a64d2531c338e4a9d134e75ea13f53bd766cc826de96ded9bf5a1
Opcode Fuzzy Hash: 7f0502d38efa46cb1cdae7d4dc69e7b78b9ca81d659487f0fc303cf67b1fb468
Instruction Fuzzy Hash: 9C215E71324D4292FB22DB25FC543DA2360F79CB85F848022A6CD879A8EF7CC699C710

Function 01002BD0 Relevance: 12.1, APIs: 8, Instructions: 56windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01002BFB
GetWindowTextA.USER32 ref: 01002C0E
_stricmp.MSVCRT ref: 01002C20
_stricmp.MSVCRT ref: 01002C36
_stricmp.MSVCRT ref: 01002C4C
_stricmp.MSVCRT ref: 01002C62
_stricmp.MSVCRT ref: 01002C78
SendMessageA.USER32 ref: 01002CAB

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: _stricmp$MessageSendTextWindowmemset
String ID:
API String ID: 2456620571-0
Opcode ID: 9f93b1b9668f486db828ed5112958a927899e4b730fce1c64e8ef0afcd4e2863
Instruction ID: 5f4c1bd4b6cb64395303f5c285e120e465f9c0ba309381548381776f7300f940
Opcode Fuzzy Hash: 9f93b1b9668f486db828ed5112958a927899e4b730fce1c64e8ef0afcd4e2863
Instruction Fuzzy Hash: 7A215171314E4692FB32DF25F8547D92361F798784F84802195CE879A4EFBCC289C710

Function 010072D0 Relevance: 7.6, APIs: 6, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 010072FD
memset.MSVCRT ref: 0100731A
lstrlenA.KERNEL32 ref: 01007322
lstrlenA.KERNEL32 ref: 01007383
memcpy.MSVCRT ref: 010073BA
lstrlenA.KERNEL32 ref: 010073C7

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: lstrlen$memset$memcpy
String ID:
API String ID: 3971493115-0
Opcode ID: 2b8aff4864e98d8cb2eacc2a196710bb9dabdb17e82dfcf207a7095bb2d3bb41
Instruction ID: fe2b1309f62bee1f522740dcc851686e01379d56934cb70560485cd3a038d29c
Opcode Fuzzy Hash: 2b8aff4864e98d8cb2eacc2a196710bb9dabdb17e82dfcf207a7095bb2d3bb41
Instruction Fuzzy Hash: F32194626185C485FB72DB29E4503EEB7A0F795708F44C162CACD43595DE6CC28ACB54

Function 01007B80 Relevance: 7.6, APIs: 5, Instructions: 65stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01007BB8
GetModuleFileNameA.KERNEL32 ref: 01007BCA
strrchr.MSVCRT ref: 01007BDA
memset.MSVCRT ref: 01007C13
memcpy.MSVCRT ref: 01007C24

Memory Dump Source

Source File: 00000004.00000002.1968326299.0000000001001000.00000020.00000001.01000000.00000009.sdmp, Offset: 01000000, based on PE: true

Associated: 00000004.00000002.1968294031.0000000001000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968361527.000000000100C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1968442661.0000000001012000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1000000_DRVSETUP64.jbxd

Similarity

API ID: memset$FileModuleNamememcpystrrchr
String ID:
API String ID: 1258352919-0
Opcode ID: a7d2f4154ebc157eef87f7cc303e1aa231aca4d9c037895eb65ca4210825c583
Instruction ID: 3ed1d1f8196d2c5d561f875e777fd4e0647e6cf980e1caa341fa860d81e8c6a4
Opcode Fuzzy Hash: a7d2f4154ebc157eef87f7cc303e1aa231aca4d9c037895eb65ca4210825c583
Instruction Fuzzy Hash: D9217C36218B8481EB32DB25E4103DE77A1F799BA0F4843269AED43BC5DE6DC2458B00

Analysis Process: CP210xVCPInstaller_x64.exePID: 7776, Parent PID: 7268COMMON

Non-executed Functions

Function 00007FF7798CD440 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7798CD477
GetCurrentProcessId.KERNEL32 ref: 00007FF7798CD482
GetCurrentThreadId.KERNEL32 ref: 00007FF7798CD48E
GetTickCount.KERNEL32 ref: 00007FF7798CD49A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7798CD4AB

Memory Dump Source

Source File: 00000009.00000002.1999488611.00007FF779871000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF779870000, based on PE: true

Associated: 00000009.00000002.1999453668.00007FF779870000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1999565743.00007FF7798F1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1999601219.00007FF7798F3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1999601219.00007FF779908000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff779870000_CP210xVCPInstaller_x64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 404986f5cc30a85b1b110af08f269cf27d5de7fe2ab396615c35e90afeb4e3b4
Instruction ID: f2af7c608932c7a21ce7f9dd7177ee77767712d610204b8186b8981b17e30e39
Opcode Fuzzy Hash: 404986f5cc30a85b1b110af08f269cf27d5de7fe2ab396615c35e90afeb4e3b4
Instruction Fuzzy Hash: 3A01562263AB0281E750EF21E450265E370FB45F90F843534DE5E47BA4DE3CD9E58320

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ElitechLogWin V6.4.6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ElitechLogWin\Async_MessageBox.dll (copy)

C:\ElitechLogWin\CH341PT.DLL (copy)

C:\ElitechLogWin\Components\WindowsInstaller-KB893803-v2-x86.exe (copy)

C:\ElitechLogWin\Components\dotNetFx40_Client_x86_x64.exe (copy)

C:\ElitechLogWin\Components\is-69FOL.tmp

C:\ElitechLogWin\Components\is-77COG.tmp

C:\ElitechLogWin\Components\is-R21KT.tmp

C:\ElitechLogWin\Components\is-V65L8.tmp

C:\ElitechLogWin\Components\wic_x86_chs.exe (copy)

C:\ElitechLogWin\Components\wic_x86_enu.exe (copy)

C:\ElitechLogWin\Crc32.NET.dll (copy)

C:\ElitechLogWin\Crc32.NET.xml (copy)

C:\ElitechLogWin\DB\data.db3 (copy)

C:\ElitechLogWin\DB\is-8N0RS.tmp

C:\ElitechLogWin\DL.exe (copy)

C:\ElitechLogWin\DL.exe.config (copy)

C:\ElitechLogWin\DL.pdb (copy)

C:\ElitechLogWin\Drivers\CH341\CH341M64.SYS (copy)

C:\ElitechLogWin\Drivers\CH341\CH341PORTS.DLL (copy)

C:\ElitechLogWin\Drivers\CH341\CH341PORTSA64.DLL (copy)

C:\ElitechLogWin\Drivers\CH341\CH341PT.DLL (copy)

C:\ElitechLogWin\Drivers\CH341\CH341PTA64.DLL (copy)

Windows Analysis Report
ElitechLogWin V6.4.6.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre