Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe

Overview

General Information

Sample name:SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Analysis ID:1417366
MD5:12cba957e6008442696a276d44fd60f5
SHA1:7038d228bb77cd86871202249839e0e8baaaacc6
SHA256:64a40e5ff36383163b44a06e4672084952bd82ef5e10069c9f4c6557cdf57572
Tags:exe
Infos:

Detection

Score:6
Range:0 - 100
Whitelisted:false
Confidence:40%

Signatures

Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\How to uninstall.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\img\Default\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\img\mame4\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\img\Win8\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusAnime\Note\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\Default\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\Mame\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\MameHip\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\SimpleNumbers\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\??????????readme 1st.txtJump to behavior
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\LockProcess.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\x64\Release\AdobeReader.pdb%% GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\Win32\Release\Txv.pdbEE/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\x64\Release\AsrLoad.pdb--)GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellCascadeWindows.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MakeBigFile.pdbAA.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ScreenSaver.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellUndoMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileReproduction.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExecute.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionCheck.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\x64\Release\MediaPlayer.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExport.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DriveInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\Export.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Export.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\Win32\Release\InternetExplore.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\Export.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Export.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileAttribute.pdb@@/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\FileRenameEx\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileHorizontally.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\Win32\Release\Associate.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileHorizontally.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLocalTumb.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellMinimizeALL.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Txv\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Txv.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgImgFmt.pdbCC2GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeSelfExtract.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeSelfExtract.exe0.0.dr, MakeSelfExtract.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SimilarCopy.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExecute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgTxtFmt.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DivFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MkDir.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SettingInitialization.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellSetTime.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileCpMv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\MArc\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.dll0.0.dr, MArc.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DivFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SettingInitialization.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Fin\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Fin.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellSetTime.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileInfo.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\Win32\Release\Test32.pdb..*GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test32.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\Win32\Release\MediaPlayer.pdb))"GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ScreenSaver.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\Release\MArc.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, MArc.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\FileRenameEx\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNameCp.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileReproduction.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DriveInfo.pdb==/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\Win32\Release\AdobeReader.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLink.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MemInfo.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionCheck.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MoveFolder.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\x64\Release\AdobeReader.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRename.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateErrorReport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellUndoMinimizeALL.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe0.0.dr
Source: Binary string: 0*.ncb;*.suo;*.scc;*.aps;*.obj;*.pdb;*.res;*.idb;*.dep;*.pch;*.tlb;*.ilk source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, _Filter.txt.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\x64\Release\Brws.pdb??-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DivFile.pdbAA2GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Seeker\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Seeker.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\LockProcess.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DivFile.pdbBB3GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcPack.pdbMM/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcPack.exe0.0.dr, ArcPack.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileCpMv.pdbEE.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRenameEx.pdbEE0GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\x64\Release\Unreg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\x64\Release\AsrLoad.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MakeBigFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RmHardware.pdb;;.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionInfo.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\Win32\Release\Seeker.pdbff/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRename.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MemInfo.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\Win32\Release\AsrLoad.pdb..*GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FolderIconChange.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileAttribute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\Win32\Release\MediaPlayer.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\Export.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Export.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileDelete.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\x64\Release\Brws.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileAttribute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNameCp.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellStartMenu.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileVertically.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeArchive.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeArchive.exe.0.dr, MakeArchive.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcPack.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcPack.exe0.0.dr, ArcPack.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MemInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Txv\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileCpMv.pdbFF/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLink.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileDelete.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileVertically.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionCheck.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRename.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MemInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRenameEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\Win32\Release\Txv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\x64\Release\InternetExplore.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\WinEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, WinEx.exe.0.dr, WinEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\Win32\Release\Fin.pdbPP/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLocalTumb.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellWinHELP.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\Win32\Release\Unreg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcUnPack.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcUnPack.exe.0.dr, ArcUnPack.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SimilarCopy.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\x64\Release\Associate.pdb::-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FreeMem.pdb--)GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SimilarCopy.pdbBB.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileHorizontally.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\x64\Release\Seeker.pdbee.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\x64\Release\Txv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DriveInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeBigFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MoveFolder.pdbBB.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Asr\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.ja-JP.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\Option.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Option.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\UpdateAsr\Win32\Release\UpdateAsr.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, UpdateAsr.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\x64\Release\Associate.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\x64\Release\Unreg.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MoveFolder.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNewEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RemoveZoneID.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellWinHELP.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\x64\Release\MediaPlayer.pdb((!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll0.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\Win32\Release\Test32.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test32.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileHorizontally.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExecute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\Win32\Release\AdobeReader.pdb&&!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\WinEx.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, WinEx.exe.0.dr, WinEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\Win32\Release\Brws.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateTumbImg.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\x64\Release\Fin.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgTxtFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Asr\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.ja-JP.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgImgFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FolderIconChange.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\Win32\Release\Associate.pdb;;.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRenameEx.pdbDD/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ScreenSaver.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeSelfExtract.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeSelfExtract.exe0.0.dr, MakeSelfExtract.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgTxtFmt.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FreeMem.pdb..*GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellSetTime.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeBigFile.pdbBB/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\x64\Release\Txv.pdbDD.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\x64\Release\Seeker.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\FirstSetting\Win32\Release\FirstSetting.pdbw source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FolderIconChange.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Asr\x64\Release\Asr.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RmHardware.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RemoveZoneID.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\Win32\Release\InternetExplore.pdb((!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\Win32\Release\Seeker.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRenameEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileDelete.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLink.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNewEx.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\RealPlayer\Win32\Release\RealPlayer.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RealPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\LockProcess.pdbBB1GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\SendToCompress\Release\SendToCompress.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SendToCompress.exe0.0.dr, SendToCompress.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\x64\Release\InternetExplore.pdb'' GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileCpMv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SettingInitialization.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\Win32\Release\Brws.pdb@@.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileShortcut.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileReproduction.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellUndoMinimizeALL.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLink.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\Win32\Release\Unreg.pdb==/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SimilarCopy.pdbCC/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\BindFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, BindFile._xe0.0.dr, BindFile._xe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateTumbImg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellCascadeWindows.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateErrorReport.pdb66 source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgTxtFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellStartMenu.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\LockProcess.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExecute.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNewEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileInfo.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcDllInfo.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcDllInfo.exe.0.dr, ArcDllInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DriveInfo.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MkDir.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FreeMem.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionInfo.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Seeker\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.dll.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\x64\Release\Test64.pdb,,(GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test64.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe0.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\x64\Release\Test64.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test64.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcUnPack.pdbDD/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcUnPack.exe.0.dr, ArcUnPack.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\SendToExtract\Release\SendToExtract.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SendToExtract.exe.0.dr, SendToExtract.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionCheck.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\RealPlayer\Win32\Release\RealPlayer.pdb&&!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RealPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileReproduction.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\Option.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Option.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileShortcut.pdb@@.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellStartMenu.pdb;;.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellCascadeWindows.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellSetTime.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\Win32\Release\Fin.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgImgFmt.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellWinHELP.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\Release\MArc.pdbXX/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, MArc.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Asr\Win32\Release\Asr.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\Export.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Export.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRename.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellCascadeWindows.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcDllInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcDllInfo.exe.0.dr, ArcDllInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNewEx.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RmHardware.pdb::-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellUndoMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateErrorReport.pdb77 source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileDelete.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FolderIconChange.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNameCp.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellMinimizeALL.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeArchive.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeArchive.exe.0.dr, MakeArchive.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellWinHELP.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNameCp.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\FirstSetting\Win32\Release\FirstSetting.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\Win32\Release\AsrLoad.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ScreenSaver.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileShortcut.pdb??-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Fin\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Fin.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MkDir.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileVertically.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\BindFile.pdb((&GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, BindFile._xe0.0.dr, BindFile._xe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateErrorReport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellStartMenu.pdb::-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RemoveZoneID.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileShortcut.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLocalTumb.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MkDir.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RemoveZoneID.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExport.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RmHardware.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateTumbImg.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLocalTumb.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MoveFolder.pdbCC/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileAttribute.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\UpdateAsr\Win32\Release\UpdateAsr.pdbs source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, UpdateAsr.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\x64\Release\Fin.pdbOO.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Brws\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileVertically.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgImgFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Brws\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FreeMem.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateTumbImg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SettingInitialization.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe.0.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0040546D FindFirstFileW,0_2_0040546D
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr, Seeker.exe0.0.dr, Brws.exe0.0.drString found in binary or memory: http://ftp://.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe0.0.dr, VersionCheck.exe.0.drString found in binary or memory: http://hp.vector.co.jp/authors/VA020799/asr_verinfo.cgiasr
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, history.txt.0.drString found in binary or memory: http://hp.vector.co.jp/authors/VA033418/)
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.drString found in binary or memory: http://search.msn.co.jp/?FORM=HPRECChildFrameSoftware
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe.0.drString found in binary or memory: http://search.msn.co.jp/?FORM=HPREFavoritesSoftware
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, How to update.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/1st/document/02_04.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/1st/document/02_05.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/Appendix.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/AppendixRuntime.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/2.install/01.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, How to uninstall.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/2.install/04.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, How to update.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/2.install/05.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/01.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/02.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/05.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/07.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drString found in binary or memory: http://www.all.undo.jp/asr/man5/9.Infomation/1.Usage/01.html
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, report.ja-JP.0.dr, report.ja-JP0.0.drString found in binary or memory: http://www.all.undo.jp/cgi/report/report.cgi
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe0.0.dr, VersionCheck.exe0.0.dr, VersionCheck.exe.0.drString found in binary or memory: https://all.undo.jp/
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe.0.drString found in binary or memory: https://all.undo.jp/Invalid
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.drString found in binary or memory: https://all.undo.jp/asr/AppendixRuntime.htmlhttps://all.undo.jp/asr/Appendix.htmlSuccessful
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, UpdateAsr.exe.0.drString found in binary or memory: https://all.undo.jp/asr/AppendixRuntime.htmlopenhttps://all.undo.jp/asr/Appendix.htmlSuccessful
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr, Seeker.exe0.0.dr, Brws.exe0.0.dr, FileRenameEx.exe0.0.dr, FileRenameEx.exe.0.drString found in binary or memory: https://all.undo.jp/asr/man5/
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Option.exe0.0.dr, FileNameCp.exe0.0.dr, ArcPack.exe0.0.dr, FileAttribute.exe0.0.dr, Export.exe.0.dr, ArcPack.exe.0.dr, FileCpMv.exe0.0.dr, Export.exe0.0.dr, MakeSelfExtract.exe0.0.dr, CreateLocalTumb.exe0.0.dr, ArcDllInfo.exe.0.dr, FileInfo.exe.0.dr, WinEx.exe.0.dr, FileRename.exe0.0.dr, FileDelete.exe0.0.dr, FileNewEx.exe0.0.dr, FileNewEx.exe.0.dr, SettingInitialization.exe.0.dr, CreateLocalTumb.exe.0.dr, MoveFolder.exe0.0.drString found in binary or memory: https://all.undo.jp/asr/man5/%s%s%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.drString found in binary or memory: https://all.undo.jp/asr/man5/9.Infomation/1.Usage/01.htmlopen
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe.0.dr, MakeBigFile.exe0.0.drString found in binary or memory: https://all.undo.jp/asr/man5/Kernel32.dllSetDefaultDllDirectoriesMakeBigFile
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, Txv.exe.0.dr, Brws.exe.0.dr, Txv.exe0.0.dr, MArc.exe.0.dr, MkDir.exe.0.dr, Seeker.exe.0.drString found in binary or memory: https://all.undo.jp/asr/man5/notepad%s%s%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.dr, Asr.exe.0.drString found in binary or memory: https://all.undo.jp/asr/man5/notepadwb
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, Txv.exe.0.dr, Brws.exe.0.dr, Txv.exe0.0.dr, MArc.exe.0.dr, MkDir.exe.0.dr, Seeker.exe.0.drString found in binary or memory: https://http://ftp://.exe.lnk.ico.cur.ani.scr.EXE.LNK.ICO.CUR.ANI.SCR%s%s%s(%d)%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.dr, Asr.exe.0.drString found in binary or memory: https://http://ftp://.exe.lnk.ico.cur.ani.scr.EXE.LNK.ICO.CUR.ANI.SCR%s(%d)%s?:
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0040D6E00_2_0040D6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004137230_2_00413723
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_00417BF60_2_00417BF6
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004250510_2_00425051
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004230700_2_00423070
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004210E00_2_004210E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0042512B0_2_0042512B
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004232800_2_00423280
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0041C5C00_2_0041C5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004026E40_2_004026E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0041F7560_2_0041F756
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004237A00_2_004237A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004067A80_2_004067A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_004239600_2_00423960
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_00423E500_2_00423E50
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_00424EC30_2_00424EC3
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0041FE900_2_0041FE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0041CFE00_2_0041CFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: String function: 00424810 appears 190 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: String function: 004037CA appears 64 times
Source: FreeMem.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: AsrLoad.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FreeMem.exe0.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: AsrLoad.exe0.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FirstSetting.exe.0.drStatic PE information: Resource name: None type: DOS executable (COM)
Source: FirstSetting.exe.0.drStatic PE information: Resource name: None type: DOS executable (COM)
Source: ICON.dll0.0.drStatic PE information: No import functions for PE file found
Source: ICON.dll.0.drStatic PE information: No import functions for PE file found
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSendToCo.exe> vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSendToEx.exe< vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTxv.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUnreg.exe, vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSeeker.exe$ vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTxv.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUnreg.exe, vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBindFile.exe2 vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilename7z.sfx.exe, vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFirstSetting.exeF vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTest.exe: vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUpdateAsr.exe, vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAsr.exe* vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAsrLoad.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAssociate.exe^ vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArcDllInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArcPack.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArcUnPack.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameChgImgFmt.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameChgTxtFmt.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateErrorReport.exeD vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateLink.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateLocalTumb.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateTumbImg.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDivFile.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDriveInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameExport.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileAttribute.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileCpMv.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileDelete.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileExecute.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileExport.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: IconMode%sFileInfo.tmp%Y/%m/%d %H:%M"%SDRHSACErsOTICompanyNameLegalCopyrightLegalTrademarksProductNameInternalNameFileDescriptionFileVersionProductVersionCommentsOriginalFilenamePrivateBuildSpecialBuild$Type$TimeCreate$TimeWrite$TimeAccess$SizeByte$SizeUnit$Att$FullPath$IsExistFileVersions$CompanyName$LegalCopyright$LegalTrademarks$ProductName$InternalName$FileDescription$FileVersion$ProductVersion$Comments$OriginalFilename$PrivateBuild$SpecialBuild$AlternateDataStreamAlternate Data Stream vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: $OriginalFilename vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: MacroTextFilterSubDirUNCLastCRRelative%Y/%m/%d %H:%M"%SDRHSACErsOTI6.Command/2.DefaultCommand/FileNameCp.htmlCompanyNameLegalCopyrightLegalTrademarksProductNameInternalNameFileDescriptionFileVersionProductVersionCommentsOriginalFilenamePrivateBuildSpecialBuild$Type$TimeCreate$TimeWrite$TimeAccess$SizeByte$SizeUnit$Att$FullPath$IsExistFileVersions$CompanyName$LegalCopyright$LegalTrademarks$ProductName$InternalName$FileDescription$FileVersion$ProductVersion$Comments$OriginalFilename$PrivateBuild$SpecialBuildError of Message file.(63507)\*Invalid DateTime vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileNameCp.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileNewEx.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileRename.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileRenameEx.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileReproduction.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileShortcut.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFolderIconChange.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFreeMem.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLockProcess.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMakeArchive.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMakeBigFile.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMakeSelfExtract.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMemInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMkDir.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMoveFolder.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOption.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRemoveZoneID.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRmHardware.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenSaver.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSettingInitialization.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellCascadeWindows.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellMinimizeALL.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellSetTime.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellStartMenu.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellTileHorizontally.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellTileVertically.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellUndoMinimizeALL.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellWinHELP.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSimilarCopy.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVersionCheck.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVersionInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWinEx.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAdobeReader.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInternetExplore.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMediaPlayer.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBrws.exe2 vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFin.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameICON.dll2 vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMArc.exe$ vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSeeker.exe$ vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSendToCo.exe> vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSendToEx.exe< vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTxv.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUnreg.exe, vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAsr.exe* vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAsrLoad.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAssociate.exe^ vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArcDllInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArcPack.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArcUnPack.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameChgImgFmt.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameChgTxtFmt.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateErrorReport.exeD vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateLink.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateLocalTumb.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCreateTumbImg.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDivFile.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDriveInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameExport.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileAttribute.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileCpMv.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileDelete.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileExecute.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileExport.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: @IconMode%sFileInfo.tmp%Y/%m/%d %H:%M"%SDRHSACErsOTICompanyNameLegalCopyrightLegalTrademarksProductNameInternalNameFileDescriptionFileVersionProductVersionCommentsOriginalFilenamePrivateBuildSpecialBuild$Type$TimeCreate$TimeWrite$TimeAccess$SizeByte$SizeUnit$Att$FullPath$IsExistFileVersions$CompanyName$LegalCopyright$LegalTrademarks$ProductName$InternalName$FileDescription$FileVersion$ProductVersion$Comments$OriginalFilename$PrivateBuild$SpecialBuild$AlternateDataStreamAlternate Data Stream vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: $OriginalFilename vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: MacroTextFilterSubDirUNCLastCRRelative%Y/%m/%d %H:%M"%SDRHSACErsOTI6.Command/2.DefaultCommand/FileNameCp.htmlCompanyNameLegalCopyrightLegalTrademarksProductNameInternalNameFileDescriptionFileVersionProductVersionCommentsOriginalFilenamePrivateBuildSpecialBuild$Type$TimeCreate$TimeWrite$TimeAccess$SizeByte$SizeUnit$Att$FullPath$IsExistFileVersions$CompanyName$LegalCopyright$LegalTrademarks$ProductName$InternalName$FileDescription$FileVersion$ProductVersion$Comments$OriginalFilename$PrivateBuild$SpecialBuildError of Message file.(63507)\*Invalid DateTime vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileNameCp.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileNewEx.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileRename.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileRenameEx.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileReproduction.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileShortcut.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFolderIconChange.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFreeMem.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLockProcess.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMakeArchive.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMakeBigFile.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMakeSelfExtract.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMemInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMkDir.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMoveFolder.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOption.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRemoveZoneID.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRmHardware.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenSaver.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSettingInitialization.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellCascadeWindows.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellMinimizeALL.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellSetTime.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellStartMenu.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellTileHorizontally.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellTileVertically.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellUndoMinimizeALL.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameShellWinHELP.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSimilarCopy.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVersionCheck.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVersionInfo.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWinEx.exe( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAdobeReader.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInternetExplore.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMediaPlayer.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRealPlayer.dll( vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBrws.exe2 vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeBinary or memory string: OriginalFilename7z.sfx.exe, vs SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeSection loaded: apphelp.dllJump to behavior
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, history.txt.0.drBinary or memory string: RemoveSelectItems = *.txt;*.sln
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, history.txt.0.drBinary or memory string: RemoveSelectItems = !*.txt;*.sln
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, history.txt.0.drBinary or memory string: RemoveSelectItems = ! *.txt;*.sln
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, history.txt.0.drBinary or memory string: 0*.txt;*.slnk0
Source: classification engineClassification label: clean6.winEXE@2/411@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\AsrJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6700:120:WilError_03
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/SerchVisible.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/up.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Stop.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Stop.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Stop.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/TreeVisible.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/up.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/mame4/AddressBar/Back.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/mame4/AddressBar/Forward.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/SerchClose.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/InstallTest/Test32.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/FilterDlg.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/InstallTest/Test64.exe
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/FilterVisible.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/SerchHighlighting.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/mame4/AddressBar
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/Forward.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/SerchNext.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/Go.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/SerchPrev.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/History.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/SerchSelect.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/Refresh.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/FilterVisible.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Forward.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Go.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/History.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Refresh.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Win8/AddressBar/Back.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/InstallTest
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/Back.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/FilterClear.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/FilterClose.bmp
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeString found in binary or memory: Asr/Common/img/Default/AddressBar/FilterDlg.bmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe "C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile written: C:\Users\user\Desktop\Asr\Common\img\Win8\TabImg\img.iniJump to behavior
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeStatic file information: File size 3794785 > 1048576
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\LockProcess.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\x64\Release\AdobeReader.pdb%% GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\Win32\Release\Txv.pdbEE/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\x64\Release\AsrLoad.pdb--)GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellCascadeWindows.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MakeBigFile.pdbAA.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ScreenSaver.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellUndoMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileReproduction.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExecute.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionCheck.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\x64\Release\MediaPlayer.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExport.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DriveInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\Export.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Export.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\Win32\Release\InternetExplore.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\Export.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Export.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileAttribute.pdb@@/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\FileRenameEx\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileHorizontally.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\Win32\Release\Associate.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileHorizontally.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLocalTumb.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellMinimizeALL.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Txv\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Txv.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgImgFmt.pdbCC2GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeSelfExtract.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeSelfExtract.exe0.0.dr, MakeSelfExtract.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SimilarCopy.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExecute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgTxtFmt.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DivFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MkDir.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SettingInitialization.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellSetTime.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileCpMv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\MArc\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.dll0.0.dr, MArc.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DivFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SettingInitialization.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Fin\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Fin.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellSetTime.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileInfo.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\Win32\Release\Test32.pdb..*GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test32.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\Win32\Release\MediaPlayer.pdb))"GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ScreenSaver.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\Release\MArc.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, MArc.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\FileRenameEx\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNameCp.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileReproduction.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DriveInfo.pdb==/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\Win32\Release\AdobeReader.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLink.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MemInfo.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionCheck.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MoveFolder.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\x64\Release\AdobeReader.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRename.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateErrorReport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellUndoMinimizeALL.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe0.0.dr
Source: Binary string: 0*.ncb;*.suo;*.scc;*.aps;*.obj;*.pdb;*.res;*.idb;*.dep;*.pch;*.tlb;*.ilk source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, _Filter.txt.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\x64\Release\Brws.pdb??-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DivFile.pdbAA2GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Seeker\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Seeker.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\LockProcess.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DivFile.pdbBB3GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DivFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcPack.pdbMM/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcPack.exe0.0.dr, ArcPack.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileCpMv.pdbEE.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRenameEx.pdbEE0GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\x64\Release\Unreg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\x64\Release\AsrLoad.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MakeBigFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RmHardware.pdb;;.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionInfo.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\Win32\Release\Seeker.pdbff/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRename.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MemInfo.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\Win32\Release\AsrLoad.pdb..*GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FolderIconChange.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileAttribute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\Win32\Release\MediaPlayer.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\Export.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Export.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileDelete.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\x64\Release\Brws.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileAttribute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNameCp.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellStartMenu.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileVertically.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeArchive.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeArchive.exe.0.dr, MakeArchive.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcPack.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcPack.exe0.0.dr, ArcPack.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MemInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Txv\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileCpMv.pdbFF/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLink.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileDelete.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileVertically.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionCheck.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRename.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MemInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MemInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRenameEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\Win32\Release\Txv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\x64\Release\InternetExplore.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\WinEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, WinEx.exe.0.dr, WinEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\Win32\Release\Fin.pdbPP/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLocalTumb.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellWinHELP.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\Win32\Release\Unreg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcUnPack.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcUnPack.exe.0.dr, ArcUnPack.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SimilarCopy.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\x64\Release\Associate.pdb::-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FreeMem.pdb--)GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SimilarCopy.pdbBB.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileHorizontally.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\x64\Release\Seeker.pdbee.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\x64\Release\Txv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\DriveInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeBigFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MoveFolder.pdbBB.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Asr\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.ja-JP.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\Option.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Option.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\UpdateAsr\Win32\Release\UpdateAsr.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, UpdateAsr.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\x64\Release\Associate.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\x64\Release\Unreg.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MoveFolder.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNewEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RemoveZoneID.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellWinHELP.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\MediaPlayer\x64\Release\MediaPlayer.pdb((!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MediaPlayer.dll0.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\Win32\Release\Test32.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test32.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileHorizontally.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileHorizontally.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExecute.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\AdobeReader\Win32\Release\AdobeReader.pdb&&!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AdobeReader.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\WinEx.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, WinEx.exe.0.dr, WinEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\Win32\Release\Brws.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateTumbImg.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\x64\Release\Fin.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgTxtFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Asr\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.ja-JP.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgImgFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FolderIconChange.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Associate\Win32\Release\Associate.pdb;;.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Associate.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileRenameEx.pdbDD/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ScreenSaver.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeSelfExtract.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeSelfExtract.exe0.0.dr, MakeSelfExtract.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgTxtFmt.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FreeMem.pdb..*GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellSetTime.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeBigFile.pdbBB/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Txv\x64\Release\Txv.pdbDD.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\x64\Release\Seeker.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\FirstSetting\Win32\Release\FirstSetting.pdbw source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FolderIconChange.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Asr\x64\Release\Asr.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RmHardware.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RemoveZoneID.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\Win32\Release\InternetExplore.pdb((!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Seeker\Win32\Release\Seeker.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRenameEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRenameEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileDelete.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLink.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNewEx.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\RealPlayer\Win32\Release\RealPlayer.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RealPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\LockProcess.pdbBB1GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\SendToCompress\Release\SendToCompress.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SendToCompress.exe0.0.dr, SendToCompress.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\InternetExplore\x64\Release\InternetExplore.pdb'' GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, InternetExplore.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileCpMv.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileCpMv.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\SettingInitialization.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Brws\Win32\Release\Brws.pdb@@.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileShortcut.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileReproduction.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellUndoMinimizeALL.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLink.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLink.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\Unreg\Win32\Release\Unreg.pdb==/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Unreg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SimilarCopy.pdbCC/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SimilarCopy.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\BindFile.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, BindFile._xe0.0.dr, BindFile._xe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateTumbImg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellCascadeWindows.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateErrorReport.pdb66 source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ChgTxtFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ChgTxtFmt.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellStartMenu.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\LockProcess.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LockProcess.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExecute.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExecute.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNewEx.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileInfo.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcDllInfo.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcDllInfo.exe.0.dr, ArcDllInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\DriveInfo.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, DriveInfo.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\MkDir.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FreeMem.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\VersionInfo.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Seeker\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.dll.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\x64\Release\Test64.pdb,,(GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test64.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileExport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe0.0.dr
Source: Binary string: C:\Asr879_3b\Asr\RootCmd\Test\x64\Release\Test64.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Test64.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcUnPack.pdbDD/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcUnPack.exe.0.dr, ArcUnPack.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\SendToExtract\Release\SendToExtract.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SendToExtract.exe.0.dr, SendToExtract.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\VersionCheck.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\PreviewPlugin\RealPlayer\Win32\Release\RealPlayer.pdb&&!GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RealPlayer.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileReproduction.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileReproduction.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\Option.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Option.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileShortcut.pdb@@.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellStartMenu.pdb;;.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellCascadeWindows.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellSetTime.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellSetTime.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\Win32\Release\Fin.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgImgFmt.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellWinHELP.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\MArc\Release\MArc.pdbXX/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, MArc.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Asr\Win32\Release\Asr.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\Export.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Export.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileRename.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileRename.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellCascadeWindows.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellCascadeWindows.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ArcDllInfo.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ArcDllInfo.exe.0.dr, ArcDllInfo.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNewEx.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNewEx.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RmHardware.pdb::-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellUndoMinimizeALL.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellUndoMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateErrorReport.pdb77 source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileDelete.pdb>>-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileDelete.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FolderIconChange.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FolderIconChange.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileNameCp.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellMinimizeALL.pdb<<.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellMinimizeALL.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MakeArchive.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeArchive.exe.0.dr, MakeArchive.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellWinHELP.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellWinHELP.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileNameCp.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileNameCp.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\FirstSetting\Win32\Release\FirstSetting.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\AsrLoad\Win32\Release\AsrLoad.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, AsrLoad.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ScreenSaver.pdb;;-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ScreenSaver.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileShortcut.pdb??-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Fin\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Fin.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MkDir.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\ShellTileVertically.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\BindFile.pdb((&GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, BindFile._xe0.0.dr, BindFile._xe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateErrorReport.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateErrorReport.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellStartMenu.pdb::-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellStartMenu.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RemoveZoneID.pdb==-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\FileShortcut.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, FileShortcut.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateLocalTumb.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MkDir.pdb>>.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\RemoveZoneID.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RemoveZoneID.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileExport.pdb<<-GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileExport.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\RmHardware.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, RmHardware.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\CreateTumbImg.pdb==.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateLocalTumb.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateLocalTumb.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\MoveFolder.pdbCC/GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MoveFolder.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FileAttribute.pdb??.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FileAttribute.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\RootCmd\UpdateAsr\Win32\Release\UpdateAsr.pdbs source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, UpdateAsr.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\Viewer\Fin\x64\Release\Fin.pdbOO.GCTL source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Fin.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Brws\Win32\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.dll.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ShellTileVertically.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ShellTileVertically.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\ChgImgFmt.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, ChgImgFmt.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\ResourceDll\src\Brws\x64\Release\resource.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.dll0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\FreeMem.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FreeMem.exe0.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\x64\Release\CreateTumbImg.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, CreateTumbImg.exe.0.dr
Source: Binary string: C:\Asr_Src\Asr\AllCommand\Commands\Win32\Release\SettingInitialization.pdb source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, SettingInitialization.exe.0.dr
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeStatic PE information: section name: .sxdata
Source: UpdateAsr.exe.0.drStatic PE information: section name: .giats
Source: FirstSetting.exe.0.drStatic PE information: section name: .giats
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0041D260 push ecx; mov dword ptr [esp], ecx0_2_0041D261
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_00424810 push eax; ret 0_2_0042482E
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_00424B90 push eax; ret 0_2_00424BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\MArc\MArc.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\MakeSelfExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\RmHardware.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\MArc.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileNameCp.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\Associate.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellStartMenu.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\AdobeReader.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\Brws.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\VersionCheck.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FolderIconChange.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\Seeker.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\Seeker.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\DriveInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ChgImgFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileNewEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellSetTime.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\SimilarCopy.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\ICON.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\Asr.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellUndoMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellTileHorizontally.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\Lang\Asr.ja-JP.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\VersionInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\MakeBigFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\CreateTumbImg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\CreateLink.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\AsrLoad.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileReproduction.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FreeMem.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ScreenSaver.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellWinHELP.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\ICON.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileExecute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\CreateTumbImg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ArcDllInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\MediaPlayer.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellCascadeWindows.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\Option.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileReproduction.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\Asr.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ChgImgFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\VersionCheck.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileNewEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellTileHorizontally.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileExport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileCpMv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileAttribute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\CreateLink.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\RmHardware.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\SendToCompress.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\RealPlayer.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\Brws.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\LockProcess.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileCpMv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Txv\Txv.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\VersionInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ChgTxtFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Brws\Brws.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\DivFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileRename.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\Unreg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Fin\Fin.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\LockProcess.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\Associate.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\MArc.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ArcUnPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\SettingInitialization.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellWinHELP.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ScreenSaver.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellCascadeWindows.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellStartMenu.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\SendToExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\MkDir.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileDelete.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Seeker\Seeker.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellUndoMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\InternetExplore.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\WinEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\InstallTest\Test64.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\MkDir.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\Fin.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileRenameEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\DivFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\MakeArchive.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\RemoveZoneID.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileShortcut.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\AsrLoad.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\SimilarCopy.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\InternetExplore.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\FirstSetting.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileRenameEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\SendToCompress.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileShortcut.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\RemoveZoneID.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\MemInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ArcPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\Lang\Asr.ja-JP.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\MoveFolder.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Brws\Brws.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\Option.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ShellTileVertically.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\MakeBigFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileRename.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\Txv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\Export.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\UpdateAsr.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\Fin.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\MArc\MArc.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\MakeSelfExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\Export.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\SendToExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileDelete.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Seeker\Seeker.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\AdobeReader.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileExecute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Viewer\Txv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\CreateLocalTumb.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Fin\Fin.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FileAttribute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\BindFile._xeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\CreateErrorReport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\MoveFolder.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ArcDllInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ArcPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\MediaPlayer.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\CreateLocalTumb.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\InstallTest\Test32.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\ArcUnPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FreeMem.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\MakeArchive.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\SettingInitialization.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellTileVertically.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileExport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\MemInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\BindFile._xeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\FolderIconChange.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Txv\Txv.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ChgTxtFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\FileNameCp.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\DriveInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\WinEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\ShellSetTime.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\Unreg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x64\command\Default\BindFile._xeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\x86\command\Default\BindFile._xeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\How to uninstall.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\img\Default\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\img\mame4\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\img\Win8\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusAnime\Note\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\Default\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\Mame\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\MameHip\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\Common\StatusImg\SimpleNumbers\Readme.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeFile created: C:\Users\user\Desktop\Asr\??????????readme 1st.txtJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\MArc\MArc.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\MakeSelfExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\RmHardware.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\MArc.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileNameCp.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\Associate.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellStartMenu.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\Brws.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\AdobeReader.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\VersionCheck.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FolderIconChange.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\Seeker.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\DriveInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\Seeker.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ChgImgFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellSetTime.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileNewEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\ICON.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\SimilarCopy.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\Asr.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellUndoMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellTileHorizontally.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\Lang\Asr.ja-JP.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\VersionInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\MakeBigFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\CreateTumbImg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\CreateLink.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileReproduction.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\AsrLoad.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FreeMem.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellWinHELP.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ScreenSaver.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\ICON.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileExecute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\CreateTumbImg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ArcDllInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\MediaPlayer.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellCascadeWindows.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileReproduction.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\Asr.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\Option.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ChgImgFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\VersionCheck.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileNewEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileExport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellTileHorizontally.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileCpMv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileAttribute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\CreateLink.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\RmHardware.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\SendToCompress.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\RealPlayer.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\Brws.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\LockProcess.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileCpMv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Txv\Txv.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\VersionInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Brws\Brws.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ChgTxtFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\DivFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\Unreg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileRename.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Fin\Fin.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\LockProcess.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\Associate.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\MArc.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ArcUnPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\SettingInitialization.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ScreenSaver.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellWinHELP.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellStartMenu.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellCascadeWindows.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\SendToExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\MkDir.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileDelete.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Seeker\Seeker.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellUndoMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\InternetExplore.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\WinEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\InstallTest\Test64.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\MkDir.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileRenameEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\Fin.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\DivFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\MakeArchive.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\RemoveZoneID.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileShortcut.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\AsrLoad.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\SimilarCopy.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\InternetExplore.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\FirstSetting.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileRenameEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\SendToCompress.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileShortcut.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\MemInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\RemoveZoneID.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ArcPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\Lang\Asr.ja-JP.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Brws\Brws.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\MoveFolder.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\Option.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ShellTileVertically.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\MakeBigFile.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileRename.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\Txv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\Export.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\Fin.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\UpdateAsr.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\MArc\MArc.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\MakeSelfExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\Export.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\SendToExtract.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileDelete.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Seeker\Seeker.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\AdobeReader.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Viewer\Txv.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileExecute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\CreateLocalTumb.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Fin\Fin.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\BindFile._xeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FileAttribute.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\CreateErrorReport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\MoveFolder.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ArcPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ArcDllInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\MediaPlayer.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\CreateLocalTumb.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\InstallTest\Test32.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\ArcUnPack.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\MakeArchive.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FreeMem.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\SettingInitialization.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellTileVertically.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileExport.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\MemInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\BindFile._xeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Txv\Txv.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\FolderIconChange.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ChgTxtFmt.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellMinimizeALL.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\FileNameCp.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\DriveInfo.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x64\command\Default\WinEx.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\Unreg.exeJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeDropped PE file which has not been started: C:\Users\user\Desktop\Asr\x86\command\Default\ShellSetTime.exeJump to dropped file
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0040546D FindFirstFileW,0_2_0040546D
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_00406A50 GetSystemInfo,0_2_00406A50
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1685771006.00000000022BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MCvMCIME
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.drBinary or memory string: {0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}{0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}Software\AMA_Soft\ASR\Command\%4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB %4dTB"%4dPB"%4dEB%4.2fKB%sKB%s%s%s%s"Shell_TrayWnd"\\\/\.\\MPR.DLLWNetGetUniversalNameWshell32.dll%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: {0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}{0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}Software\AMA_Soft\ASR\Command\%4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB%4dTB%4dPB%4dEB%4.2fKB%sKB%s%s%s%s ""Shell_TrayWnd""\\\/\.\MPR.DLLWNetGetUniversalNameWshell32.dll\%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Seeker.exe0.0.drBinary or memory string: {0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}{0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}Software\AMA_Soft\ASR\Command\%4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB%4dTB %4dPB"%4dEB"%4.2fKB%sKB%s%s%s%sShell_TrayWnd""\\\/\.\MPR.DLLWNetGetUniversalNameWshell32.dll\\%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe.0.drBinary or memory string: VERSION.dll%4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4dKB%4dMB%4dGB%4dTB%4dPB%4dEB%sKB%s%s "Shell_TrayWnd\\/.MPR.DLLWNetGetUniversalNameWshell32.dll%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: %4.0f{0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}{0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}Software\AMA_Soft\ASR\Command\%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB%4dTB%4dPB%4dEB%4.2fKB%sKB%s%s%s%s ""Shell_TrayWnd""\\\/\.\MPR.DLLWNetGetUniversalNameWshell32.dll\%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: %sShell_TrayWndNoDrives%c:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer%c:\\%d/%s%s %s%sTimeout!
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe0.0.drBinary or memory string: %sShell_TrayWndNoDrives%d/%s%sSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer%c:\%c:\%s %swbTimeout!
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.drBinary or memory string: VERSION.dll%4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB%4dTB%4dPB%4dEB%sKB%s%s "Shell_TrayWnd\\/.MPR.DLLWNetGetUniversalNameWshell32.dll%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681216109.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1681364289.0000000002B70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: %sShell_TrayWndNoDrivesSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer%c:\%c:\\%d/%s%s %s%s\Timeout!
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Txv.exe0.0.drBinary or memory string: {0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}{0F04AF43-7B85-46A5-A0A7-6D323A84AD7C}Software\AMA_Soft\ASR\Command\%4.0f%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4dKB%4dMB%4dGB%4dTB%4dPB%4dEB%4.2fKB%sKB%s%s%s%sShell_TrayWndMPR.DLL%s
Source: Asr.exe0.0.drBinary or memory string: !Error of PostMessageBarBusy!System error of counter = %dProgram ManagerProgman%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %lld %lldWindowStateSet
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: %s\Shell_TrayWndNoDrivesSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer%c:\%c:\\%d/%s\%s %s%sTimeout!
Source: Asr.exe.0.drBinary or memory string: !Error of PostMessageBarBusy!System error of counter = %dProgram ManagerProgman%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %lld %lldWindowStateSetx
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.drBinary or memory string: %s\Shell_TrayWnd\NoDrives%d/%s%sSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer%c:\%c:\%s %s\\Timeout!
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.drBinary or memory string: %4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB%4dTB %4dPB"%4dEB"%4.2fKB%sKB%s%s%s%sShell_TrayWnd""\\\/\.\MPR.DLLWNetGetUniversalNameWshell32.dll\\%s
Source: SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, Brws.exe.0.dr, MArc.exe.0.drBinary or memory string: %4.0f%4.2fKB%4.2fMB%4.2fGB%4.2fTB%4.2fPB%4.2fEB%4d%4dKB%4dMB%4dGB%4dTB%4dPB%4dEB%4.2fKB%sKB%s%s%s%s ""Shell_TrayWnd""\\\/\.\MPR.DLLWNetGetUniversalNameWshell32.dll\%s
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exeCode function: 0_2_0041D480 GetVersionExW,0_2_0041D480

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		2
Process Injection		11
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		2
Process Injection		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS3
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
Obfuscated Files or Information		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe7%ReversingLabs
SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe3%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Desktop\Asr\FirstSetting.exe4%ReversingLabs
C:\Users\user\Desktop\Asr\FirstSetting.exe1%VirustotalBrowse
C:\Users\user\Desktop\Asr\InstallTest\Test32.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\InstallTest\Test32.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\InstallTest\Test64.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\InstallTest\Test64.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\UpdateAsr.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\UpdateAsr.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\Asr.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\Asr.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\AsrLoad.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\AsrLoad.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\Associate.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\Associate.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\Lang\Asr.ja-JP.dll0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\Lang\Asr.ja-JP.dll0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\Unreg.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\Unreg.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dll0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dll0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\ArcDllInfo.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\ArcDllInfo.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\ArcPack.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\ArcPack.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\ArcUnPack.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\ArcUnPack.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\BindFile._xe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\BindFile._xe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\ChgImgFmt.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\ChgImgFmt.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\ChgTxtFmt.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\ChgTxtFmt.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\CreateLink.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\CreateLink.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\CreateLocalTumb.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\CreateLocalTumb.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\CreateTumbImg.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\CreateTumbImg.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\DivFile.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\DivFile.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\DriveInfo.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\DriveInfo.exe0%VirustotalBrowse
C:\Users\user\Desktop\Asr\x64\command\Default\Export.exe0%ReversingLabs
C:\Users\user\Desktop\Asr\x64\command\Default\Export.exe0%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://hp.vector.co.jp/authors/VA020799/asr_verinfo.cgiasr0%Avira URL Cloudsafe
http://ftp://.exe0%Avira URL Cloudsafe
https://http://ftp://.exe.lnk.ico.cur.ani.scr.EXE.LNK.ICO.CUR.ANI.SCR%s(%d)%s?:0%Avira URL Cloudsafe
http://hp.vector.co.jp/authors/VA033418/)0%Avira URL Cloudsafe
http://search.msn.co.jp/?FORM=HPREFavoritesSoftware0%Avira URL Cloudsafe
http://search.msn.co.jp/?FORM=HPRECChildFrameSoftware0%Avira URL Cloudsafe
https://http://ftp://.exe.lnk.ico.cur.ani.scr.EXE.LNK.ICO.CUR.ANI.SCR%s%s%s(%d)%s0%Avira URL Cloudsafe
http://hp.vector.co.jp/authors/VA033418/)1%VirustotalBrowse
http://search.msn.co.jp/?FORM=HPRECChildFrameSoftware0%VirustotalBrowse
http://hp.vector.co.jp/authors/VA020799/asr_verinfo.cgiasr1%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.all.undo.jp/asr/AppendixRuntime.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
    		high
    http://ftp://.exeSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr, Seeker.exe0.0.dr, Brws.exe0.0.drfalse
    • Avira URL Cloud: safe
    		low
    http://hp.vector.co.jp/authors/VA020799/asr_verinfo.cgiasrSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionCheck.exe0.0.dr, VersionCheck.exe.0.drfalse
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown
    https://all.undo.jp/asr/man5/notepad%s%s%sSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, Txv.exe.0.dr, Brws.exe.0.dr, Txv.exe0.0.dr, MArc.exe.0.dr, MkDir.exe.0.dr, Seeker.exe.0.drfalse
      		high
      http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/05.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drfalse
        		high
        http://www.all.undo.jp/SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
          		high
          http://www.all.undo.jp/asr/SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
            		high
            https://all.undo.jp/asr/AppendixRuntime.htmlopenhttps://all.undo.jp/asr/Appendix.htmlSuccessfulSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, UpdateAsr.exe.0.drfalse
              		high
              http://hp.vector.co.jp/authors/VA033418/)SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, history.txt.0.drfalse
              • 1%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown
              http://www.all.undo.jp/asr/1st/document/02_05.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
                		high
                http://www.all.undo.jp/asr/man5/2.install/05.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, How to update.txt.0.drfalse
                  		high
                  https://all.undo.jp/asr/man5/Kernel32.dllSetDefaultDllDirectoriesMakeBigFileSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MakeBigFile.exe.0.dr, MakeBigFile.exe0.0.drfalse
                    		high
                    http://www.all.undo.jp/asr/Appendix.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
                      		high
                      http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/07.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drfalse
                        		high
                        http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/01.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drfalse
                          		high
                          http://www.all.undo.jp/asr/man5/SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
                            		high
                            https://http://ftp://.exe.lnk.ico.cur.ani.scr.EXE.LNK.ICO.CUR.ANI.SCR%s(%d)%s?:SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.dr, Asr.exe.0.drfalse
                            • Avira URL Cloud: safe
                            		low
                            http://www.all.undo.jp/asr/man5/2.install/01.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
                              		high
                              http://www.all.undo.jp/asr/man5/9.Infomation/1.Usage/01.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, ??????????readme 1st.txt.0.drfalse
                                		high
                                http://www.all.undo.jp/cgi/report/report.cgiSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, report.ja-JP.0.dr, report.ja-JP0.0.drfalse
                                  		high
                                  https://all.undo.jp/asr/man5/9.Infomation/1.Usage/01.htmlopenSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.drfalse
                                    		high
                                    http://search.msn.co.jp/?FORM=HPREFavoritesSoftwareSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe.0.drfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://all.undo.jp/InvalidSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe.0.drfalse
                                      		high
                                      https://all.undo.jp/asr/AppendixRuntime.htmlhttps://all.undo.jp/asr/Appendix.htmlSuccessfulSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, FirstSetting.exe.0.drfalse
                                        		high
                                        https://http://ftp://.exe.lnk.ico.cur.ani.scr.EXE.LNK.ICO.CUR.ANI.SCR%s%s%s(%d)%sSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MArc.exe0.0.dr, Txv.exe.0.dr, Brws.exe.0.dr, Txv.exe0.0.dr, MArc.exe.0.dr, MkDir.exe.0.dr, Seeker.exe.0.drfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        https://all.undo.jp/SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, VersionInfo.exe0.0.dr, VersionCheck.exe0.0.dr, VersionCheck.exe.0.drfalse
                                          		high
                                          http://www.all.undo.jp/asr/man5/2.install/04.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, How to uninstall.txt.0.drfalse
                                            		high
                                            http://www.all.undo.jp/asr/man5/8.Custmize/1.UserFolder/2.ScriptCommand/02.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, NewCommand.template.0.drfalse
                                              		high
                                              https://all.undo.jp/asr/man5/notepadwbSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Asr.exe0.0.dr, Asr.exe.0.drfalse
                                                		high
                                                http://www.all.undo.jp/asr/1st/document/02_04.htmlSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1658500952.0000000002349000.00000004.00001000.00020000.00000000.sdmp, How to update.txt.0.drfalse
                                                  		high
                                                  http://search.msn.co.jp/?FORM=HPRECChildFrameSoftwareSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Brws.exe0.0.drfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://all.undo.jp/asr/man5/%s%s%sSecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Option.exe0.0.dr, FileNameCp.exe0.0.dr, ArcPack.exe0.0.dr, FileAttribute.exe0.0.dr, Export.exe.0.dr, ArcPack.exe.0.dr, FileCpMv.exe0.0.dr, Export.exe0.0.dr, MakeSelfExtract.exe0.0.dr, CreateLocalTumb.exe0.0.dr, ArcDllInfo.exe.0.dr, FileInfo.exe.0.dr, WinEx.exe.0.dr, FileRename.exe0.0.dr, FileDelete.exe0.0.dr, FileNewEx.exe0.0.dr, FileNewEx.exe.0.dr, SettingInitialization.exe.0.dr, CreateLocalTumb.exe.0.dr, MoveFolder.exe0.0.drfalse
                                                    		high
                                                    https://all.undo.jp/asr/man5/SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe, 00000000.00000003.1682310556.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, MkDir.exe0.0.dr, Seeker.exe0.0.dr, Brws.exe0.0.dr, FileRenameEx.exe0.0.dr, FileRenameEx.exe.0.drfalse
                                                      		high

                                                      World Map of Contacted IPs

                                                      ⊘No contacted IP infos

                                                      General Information

                                                      Joe Sandbox version:40.0.0 Tourmaline
                                                      Analysis ID:1417366
                                                      Start date and time:2024-03-29 05:20:09 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 4m 23s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Number of analysed new started processes analysed:2
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Sample name:SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      Detection:CLEAN
                                                      Classification:clean6.winEXE@2/411@0/0
                                                      EGA Information:
                                                      • Successful, ratio: 100%
                                                      HCA Information:
                                                      • Successful, ratio: 100%
                                                      • Number of executed functions: 78
                                                      • Number of non-executed functions: 47
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe
                                                      • Stop behavior analysis, all processes terminated

                                                      Warnings

                                                      • Not all processes where analyzed, report is missing behavior information

                                                      Simulations

                                                      Behavior and APIs

                                                      ⊘No simulations

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      ⊘No context

                                                      Domains

                                                      ⊘No context

                                                      ASNs

                                                      ⊘No context

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      C:\Users\user\Desktop\Asr\??????????readme 1st.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):7922
                                                      Entropy (8bit):5.466373158309693
                                                      Encrypted:false
                                                      SSDEEP:96:a3GOVoDr4BQx2dDgWMIVZYuFp19V4aVMs9FpvlqtuHey5t4OSCDoEV7g:fOG8BQxUkWPt97Dq0H17hRUEVk
                                                      MD5:F842FECED90CD76BF83E02CB2D87119D
                                                      SHA1:6510570AABAAEF1562BB888C65533D9E6201B4A6
                                                      SHA-256:40467C31445D3C40DD31BB4EFFCE63F9F869A79AE32FC827AA12D58C5663D030
                                                      SHA-512:031EBD50E60BDC0295B9D84CDED544D9987FE2F056E461C0B340FCDF5105EDDDE3D75AF29A4A8613D2794B800A3E78974548CDD68B43A0D5DB852D4E16E2A998
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:..A.s./.R. .!|.f.0.0.0.0.0.0.........0.f.e;..^n0.U0.0M..^k0._..j0.0.0.0.0.Y.....S.0..naW0_0P}.g.0s.0}o0.0.0.0.0.0.0.0.0k0....W0f0J0.0~0Y0.0.....0]0a0.0.0.SgqD0_0`0M0~0Y0.0F0.0.0W0O0J0X.D0W0~0Y0.0.........0.0.0.0.0.0.0.0.0.0.0..h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./......0A.s./.R...#.n0.0.0.0.0.0.0..h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./......0A.s./.R..0.0.0.0.0.0.0.0..h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./..........0; .0.0.0.0.0.0.0o0.0.Nn0lQ...0.0.0.0.0.0h0qQ..n0.0n0h0j0.0~0Y0.0.....0; #.a}HQo0.0.0.0.0.0.0.0n0.0.0.0.0.0.0.0.0T0)R(uO0`0U0D0.0.....0; .g.en0.`1XJ0.0s0.0s.W0D0...fo0.0hQf0W.e.b..0.0.0g0n0...f.0*QHQh0W0f0J0.0~0Y0.0.....................0.i...0.........0.g.e.`1X.0J0.0s0s.0}j0....o0S0a0.0.0.SgqO0`0U0D0.0....h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./..........0.0.0.0.0.N...0w..ph0W0f0P.C.n0.d\OhQ,..0.R.s.vk0L.F0.v.vn0.0.0.0.0.0.0.0.0.0..n0.0.0.0.0.0g0Y0.0.........0MR\Oo0lQ..W0f0ASpet^L0L}N.W0.0MR.ch0W0f0D0.0.t

                                                      C:\Users\user\Desktop\Asr\Common\AllCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF, CR line terminators
                                                      Category:dropped
                                                      Size (bytes):299792
                                                      Entropy (8bit):4.476462355662853
                                                      Encrypted:false
                                                      SSDEEP:3072:gqlwn9hWUnP/FVOIIDsFtoDu5EPalQwlWbsxCn4dT+dYfqp0bWmrgVS3cheTZkvJ:gqlwn9hWUnP/FVYsE
                                                      MD5:E159CB990E45C27DAA4CD55B57B1C16A
                                                      SHA1:AB66FAA30972F13393CC7C32658D45B963B4283E
                                                      SHA-256:AC304961E27D35F59315F083F421812EF9232C94217252EE8CB6D1690A16E52D
                                                      SHA-512:F4997F2C376CA3C8E11701FF711CB8A95F6F254AD8D8E0FFF9BE8EAD870FAE084BDA26332656B18F48797948D50412C733753075BA74DD2FA4E9F5778CE6366C
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:..3.5.2.1.4....0.0.0.0\O.b(.N.)....0.0.0.0.0.0.0.0.c.[W0f0.e..\O.bW0~0Y0....4.2.0.1.8....0.0.0.0.N.b\O.b(.B.)....0.0.0.0.N.b\O.b....4.2.0.1.7....0.0.0.0.0\O.b(.K.)....b5_.0.0.0.0\O.b....4.2.0.1.9....0.0.0.0.0.0.0n0\O.b(.S.)....b5_.0.0.0.0.0.0.0\O.b....4.2.0.3.8....0.0.0n0\O.b(.L.)....T.z.0.0.0n0\O.b....4.2.0.1.4....b5_.0.0.0(.C.)....b5_.0.0.0....4.2.0.1.5....b5_.y.R(.M.)....b5_.y.R....4.2.0.2.6....Nn0.0.0x0.b5_.0.0.0(.T.)....Nn0.0.0x0.b5_.0.0.0....4.2.0.2.7....Nn0.0.0x0.b5_.y.R(.Y.)....Nn0.0.0x0.b5_.y.R....4.2.0.2.9...<Of0D0.0.TMRn0.0.0.0.0.0k0.0.0.0(.S.)...<Of0D0.0.TMRn0.0.0.0.0.0k0.R^.W0f0.0.0.0....4.2.0.3.0...<Of0D0.0.TMRn0.0.0.0.0.0k0.y.R(.R.)...<Of0D0.0.TMRn0.0.0.0.0.0k0.R^.W0f0.y.R....4.2.0.1.6.......n0\O.b(.D.).......n0\O.b....3.5.2.0.9....W.0...0.Wn0.TMRn0.Y.f(.M.)....W.0...0.}.g0.TMR.0.Y.fW0~0Y0....4.2.0.1.2....b5_.TMRn0.Y.f(.R.)....b5_.0.0.0.0....4.2.0.2.1....N.bg0.TMRn0.Y.f(.E.)....N.b.0.0.0.0....4.2.0.3.5....Q.[.0$R%RW0f0.b5_P[.Y.f(.W.)....Q.[.0$R%RW0f0.b5_P[.Y.f....3.5.2.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\????????????????????????(Don't edit this folder).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):590
                                                      Entropy (8bit):4.294567995113771
                                                      Encrypted:false
                                                      SSDEEP:12:Q27TgdhCic1TVnRRGSF3gOGlRN7GrkBpjLwouHx3u41e:Q23gDCicNNRRGQ3gOoNaGzuHe
                                                      MD5:273881B5F7054EDD22CFEA4990B9EBD9
                                                      SHA1:DFE6FC1B08E3CECA36DEEB6E1EB157A3B985464E
                                                      SHA-256:5F9B5CF39C3DD4B1C8513706355E93BC172C63813307E37AE31708C1911688A9
                                                      SHA-512:053D3A0803773D7B79050E69AE942D8F9BE8FF05E97A225DEB34869F43EC497FA5E639CACFAD96EA011521A64943F57D2555C0C5DF474949DD9CBB75E2581B2F
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:..S0n0.0.0.0.0.0.N.Nn0.0.0.0.0o0.}.W0j0D0g0O0`0U0D0.0....S0a0.0o0.R.g$P.0.0.0.0.0.0.0.0n0....(un0.0.0.0.0.0.0g0Y0.0.....0.0.0.0.0.0Y0.0k0o0.0.0.0.0.0.0.0.0.0.0.0n0.e.0.SgqO0`0U0D0.0........P.l.e.a.s.e. .d.o. .n.o.t. .e.d.i.t. .t.h.e. .f.i.l.e.s. .i.n. .t.h.e. .f.o.l.d.e.r. .b.e.l.o.w. .t.h.i.s.......H.e.r.e. .i.s. .a. .t.e.m.p.l.a.t.e. .a.n.d. .i.n.i.t.i.a.l. .v.a.l.u.e.,. .f.o.r. .r.e.p.l.i.c.a.t.i.o.n. .o.f. .u.p.d.a.t.e.s.......I.f. .y.o.u. .w.a.n.t. .t.o. .c.u.s.t.o.m.i.z.e.,. .p.l.e.a.s.e. .r.e.f.e.r. .t.o. .t.h.e. .p.e.r.s.o.n. .o.f. .t.h.e. .u.s.e.r. .d.i.r.e.c.t.o.r.y.......

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Bar\Default.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):894
                                                      Entropy (8bit):6.01073002150077
                                                      Encrypted:false
                                                      SSDEEP:24:Ir999QHW/IjK4azqLrIJvK666VAc9xy+fOn:Ir999eoIjbazqLx666VH/XO
                                                      MD5:D06F154FD28494B64D3B0C56243E38D4
                                                      SHA1:880B6AB80010948EE48A3EED40946A962A925E7A
                                                      SHA-256:8E495660ACD6D2C9FBF4B3580F175D195C47DA2FCF66A76A8D369089D849210C
                                                      SHA-512:94CF10F903AAD28E231FE5190E9C06240F20D3255CE293370FF34B5A2581D9C989C2B5636D49F700CBE2159B2A56BC5DB6AD3EF255B125C1FA960324B0061D4C
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:..............h.......(....... ........................................................................................rpQ>`B+]<'[;&[;&[;&[;&[;&[;&`@+lUD............................................iX..x......pT@...c..........i......c|.....{bR.wn....../l.....j.........P.>......f1s.....x`Om[R!..f..3p....s............f...........V|.hVL$..f..8u..................................W}.fSI'..f..=y......ul.....^p......f.......X~.fSI)..f..A~......Kx.....`a..............Y..gTJ,..n..B...c.w.w.w.w.w.w.{.....Uk_n]S...z..4...j..^..^..^..^..^..^..k...E..Esx.3cp.vn0.......,..,..,..,..,..,..'..#.................2...................................{..vo......3....................$..!............}.............3..............)..................................3..2..0...................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\ExternalDefCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):12864
                                                      Entropy (8bit):5.247042551007864
                                                      Encrypted:false
                                                      SSDEEP:192:5YalsBQpp0kBfkjfqJsp8M4LHg4knYSOjZOtNfpGwS4Mh7QIYMvJJRD:lfake/peHWnY5Q/RGxiwR
                                                      MD5:AE6E5244378A984C62CB703130475D0C
                                                      SHA1:036BA43C239486CBF80F91FE0E40F2ECF845EC8C
                                                      SHA-256:D9A50F49B780CC1207CF4CCAD7A550885A3672A0BD9A30B8FE0E736E2DFE75B7
                                                      SHA-512:F361A142D3348A5640B0997499654470F47DE27FC193838060BA15803AF9B4ACC2E1C472625F4D1BFF70557FF53B426ACFE88D3B742AFF67E513C7555AB451CB
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:.././..j.ng0.T.hU0.0.0.0.0.0.0(..0.0.0.0.0.0.0.0Bfk07_6R.N.fM0U0.0.0S0h0L0B0.0n0g0T0.l.aO0`0U0D0)....././..g.R.0.0.0.0I.D.n0.{.V:.4.2.0.0.1.^.4.2.5.0.0....././..0.0E.O.F..0.NM.o0...0..~0j0D0n0g0.0+g>\k0...f.0....W0f0D0~0Y0........4.2.0.0.1.....-.-.-...%.C.M.D._.D.i.r.%.E.x.p.o.r.t...e.x.e...-..[n0.0.0.0.0.0.0....4.2.0.0.2.....-.-.-...%.C.M.D._.D.i.r.%.D.r.i.v.e.I.n.f.o...e.x.e. .?.N.o.w.D.i.r.?....0.0.0.0.`1X....4.2.0.0.3...M...X.F.D...%.C.M.D._.D.i.r.%.F.i.l.e.N.a.m.e.C.p...e.x.e....0.0.0.0.Tn0.0.0.0....4.2.0.0.4...M...N.F.D...%.C.M.D._.D.i.r.%.F.i.l.e.A.t.t.r.i.b.u.t.e...e.x.e...^\'`.Y.f....4.2.0.0.5...M...N.F.D...%.C.M.D._.D.i.r.%.F.i.l.e.I.n.f.o...e.x.e....0.0.0.0.`1X....4.2.0.0.6...M...N.F.D...%.C.M.D._.D.i.r.%.F.i.l.e.E.x.p.o.r.t...e.x.e....0.0.0.0.N...Q.R....4.2.0.0.7...M...N.F.D...%.C.M.D._.D.i.r.%.A.r.c.P.a.c.k...e.x.e...'W.~....4.2.0.0.8...M...N.F.-...%.C.M.D._.D.i.r.%.A.r.c.U.n.P.a.c.k...e.x.e.....Q....4.2.0.0.9...M...N.F.-...%.C.M.D._.D.i.r.%.M.a.k.e.S.e.l.f.E.x.t.r.a.c.t.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\ExternalUserCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF, CR, LF line terminators
                                                      Category:dropped
                                                      Size (bytes):228
                                                      Entropy (8bit):4.828319566306335
                                                      Encrypted:false
                                                      SSDEEP:3:Q1zzVao2cXajgb0gP5MX48BVtVLB6rhlAl4HFldFVo4VWaOVn2CU9hNIAljwl:Q1vihghx83YrzAl4HyraSAul
                                                      MD5:A2301BFBDE65315A659EF4629E1F6E42
                                                      SHA1:F6D0F278B5F9DCF4B244A4FE12C222F4A8664EFC
                                                      SHA-256:B020BD57C911F772143747E28DFDC79CD903C8356F5816D025CFFD74F5998486
                                                      SHA-512:AA37CF3CC1C9DE75D49A8E9DF1E37DAE0C67B0077029542E018826DCEED3E26BAD6325E63F488D0E2584183E5D953A8FB099E8D2023C45DAEB3B138F66B238FC
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:.././..0.0.0.0.[...0.0.0.0...0.0.0.0k0.0.0.b5_.0.0.0.....././..g.R.0.0.0.0I.D.n0.{.V:.4.2.5.0.1.^.4.3.0.0.0..././..0.0.0.0.N.io0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.h0.TX0g0Y0n0g0.0]0a0.0.0.SgqO0`0U0D0.0........E.O.F.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\UsrMenu1.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1518
                                                      Entropy (8bit):4.21621594028832
                                                      Encrypted:false
                                                      SSDEEP:24:QsAehjby/fy/rZ23Ms2cRwLZc1BwcnWx/UxC4wxxCRxC0Wku+GM2xSohW2xSosW1:V/Q8uZ+unWxcx8xxKx0YGM2xSMW2xSmp
                                                      MD5:E90DC0342208E1A20D7DA639E931BBB9
                                                      SHA1:D1CFEF7DDCF596B35A6EBBB85A7A6F7901B7A9D8
                                                      SHA-256:BA309EEE333C1E54E4944A8F4E4015640AFDD42379AC5841B1267AC4058232B8
                                                      SHA-512:3F6DC13EDDED899CB548F3879B73675C21C92FC198B65DBD6E4EBAE410C9C118D7CA9E04028C68359B6FC6ECA4DED58ECCA866E7B2A2C2A69BD4A8659752875D
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0.[...0.0.0.0n0.0.0.0.0g0Y0........S.C.R.I.P.T....0.0.0.0n0w..R..%.S.c.r.i.p.t._.d.i.r.%.E.d.i.t.o.r...t.x.t.....S.C.R.I.P.T....0.0.0.0.0n0w..R..%.S.c.r.i.p.t._.d.i.r.%.V.i.e.w.e.r...t.x.t.........D.R.O.P.O.P.E.N....0.0.0.0.0.0.0.0.0.0.0(.C.:.\.T.e.s.t.x0.0.0.0)...C.:.\.T.e.s.t.....D.R.O.P.O.P.E.N....0.0.0.0.0.0.0.0.0.0.0(.T.e.s.t...b.a.t.w..R)...C.:.\.t.e.s.t.\.t.e.s.t...b.a.t.........O.P.E.N....0.03^.0w..R..n.o.t.e.p.a.d...e.x.e.....O.P.E.N...W.i.n.d.o.w.s..0.0.0.0.0.0.0.0w..R..c.:.\.w.i.n.d.o.w.s.........N.E.W...W.i.n.d.o.w.s..0.0.0.0.0.eW0O0..O0..c.:.\.w.i.n.d.o.w.s.....J.U.M.P...W.i.n.d.o.w.s..0.0.0.0x0.0.0.0.0..c.:.\.w.i.n.d.o.w.s.........S.E.P.A.R.A.T.O.R.........M.E.N.U.I.T.E.M....0.0.0j0W0..3.3.2.0.4.....M.E.N.U.I.T.E.M...W.i.n.d.o.w.s.2.0.0.0...3.3.2.0.5.....M.E.N.U.I.T.E.M...W.i.n.d.o.w.s.X.P...3.3.2.0.7.....M.E.N.U.I.T.E.M...W.i.n.d.o.w.s.7...3.3.2.1.9.....S.E.P.A.R.A.T.O.R.....P.O.P.U.P...V.i.s.u.a.l.S.t.u.d.i.o.(.&.N.).......M.E.N.U.I.T.E.M...V.i.s.u.a.l.S.t.u.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\UsrMenu2.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):366
                                                      Entropy (8bit):4.08033926183105
                                                      Encrypted:false
                                                      SSDEEP:6:QsEioS4L2mLlJ2ka2mLlUWCvm2mLllGYJ2mLlQirklj2mLlQAYCWUGm2mLlQK8/k:QsZoSmHLl4bHLlUL+HLl1JHLlVrQHLl1
                                                      MD5:5E43C1669C23CB2F0D800F53C5D56199
                                                      SHA1:2CFC4BAD83E08AFD267F9759ED85A1960885E21C
                                                      SHA-256:13345E49BCE454C29A08AFC23C69E7A642CD8F7329822F87B5997489D0094466
                                                      SHA-512:5DD6489B2E35FBB41EC4B925801E7112EC87C641C6E7E2D8E4B91775EC033AC262AB589C80EF7B83ADB396B172B2298E06EDCBDCD24DF94FB4E79982A3E3D2E9
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0.[...0.0.0.0n0.0.0.0.0g0Y0........M.E.N.U.I.T.E.M....0.0.0.0(..\)...3.2.9.1.1.....M.E.N.U.I.T.E.M....0.0.0.0(.-N)...3.2.9.1.2.....M.E.N.U.I.T.E.M....0.0.0.0(.'Y)...3.2.9.1.3.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(..\)...3.2.9.2.1.....M.E.N.U.I.T.E.M....0.0.0.0.0(.-N)...3.2.9.2.2.....M.E.N.U.I.T.E.M....0.0.0.0.0(.'Y)...3.2.9.2.3.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\UsrMenu3.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):340
                                                      Entropy (8bit):3.9600849279274026
                                                      Encrypted:false
                                                      SSDEEP:6:QsEioS4L2mLlO2mLlW+79m2mLlvi+2mLlWGwx2mLl+sBx2mLlW8rx2mLlicv:QsZoSmHLlOHLlW+wHLlvzHLlWG+HLlLh
                                                      MD5:95C24BC497B26A9CFAD9092D1C838D54
                                                      SHA1:A2EC217E29AC0BAED21EAC92CFD00B985991FB7F
                                                      SHA-256:B9C6B789436B335AC01FE6CD590461A34B7DEE65FD5C8C2FDA04CF75237ADF41
                                                      SHA-512:4C79ED1447E83FB09525137E86F369DFA0C1DA6AFB00514EE097A978638B272E56847E8C6694EB23E40B39D7F01490A51E607662CA922BD6B9265EB1E34DE9FF
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0.[...0.0.0.0n0.0.0.0.0g0Y0........M.E.N.U.I.T.E.M....0.0.0.0..3.2.9.0.0.....M.E.N.U.I.T.E.M...s.0}.N....3.2.9.0.2.....M.E.N.U.I.T.E.M....N....3.2.9.0.1.....M.E.N.U.I.T.E.M...s.0}..3.2.9.0.4.....M.E.N.U.I.T.E.M...&Ny0f0h.:y..3.2.9.0.5.....M.E.N.U.I.T.E.M....0.0.0.0.0..3.2.9.0.6.....M.E.N.U.I.T.E.M....0.0.0.0n0.0..3.2.9.0.7.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_Filter.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1460
                                                      Entropy (8bit):4.789060423300886
                                                      Encrypted:false
                                                      SSDEEP:24:QlsnuGCVHx1FsBGDMgqUuyo/cz9SfAO48tUZINZv5C+v4KRrAs1L:VLCNx1FIAqUlgY9sdtU+4Q
                                                      MD5:4FF9FB3F657D9A77FF996CA579B50A11
                                                      SHA1:AB204E0FC8315F2025D34FFB79C1868201A7A915
                                                      SHA-256:DB831E614ECEEBFD4CE3D5BB15A43617B9D194E40EA7F100B4A5408F289874F6
                                                      SHA-512:18846251A4F1BC352D846ED0F8C2A41F980451A3851751D48371A9924028A05BCDA4E2779247B41D3390A6AA33033EA9D2098CB4C493CAA0BCA32C885D62F71D
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0n0.[.......0S0n0.0.0.0.0o0.0.0.0.0.0.0L0yr.kg0Y0.0.........0.f._n0...f.0.....0.f._o0.0.0...v.T<.T.A.B.>..b5_P[.0h0j0.0~0Y0.0.....0<.T.A.B.>.L0!qD0.0F0j0.0.0.0.02.d0.N.NB0.0.0.0.0.0zzL.o0hQf0.0.0.0.0h0.0j0U0.0~0Y0.0.....0yr.kj0.0.0.0.0o0.N..n02..z^.g0Y0.0....<.n.o.n.e.>..0.0.0.0.0.0.0.0.0.0.0n0.d.n0yr.k.d\O....<.e.d.i.t.>..0.0.0.}.Y0.0_0.0k0.0.03^g0S0n0.0.0.0.0.0..M0~0Y0........j0W0/..d...<.n.o.n.e.>.....;u.P.0.0.0.0..*...b.m.p.;.*...g.i.f.;.*...p.n.g.;.*...j.p.g......R;u.0.0.0.0..*...m.p.g.;.*...f.l.v.;.*...w.m.v.;.*...a.v.i.;.*...s.w.f.;.*...m.o.v.;.*...r.m......0.0.0.0.0.0..*...d.o.c.;.*...x.l.s.;.*...p.p.t.;.*...d.o.c.x.;.*...x.l.s.x.;.*...p.p.t.x.;.*...t.x.t.;.*...p.d.f......0.0.0.0.0.0.0.0..*...c.p.p.;.*...c.;.*...h.;.*...v.b.;.*...c.s.;.*...h.;.*...p.l.;.*...p.h.p.....'W.~.0.0.0.0..*...l.z.h.;.*...z.i.p.;.*...c.a.b.;.*...r.a.r.;.*...t.a.r.;.*...7.z......[L..0.0.0.0..*...e.x.e.;.*...c.o.m.;.*...b.a.t.;.*...s.c.r.;.*...p.i.f......0.0.0.0.0.0..*...l.o.g.;.*...t.x.t...

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_FolderBarAction.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):666
                                                      Entropy (8bit):4.209364664780469
                                                      Encrypted:false
                                                      SSDEEP:12:QinHLlBsJHLlWMCHLli3CZzxl0HLlYJJHLlmu0cvJHLlNF+HLlNrJHLly5ctW:QExBsJxWMCxUC9j0xYJJxmJcvJxNF+x6
                                                      MD5:DD6838765128194AC65E09036DE594A5
                                                      SHA1:815136F1059105D2F721BB9F4BDB232B4862EA6F
                                                      SHA-256:96CD31119986714F32B7A2957B4694432965E6C4B9E2C12200B08AE98CE54F22
                                                      SHA-512:A92718942CECB2636D714086E78EB1A6F0D06F42285F1FB6B1295667D7C164AB4F0FD18A312DB0B96ACD77201AF5DC8601ADCE6E571CD4BC7CA76721575221CD
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0.0.0.0n0.R\O.0.0.0.0n0.0.0.0.0g0Y0.0........M.E.N.U.I.T.E.M....g.en0.rKak0Y0.0(.&.T.).\.t.F.5...4.7.2.0.2.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0(.&.C.).\.t.C.t.r.l.+.C...4.7.2.5.0.....M.E.N.U.I.T.E.M....R.0.S.0(.&.X.).\.t.C.t.r.l.+.X...4.7.2.5.1.....M.E.N.U.I.T.E.M......0.NQ0(.&.P.).\.t.C.t.r.l.+.V...4.7.2.5.2.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...CQk0;bY0(.&.P.).\.t.C.t.r.l.+.Z...4.7.2.5.3.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....TMRn0.Y.f(.&.M.).\.t.F.2...4.7.2.5.4.....M.E.N.U.I.T.E.M...JRd.(.&.D.).\.t.D.E.L...4.7.2.5.5.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(.&.R.).\.t.A.L.T.+.E.n.t.e.r...4.7.2.5.9.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_FolderBarSelItem.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):304
                                                      Entropy (8bit):4.803179431017057
                                                      Encrypted:false
                                                      SSDEEP:6:QmV6Sni6EtjbVIm2mLlFyVEpK2mLlurRhcOlpWm2mLlurRY7lphSX:Qi5i6E95HLlYEkHLlurj7lnHLlurslKX
                                                      MD5:8485DE2EB02331075B9224CA0D43445B
                                                      SHA1:2D471E23E9DC422ADBCFCD375EF41C98F0FBDA21
                                                      SHA-256:4E4D4B911BC7E468598C389AF55EA7D28699AA4D389E5B734192A30C132E6285
                                                      SHA-512:93D5D32C961EF99ABBF899667EDA428B3048B6B8880EE886A40A674E8D84C4F93806E3C5EAC4507C3EEB38D4ADE203C1D2F52D93F8F0DD99C3EE120D5B9134EF
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0.0.0.0g0.0.0.0.0x..bBfn0.S.0.0.0.0.0.0.0.0n0HQ-.k0.N.NU0.0~0Y0.0....M.E.N.U.I.T.E.M....eW0D0.0.0g0..O0(.&.N.)...6.5.5.3.1.....M.E.N.U.I.T.E.M....NMO..d\.0.eW0D0.0.0.0.0g0..O0(.&.G.)...6.5.5.3.2.....M.E.N.U.I.T.E.M....NMO..d\.0.eW0D0.0.0g0..O0(.&.A.)...6.5.5.3.3.....S.E.P.A.R.A.T.O.R.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_FolderBarSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):668
                                                      Entropy (8bit):4.379911273288116
                                                      Encrypted:false
                                                      SSDEEP:12:QiMXIWi7F2HLlud2HLla9ksjh2HLl+KwkF2HLlFcW4GKJHLlpPEjJHLlaSYWHLlt:QFIL2xW2xgh2x+KwkF2xFd41JxSjJxZd
                                                      MD5:015C78250F8554D38701E7FF615C92CF
                                                      SHA1:3C758D04EB0EFBA36C48705558A6E3BB5CDBB305
                                                      SHA-256:5ADE00BB897B80C15DDCC097216D8A0F0CE3F1301955F6D4959C53088E190165
                                                      SHA-512:0FB0C41214EA4E13BDA9CD2A4AB46EB4CB3A5853FA48A184057841F68443D07E3BA618AAB10432D1C959226C2540735DA14C057EF1305A105A35AA37EDB4FE96
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview:...&.0.0.0.0.0.0.0n0-..[.0.0.0.0g0Y0.0........P.O.P.U.P...#..R-..[(.&.R.).......M.E.N.U.I.T.E.M....0.0.0n0.y.Rh0#..R(.&.L.)...4.7.2.0.4.......M.E.N.U.I.T.E.M....0.0.R.0.fH0h0#..R(.&.T.)...4.7.2.1.5.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....N.`.0.0.0.0.0.0#..R(.&.V.)...4.7.2.0.7.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.0.0.0.0#..R(.&.N.)...4.7.2.0.5.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M.....W0.0.0.0.0.0h.:y(.&.H.)...4.7.2.0.6.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0n0h.:y(.&.B.)...4.7.9.5.2.....M.E.N.U.I.T.E.M....0.0.0.0.0n0h.:y(.&.T.)...4.7.9.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(.&.O.)...4.7.9.5.0.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ItemClip.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):108
                                                      Entropy (8bit):4.448019110478425
                                                      Encrypted:false
                                                      SSDEEP:3:QQBjCU2eW1a0CV63trfDVDVhUKcPfNzhvx5ov:QcHW1a7kxVDVCPflev
                                                      MD5:4B03CA5F0ED5371550142791F2BAC1F3
                                                      SHA1:3D6173FADF9433D7C9D85E70DEE3F12D341B6C09
                                                      SHA-256:1B821BF8B308B02D87CA95F51101A243B103350D4FD29820020B36DC179F95CD
                                                      SHA-512:2C8E1796D4B31DEAAF57418CD11B67316515B76908E6AE37064CB91F50A469E49F0CAC34B92B7D104516DC0B2A0D7E9D50D232E2279771C929CD97398A586BAA
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.0.0.0.0.0n0.0.0.0.0.0.0.0.0g0Y0.0(..N.}U0.0f0D0.0`0Q0g0.0.s(Wo0.O(uU0.0f0J0.0~0[0.0).........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ItemClipSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):160
                                                      Entropy (8bit):4.658717669152543
                                                      Encrypted:false
                                                      SSDEEP:3:QQBjCU2mbCV63trfDVDVhUKcPfNzhvx5ozq2r6lhlPfBJqihPoO:QcQkxVDVCPfle+2mLlnBJqIQO
                                                      MD5:181CDF7C8BA8D918EF2277C3FA3009FF
                                                      SHA1:18279628DA10A1B76DCAEBB259402E6B1F81B7B1
                                                      SHA-256:62FF2BC144BD254ED3DC817A66E412BBAC739BF7B9A0C6C89634FDE8170D40DC
                                                      SHA-512:8B7A730875DE0D49CA8466D9ED83B06DD84D27B916430958119363FFF903557BA8F2B89DF340CBA73702ED20DE66016F66B1327490806F353185C3BBAB95F165
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.0.0.0.0.0n0-..[.0.0.0.0g0Y0.0(..N.}U0.0f0D0.0`0Q0g0.0.s(Wo0.O(uU0.0f0J0.0~0[0.0).........M.E.N.U.I.T.E.M....0.0.0.0.0(.&.O.)...4.7.9.5.0.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ListContextMenu.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):2162
                                                      Entropy (8bit):4.56436399580495
                                                      Encrypted:false
                                                      SSDEEP:48:Y6PT9qHZj2xt2x2fX2xf2xk7f12xGu2x82xZ2xD+U2x52xb2x/Kg2xV2xfu2xX2t:RPTcZj2H2w/2J2CB2N2W2z2Z2b2B2BKT
                                                      MD5:F8DDCDBDAE6DBA62A204AAB4DCF34944
                                                      SHA1:5B6E64FFE4B00A4237399C097471EFD7BC470BAF
                                                      SHA-256:C20B4FE8124314EBB819C8128E8D392794E4AB1EC7783CEE657A35A681122EA4
                                                      SHA-512:F58B4370E995ABCF50D92AF0604E0607878AB611AA31852B9CEB53391F6A6940B11EA54AB8F2D9C038374CA318C71C1E85C73016E1F647F8FA49C931977C43B1
                                                      Malicious:false
                                                      Preview:...&.0.0.0g0UO.0K0n0.0.0.0.0.0x..bW0f0D0.0.rKan0h0M0n0.0.0.0.0.0.0.0.0.0.0n0.b5_..R..HQ-.k0h.:yU0.0~0Y0......W.h.e.n. .a.n. .e.x.t.e.n.s.i.o.n. .o.f. .t.h.e. .c.o.n.t.e.x.t. .m.e.n.u. .i.t.e.m.s. .t.o. .c.h.o.o.s.e. .a.n.y. .s.t.a.t.e. .i.n. .t.h.e. .l.i.s.t. .(.w.i.l.l. .b.e. .d.i.s.p.l.a.y.e.d. .a.t. .t.h.e. .t.o.p.).............P.O.P.U.P....b5_.0.0.0.0(.&.E.).......P.O.P.U.P....}.(.&.E.).........M.E.N.U.I.T.E.M....0.0.0.0g0..O0(.&.E.)...4.0.0.0.1.........M.E.N.U.I.T.E.M....0.0.0.0g0..O0(.&.V.)...4.0.0.0.3.......E.N.D...........P.O.P.U.P....TMRn0.0.0.0(.&.N.).........M.E.N.U.I.T.E.M....0.0.0.0.Tn0.0.0.0(.&.C.)...3.5.6.5.0.........M.E.N.U.I.T.E.M....0.0.0.0g0.TMR.0.0.0.0(.&.F.)...3.5.6.5.1.........M.E.N.U.I.T.E.M....b5_P[j0W0g0.0.0.0.0.Tn0.0.0.0(.&.X.)...3.5.6.5.2.......E.N.D...........P.O.P.U.P....0.0.0.0.d\O(.&.F.).........M.E.N.U.I.T.E.M....0.0.0.0.0.0.0(.&.C.)...4.2.0.1.4.........M.E.N.U.I.T.E.M....0.0.0.0.y.R(.&.M.)...4.2.0.1.5.........M.E.N.U.I.T.E.M...'W.~(.&.P.)...4.2.0.0.7.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ListHeader(Detail).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):268
                                                      Entropy (8bit):4.75644450381611
                                                      Encrypted:false
                                                      SSDEEP:6:Qj8/0xXd6EdAK2mLlg9/PX2mLllril4YJ2mLlWWt0JCx:Qjc0xXd6EzHLlGPXHLlBil4YJHLlWWtJ
                                                      MD5:983C2B1B1772B20F844BDDAB4977EEDF
                                                      SHA1:02089C44F89991CD9AC681751FD287C1A9E18D7C
                                                      SHA-256:33F4C9D9699E9F030592562AF42C56DF21D8B991C2D63A11043DE8D4D1C4C6E8
                                                      SHA-512:42DDA8B414F28DCEF2F0C5102ECEE85447BEA19C5FE97F67726DE8FEEE4702C79B88CB88D420512D380F9B7CE4D18709D296902C846555390317E5E602824833
                                                      Malicious:false
                                                      Preview:...&.0.0.0g0s.0}h.:yn0Bfn0.0.0.0n0.S.0.0.0.0.0.0.0.0.i.b.[...0.0.0.0........M.E.N.U.I.T.E.M...E^n0..R..te(.&.T.)...4.8.0.0.0.....M.E.N.U.I.T.E.M...hQf0n0E^n0..R..te(.&.Y.)...3.2.9.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...s.0}h.:yn0-..[(.&.O.)...3.2.7.8.1.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ListNoSelContextMenu.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3680
                                                      Entropy (8bit):4.541079304270962
                                                      Encrypted:false
                                                      SSDEEP:96:ZXE2P2wO2l2wz2Q2P2ip2Qn2P2QWv2T2l12UH2UGx222QH2o2QNM2t2Qt2o2Wb2v:ZXeeMF7eiYQ2eQRqONRg5QWzQVUQUzjv
                                                      MD5:F3AA8DF1FF9606BBE67939D61248F01B
                                                      SHA1:E7C33CD7FF4C9B4415317D3776E4D4121B810BC1
                                                      SHA-256:D7CD89F03D14B2974993CED36A6CB2DA50B5D3DA58D0B85F1C7EF08A16686C70
                                                      SHA-512:1802E6426AC1586BB203810B537A10E5F8DBA124582A39AC53A459BD8CA8A98E347B7E9B8AACAC7038CDEFBC8CE9A45049E2C7CCF066212EE6F5D43266AFCBA8
                                                      Malicious:false
                                                      Preview:...&.0.0.0*gx..bBfn0.S.0.0.0.0.0.0.0.0.i.b.[...0.0.0.0...././.<..0.0.0.0.0.0.0>.o0.e..\O.b.S..j0.0.0.0.0.0.0.0k0n..cU0.0~0Y0.0...././.(..0.0.0.0.0.0.0.0...T.zn0O.f.f.i.c.e..0.0.0.0...0.0.0.0.0.0.0.0.0j0i0).............P.O.P.U.P.....O0(.&.O.).......M.E.N.U.I.T.E.M....eW0O0..O0(.&.N.)...5.7.6.0.0.......M.E.N.U.I.T.E.M...S0S0K0.0..O0(.&.H.)...3.5.0.5.3.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0g0..O0(.&.B.)...3.5.0.5.4.......M.E.N.U.I.T.E.M...S0S0K0.0.0.0.0.0.0.0.0.0g0..O0(.&.G.)...3.5.0.5.5.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0n0.0.0.0.0K0.0..O0(.&.C.)...3.5.0.5.2.......M.E.N.U.I.T.E.M....c.[.0.0.0.0K0.0..O0(.&.F.).........3.5.0.5.1.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0(.&.E.)...3.5.5.1.1.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.0(.&.O.)...3.5.5.1.0.....E.N.D.....P.O.P.U.P.....X0.0(.&.C.).......M.E.N.U.I.T.E.M.....X0.0(.&.C.)...3.5.1.1.2.......M.E.N.U.I.T.E.M....S.0..X0.0(.&.R.)...3.5.1.0.6.......M.E.N.U.I.T.E.M...

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_PreviewBarSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):290
                                                      Entropy (8bit):4.60796469800036
                                                      Encrypted:false
                                                      SSDEEP:6:Q6qdkxVDVCPfle+2mLlaIL0pPAom2mLlC2/PA84YJ2mLlnBJqIQO:Q6TC1e+HLlaSYWHLlCoPj4YJHLlnPIO
                                                      MD5:CABB94AF61A1AABA87927C1EE1B47C11
                                                      SHA1:1DA3ECD18D72C4E01D0FA327251206684CD4C57C
                                                      SHA-256:AF70885A57ADA8E89A5B22583740D4C4ED231A8A50EF429A63A2122669CB442C
                                                      SHA-512:827839724F11836649BEAE9FE5CE7435E1A1E605A5FC2828C7144DDCE662E8FA2715FB3260045D5D7B619FD9A856276C18759728EB79C377A14D72715DDBAB29
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.0.0n0-..[.0.0.0.0g0Y0.0(..N.}U0.0f0D0.0`0Q0g0.0.s(Wo0.O(uU0.0f0J0.0~0[0.0).........M.E.N.U.I.T.E.M....0.0.0.0n0h.:y(.&.B.)...4.7.9.5.2.....M.E.N.U.I.T.E.M....0.0.0.0.0n0h.:y(.&.T.)...4.7.9.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(.&.O.)...4.7.9.5.0.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_RecentBarSelItem.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):384
                                                      Entropy (8bit):4.546490297259062
                                                      Encrypted:false
                                                      SSDEEP:6:QRT87GFTsi6ExBZ2mLleVl4Ma9m2mLlFyIo+2mLlRWgjJ2mLlsSo1J66xAy9:QZ87GF36EJHLlePB/HLlI+HLlRWgjJHM
                                                      MD5:E0432A367167198196A5C7987E44034F
                                                      SHA1:39E6DCEC4B97A643E3072CD7C26DC9C972D74DA0
                                                      SHA-256:6D377B15F373453555468CDD87D6178B75E9488BB99C54CEFFD63BCC965D605E
                                                      SHA-512:86FC62621E77C49BCE809BB95EA7292C503215DFD779DA9E68F589438069CE6CD2E4F2905227197190B6BE90B7D4E928AD09778FB5F2291F761B126A10898F40
                                                      Malicious:false
                                                      Preview:...&.g...X0_0.0.0.0.0.0.0.0g0.0.0.0.0x..bBfn0.S.0.0.0.0.0.0.0.0g0Y0.0........M.E.N.U.I.T.E.M....y.R(.&.M.)...4.7.4.0.2.....M.E.N.U.I.T.E.M....eW0D0.0.0g0..O0(.&.O.)...4.7.4.0.3.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0g0..O0(.&.B.)...4.7.4.0.4.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...hQf0JRd.(.&.D.)...4.7.4.0.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.E.D.I.T...S0n0.0.0.0.0.[..n0.}.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_RecentBarSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):864
                                                      Entropy (8bit):4.420249104044712
                                                      Encrypted:false
                                                      SSDEEP:24:QQveMxe5TxLxR04cJixPaxaORex27gJx41JxZRxDUYJxv:XTxUxLx+ZoxSxaORex27Wx4LxDxoOxv
                                                      MD5:079ACB27E0087950A876C8C1436232C2
                                                      SHA1:88FBE20B021DF300AC330425FB13E213DF857AAC
                                                      SHA-256:40157B96FCA50DB986B9919EDA88AF78A458F587B4252143EDB3AC149748B441
                                                      SHA-512:1DD1D30855F74582C7EC4AEE420D5E20914E443BA87EFB586A7364D4878D7E478A028FA62658F716A0FCF744C0549FB8A459F3BE495FE3556EB7673E31140934
                                                      Malicious:false
                                                      Preview:...&.g...X0_0.0.0.0.0.0.0.0n0-..[.0.0.0.0g0Y0.0........P.O.P.U.P...S0n0.0.0n0.j.nn0.R\O(.&.D.)..... . . . .M.E.N.U.I.T.E.M....y.R(.&.M.)...4.7.4.5.3..... . . . .M.E.N.U.I.T.E.M....eW0O0..O0(.&.N.)...4.7.4.5.4..... . . . .M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0g0..O0(.&.B.)...4.7.4.5.5.....E.N.D.....P.O.P.U.P...S0n0.0.0n0.0.0.0.0.[L.._n0.R\O(.&.X.)..... . . . .M.E.N.U.I.T.E.M...UO.0W0j0D0(.&.N.)...4.7.4.7.0..... . . . .M.E.N.U.I.T.E.M....0.0.0x0.0.0.0.0.0.y.R(.&.L.)...4.7.4.7.1..... . . . .M.E.N.U.I.T.E.M...S0n0.0.0.0^.h.:yk0Y0.0(.&.X.)...4.7.4.7.2.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0g0..O0(.&.S.)...4.7.4.0.5.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0n0h.:y(.&.B.)...4.7.9.5.2.....M.E.N.U.I.T.E.M....0.0.0.0.0n0h.:y(.&.T.)...4.7.9.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(.&.O.)...4.7.9.5.0.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_SortMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):218
                                                      Entropy (8bit):4.644122678678204
                                                      Encrypted:false
                                                      SSDEEP:6:QLVlDPexq2H42/e8A2cAuAcmPiyQQ2e2mLlWC6Wi:QLTWM2HdeAcACQiTeHLld6Wi
                                                      MD5:FC6CDDF75EF1F91260310F66F8861EA9
                                                      SHA1:693C9B20DD54F5AFC90D364063434E7ADD7E7764
                                                      SHA-256:8B692C39B44B9BB6A2077602AC89D520ECD498E5642D05C1F13FCF1E76587B81
                                                      SHA-512:6225E0072F74F63AB984A87AD98249508C3E1C9E26BF6781DD711A52C633456F7826ED8EC6D9B8BF2A5C687CF18BB6DDFFCC4C89A70C02BD9976606EC95ACCF6
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.0.0.0K0.0n0.0.0.0.0.0.0.0....,g.0.0.0.0o0yr.kj0.`1X.0qbc0f0D0.0n0g0.0.0.0.0.0MOn.n0.0.0.0.0.0.0W0K0g0M0~0[0.0.0........P.O.S.I.T.I.O.N...M.O.U.S.E.....M.E.N.U.I.T.E.M...<..0.0.0.0.0.0.0>...3.2.7.7.6.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabDropMenu.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):426
                                                      Entropy (8bit):4.683210657040223
                                                      Encrypted:false
                                                      SSDEEP:12:QH5HshztOkHLlef5zlcjHLlef5zClcbwxHLlaG1RYJHLlef51zHLlRi3IM:QpUNxeBzluxeB+lu+xl1RYJxeBZxRi3l
                                                      MD5:6672F8F091415390EE73E999BCA70D5C
                                                      SHA1:F5C5D39C7345D21B6DFB988ED4FB4D36DBB035F8
                                                      SHA-256:C481F0E9082A4A5566FE4270E6067F618088A561CFA07C7507DAC7FA0EF2668E
                                                      SHA-512:437F7EFE791B30F0BAB98822CDEED9BD041C9BEA912F1D0CAE3C5F34D7E5B86B27C20DE078DDE403499FC47F02FC710F6960DEC7B560B1F120CFD3F2113B5442
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0K0.0.0.0.0tPk0.0.0.0.0.0.0.0.0.0.0.0U0.0_0Bfk0h.:yU0.0.0.0.0.0.0g0Y0........M.E.N.U.I.T.E.M....s(Wn0.0.0.0.0.0.0!kn0.0.0.0.0.0.0x0.y.R..3.5.8.0.6.....M.E.N.U.I.T.E.M....s(Wn0.0.0.0.0.0.0MRn0.0.0.0.0.0.0x0.y.R..3.5.8.0.7.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0\O.b..3.5.8.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....s(Wn0.0.0.0.0.0.0..X0.0..3.5.1.1.2.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.R.0.fH0..3.5.8.5.0.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabMenu.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1210
                                                      Entropy (8bit):4.54315390746405
                                                      Encrypted:false
                                                      SSDEEP:24:QKz+xeBVx+IxWWXx7Fxeevmxl+/Jx28x2oaxxi+JxrSjxAgKJxJJxRi3IUxeyJxs:Mxenx+IxWWXx7FxeMmxlox28x2LxxVxb
                                                      MD5:36C2D2ADA4FCF33F939AB2A0424CA930
                                                      SHA1:C3421FBDA1CBCF4A7F13297A26E431A723198262
                                                      SHA-256:A738E859AF65ACA340E8C6CBABB361BF62C01744FD74967F580A85DB1A888E6E
                                                      SHA-512:40480887BEC8161394BC35CD4CBA5A3D314C0C485208F78E088A149563C5B9829F4AACC06F9BD4F990DEEA0FF58CFCF391EC71B6320BB7ECFA83E8918DB0439C
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.Ng0h.:yU0.0.0.0.0.0.0g0Y0(..R.g$Pg0o0.S.0.0.0.0.0.0.0.0).........M.E.N.U.I.T.E.M....s(Wn0.0.0.0.0.0.0..X0.0(.&.C.)...3.5.1.1.2.....M.E.N.U.I.T.E.M....].0..X0.0(.&.L.)...3.5.1.0.7.....M.E.N.U.I.T.E.M....S.0..X0.0(.&.R.)...3.5.1.0.6.....M.E.N.U.I.T.E.M...hQf0..X0.0(.&.A.)...3.5.1.1.1.....M.E.N.U.I.T.E.M....s(Wn0.0.0.0.0.0.N.Y.0..X0.0(.&.N.)...3.5.1.0.8.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0..X0.0(.&.G.)...3.5.1.0.5.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...S0S0K0.0..O0(.&.O.)...3.5.0.5.3.....M.E.N.U.I.T.E.M...S0S0K0.0.0.0.0.0.0.0.0.0g0..O0(.&.B.)...3.5.0.5.5.....M.E.N.U.I.T.E.M.....X0_0.0.0.0.Q.^..O0(.&.T.)...3.5.8.2.7.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M......0.NQ0(.&.P.)...5.7.6.3.7.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0n0...NQ0(.&.S.)...5.7.6.3.8.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....g.en0.`1Xk0.f.e(.&.R.)...3.3.3.0.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.R.0.fH0(.&.L.)...3.5.8.5.0.....M.E.N.U.I.T.E.M...;ub..RrR.R.0.fH0(.&.D.)...4.8.1.0.0.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabMenuSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):608
                                                      Entropy (8bit):4.3624183280258695
                                                      Encrypted:false
                                                      SSDEEP:12:QldHLl7QwHLlaG+WdJHLlI+HLlAAZHLlqPe0HLl+GJHLlaSYWHLlCoPj4YJHLlnu:Q3x7Fxl+kJxI+xAExt0xnJxZRxDUYJxu
                                                      MD5:096DC878840D460D8E58C5B8708DE6B6
                                                      SHA1:48FEE4830F7517A4E8526F1BC8465DF80C7B0D21
                                                      SHA-256:819648CD277B871CB5E1C31A75B668059049951B13E34E7887B23803D6C43458
                                                      SHA-512:A7D2A67BC864C37081B8401195E393DDFED816A494C951A23D8F38558DEC9F948BDC09ADC83AC5C90B29BBFA4F1EF1DA83D2291C48B2858FAAF7E04142B9719D
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.{.t.0.0n0-..[.0.0.0.0g0Y0.0........M.E.N.U.I.T.E.M...hQf0..X0.0(.&.A.)...3.5.1.1.1.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0..X0.0(.&.T.)...3.5.1.0.5.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....g'Y.S(.&.X.)...3.5.9.1.2.....M.E.N.U.I.T.E.M....m0f0h.:y(.&.C.)...5.7.6.5.0.....M.E.N.U.I.T.E.M...&~k0&Ny0f0h.:y(.&.H.)...5.7.6.5.1.....M.E.N.U.I.T.E.M...*jk0&Ny0f0h.:y(.&.V.)...5.7.6.5.2.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0n0h.:y(.&.B.)...4.7.9.5.2.....M.E.N.U.I.T.E.M....0.0.0.0.0n0h.:y(.&.T.)...4.7.9.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(.&.O.)...4.7.9.5.0.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabMngBarAction.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1510
                                                      Entropy (8bit):4.520984366903461
                                                      Encrypted:false
                                                      SSDEEP:24:Q+2xmWww2x/h2xEr2xkW8h2xPU2x+3IRT2xLW52xLWPq2xLWAZh2xyQyiG2xRi3t:J2x/v2xJ2xg2xQ2xPU2x+3kT2xg2xSqW
                                                      MD5:33E5D06C582EA226DA7859CA88685B25
                                                      SHA1:568758BACF426BB252A3568C4801D5E4462BECCC
                                                      SHA-256:0E5C1D895E4658D03DA32D520D0CC807B189248BC35547B06FC4D7D477AB13FD
                                                      SHA-512:02048CB6D5391B6B9CB1E98A1BE41F00252E9E1CCF9FC78D05CDDB2510C409D49FB84F3B26033420DAB116326FC1655A5EA253DED394A400B0D559E1FB7898EE
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.{.t.0.0n0.R\O.0.0.0.0n0.0.0.0.0g0Y0.0........P.O.P.U.P...x..b(.&.S.).......M.E.N.U.I.T.E.M...hQf0x..b/..d.(.&.A.).\.t.C.t.r.l.+.A...4.7.6.0.3.......M.E.N.U.I.T.E.M...x..b.d.(.&.X.)...4.7.6.0.2.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....TX0.0.0.0.0.0x..b(.&.G.).\.t.C.t.r.l.+.G...4.7.6.0.4.......M.E.N.U.I.T.E.M....TX0.0.0.0.0.0x..b(.&.D.).\.t.C.t.r.l.+.D...4.7.6.0.5.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0x..b(.&.N.)...4.7.6.0.6.......M.E.N.U.I.T.E.M....N.`.0.0.0.0.0x..b(.&.V.)...4.7.6.0.7.....E.N.D.....P.O.P.U.P...x..b.0.0.0.0.0.0te.R(.&.A.).......M.E.N.U.I.T.E.M....0.0.0.0.0.0*jk0&Ny0.0(.&.H.)...5.7.6.5.2.......M.E.N.U.I.T.E.M....0.0.0.0.0.0&~k0&Ny0.0(.&.V.)...5.7.6.5.1.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.m0f0h.:y(.&.C.)...5.7.6.5.0.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M...P[.0.0.0.0.0n0.g'Y.S(.&.X.)...3.5.9.1.2.....E.N.D.....P.O.P.U.P....0.0.0.0.0.{.t(.&.W.).......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.R.f(.&.L.)...4.7.6.2.2.......M.E.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabMngBarSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):486
                                                      Entropy (8bit):4.393052280765127
                                                      Encrypted:false
                                                      SSDEEP:12:QldHLlnXDCPzMBF2HLlaGo2HLlSmKJHLlaSYWHLlCoPj4YJHLlnPIv:Q3xnXDz2xlo2xwJxZRxDUYJxu
                                                      MD5:F37B07CBD39E2BC7351D0FFC086099F7
                                                      SHA1:8F4548B39299A89966875295D4F360C55EB697FB
                                                      SHA-256:AFDFE9668AF6EDDC172939CCD5E51B03B806A48514548C6319A63E4ECF0FBD6A
                                                      SHA-512:9F09568527AC54C203FDCEC5900C42C780B2F3F95E633320033E1A9E1A1250C374C2C3BD1CF7B0A2F1F191B15901B7EB2B961B670435313A856E5A2049B2179B
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.{.t.0.0n0-..[.0.0.0.0g0Y0.0........M.E.N.U.I.T.E.M.....Rte.R(.&.A.)...4.7.6.5.0.....P.O.P.U.P...&Ns0..(.&.S.).......M.E.N.U.I.T.E.M....0.0.0.0.0.0T0h0k0~0h0.0.0(.&.V.)...4.7.6.5.3.......M.E.N.U.I.T.E.M....0.0.0.0T0h0k0~0h0.0.0(.&.H.)...4.7.6.5.2.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0n0h.:y(.&.B.)...4.7.9.5.2.....M.E.N.U.I.T.E.M....0.0.0.0.0n0h.:y(.&.T.)...4.7.9.5.1.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(.&.O.)...4.7.9.5.0.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabMngContextMenu.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1664
                                                      Entropy (8bit):4.58562696963408
                                                      Encrypted:false
                                                      SSDEEP:48:OP82x/v2xJ2xg2xQ2xPU2x+3kT2xg2xSq2x12xMiG2xRiL2xg2x0+92xd2xrbx2E:OP82Bv2T2i2y2ZU2I3kT2i2x2b2OiG2b
                                                      MD5:D59FA83B10A0490D8A49AF4663CF6FD6
                                                      SHA1:48B7B65B9FA567C9DDC6C3BB33BE359B9E8BCE9B
                                                      SHA-256:C358FA07B0081EEA004ED59F1781EB113958A8C2E159103EB743297B0FBC01C5
                                                      SHA-512:DAB25CBB8B8220E6317CD73254F591D559F5D7796AEFD1009C51DA470CC55DDAE6115812EE50CA9D76DB7AF81A2507AFC95D156487739C299E2622D4321C6F4E
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0UO.0K0n0.0.0.0.0.0x..bW0f0D0.0.rKan0h0M0n0.0.0.0.0.0.0.0.0.0.0........P.O.P.U.P...x..b(.&.S.).......M.E.N.U.I.T.E.M...hQf0x..b/..d.(.&.A.).\.t.C.t.r.l.+.A...4.7.6.0.3.......M.E.N.U.I.T.E.M...x..b.d.(.&.X.)...4.7.6.0.2.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....TX0.0.0.0.0.0x..b(.&.G.).\.t.C.t.r.l.+.G...4.7.6.0.4.......M.E.N.U.I.T.E.M....TX0.0.0.0.0.0x..b(.&.D.).\.t.C.t.r.l.+.D...4.7.6.0.5.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0x..b(.&.N.)...4.7.6.0.6.......M.E.N.U.I.T.E.M....N.`.0.0.0.0.0x..b(.&.V.)...4.7.6.0.7.....E.N.D.....P.O.P.U.P...x..b.0.0.0.0.0.0te.R(.&.A.).......M.E.N.U.I.T.E.M....0.0.0.0.0.0*jk0&Ny0.0(.&.H.)...5.7.6.5.2.......M.E.N.U.I.T.E.M....0.0.0.0.0.0&~k0&Ny0.0(.&.V.)...5.7.6.5.1.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.m0f0h.:y(.&.C.)...5.7.6.5.0.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M...P[.0.0.0.0.0n0.g'Y.S(.&.X.)...3.5.9.1.2.....E.N.D.....P.O.P.U.P....0.0.0.0.0.{.t(.&.W.).......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.R.f(.&.L.).

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TabletAssistSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):746
                                                      Entropy (8bit):4.582096809411408
                                                      Encrypted:false
                                                      SSDEEP:12:QHkn1w1HLleL25HLlufljHLlbUlCg6AEAlOF2HLliFBe2HLlayn10Vgjh2HLlOIE:QYw1xey5xQljxbSC7AEAq2xYE2x/1h2K
                                                      MD5:C38225B6C03C022D0BF89BB22BFB8D31
                                                      SHA1:D5E43723F54A6D24C1D38305CEB9C4A33A185A3E
                                                      SHA-256:D477854FF34B67A223FD6931D977E3FA5F3334D2E2B5BF80C006682F912B5943
                                                      SHA-512:F9CE7C44637AC144E33F94C1B68EF18CD2701B073217C39CD3C4AFFEB47343E9FB25E75813B05B75ED7FBA695E422C24DD8ACC83C543C6F325AE0E7959D7CBD9
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0/e.c.0.0n0-..[.0.0.0.0g0Y0........M.E.N.U.I.T.E.M....s(Wn0.0.0n0.{.t.0.0.0.0.0.0.0..O0(.&.M.)...4.7.8.3.3.....M.E.N.U.I.T.E.M....g.en0.`1Xk0.f.e(.&.R.).\.t.F.5...4.7.0.0.1.....M.E.N.U.I.T.E.M....0.0.0.0.0.`1Xn0.f.e(.&.C.)...4.7.0.0.4.........P.O.P.U.P....T.0.0.0x0n0.R.f.0.0.0.0.0n0.0.0.0.0.0.0(.&.E.).......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.0..4.7.8.1.1.......M.E.N.U.I.T.E.M....0.0.0.0.0/e.c.0.0.0..4.7.8.1.2.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....0.0.0.0.{.t.0.0.0..4.7.8.1.3.......M.E.N.U.I.T.E.M....0.0.0.[L..0.0.0..4.7.8.1.4.......M.E.N.U.I.T.E.M....}..0.0.0..4.7.8.1.5.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0..4.7.8.1.6.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0n0h.:y(.&.B.)...4.7.9.5.2.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_TaskTray.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):118
                                                      Entropy (8bit):4.39062601449076
                                                      Encrypted:false
                                                      SSDEEP:3:QNVkKVnJVjykpbsCV64vlsq2r6lhlHYVRVwiidtY:QNVkKVbFbjBZ2mLl4LVwiiA
                                                      MD5:7EDD5CB918077216C00E1895E5DC930D
                                                      SHA1:F24514078F53962BC79DFDF91DD986703422CD37
                                                      SHA-256:E01797B85B3D227B349B0FBBB9637E6A235DDB24F1E6E018457F7F80C1F9FAC1
                                                      SHA-512:CBB38780F5512AAEA6F2ABCFBBB76B6A362D010DCC5274D20A56A7494B6FDF2C7D4A564A01E4F5DA9F046527611D5AC1FADC78973F9ADB40860684089BC009FA
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0.0k0<h.}U0.0_0..n0.0.0.0.0g0Y0.0........M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0n0B}.N(.&.X.)...3.5.0.0.0.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ToolbarIconMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):472
                                                      Entropy (8bit):4.1450439992230566
                                                      Encrypted:false
                                                      SSDEEP:12:QOKom9AniTeHLl4bHLlUL+HLl1JHLlVrQHLloCXZHLl98EvW32J:QsmKnGex4bxq+x1JxJQxoKxbvW3G
                                                      MD5:424EEB1DA313D77C4C9177521ECA6A45
                                                      SHA1:B16C5CBC466AB4C81859E09EB0553D52E240550A
                                                      SHA-256:6E9F5A2C0F14709848087A0C6000E453F2BB1FD57465A8419853BB39E295C61A
                                                      SHA-512:DC01E6FF293D5838317B15887C4B8BAC9EAC94129114927B3DF0F587A0C55F577F03740A735734EDA7F755AD20BB71896E264612494EEA8D41682C63198C2C83
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0K0.0n0.0.0.0.0.0.0.0.0.0.0.0........P.O.S.I.T.I.O.N...M.O.U.S.E.....M.E.N.U.I.T.E.M....0.0.0.0(..\)...3.2.9.1.1.....M.E.N.U.I.T.E.M....0.0.0.0(.-N)...3.2.9.1.2.....M.E.N.U.I.T.E.M....0.0.0.0(.'Y)...3.2.9.1.3.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(..\)...3.2.9.2.1.....M.E.N.U.I.T.E.M....0.0.0.0.0(.-N)...3.2.9.2.2.....M.E.N.U.I.T.E.M....0.0.0.0.0(.'Y)...3.2.9.2.3.....S.E.P.A.R.A.T.O.R.........M.E.N.U.E.D.I.T...S0n0.0.0.0.0.[..n0.}.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ToolbarListMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):446
                                                      Entropy (8bit):4.05250621525738
                                                      Encrypted:false
                                                      SSDEEP:12:QOKCAniTeHLlOHLlW+wHLlvzHLlWG+HLlLBxHLlW8NHLlUW32J:QxnGexOxW+wxvzxWG+xLBxxWexUW3G
                                                      MD5:9F0264A4A157A6DFE06050421DADBDEC
                                                      SHA1:01FF0EDFE060BC2F999423D02336BE66026D0C1A
                                                      SHA-256:17FFC53D2F3B04FEDA25323BD963D3BA7B7D44553F3DB9FA3FD0B874A6D5FCA9
                                                      SHA-512:C3F02E417A3A229E8FF3185E8305A42CC2E1A99B541EBC89A8E481A62C30D5E74C4B05900DDCC333FC83D32068C7B1FE1F4C4ECFAAD3DF91D79B3E338CB4A6C0
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0K0.0n0h.:y.0.0.0.0.0.0.0........P.O.S.I.T.I.O.N...M.O.U.S.E.....M.E.N.U.I.T.E.M....0.0.0.0..3.2.9.0.0.....M.E.N.U.I.T.E.M...s.0}.N....3.2.9.0.2.....M.E.N.U.I.T.E.M....N....3.2.9.0.1.....M.E.N.U.I.T.E.M...s.0}..3.2.9.0.4.....M.E.N.U.I.T.E.M...&Ny0f0h.:y..3.2.9.0.5.....M.E.N.U.I.T.E.M....0.0.0.0.0..3.2.9.0.6.....M.E.N.U.I.T.E.M....0.0.0.0n0.0..3.2.9.0.7.....S.E.P.A.R.A.T.O.R.........M.E.N.U.E.D.I.T...S0n0.0.0.0.0.[..n0.}.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ToolbarSortMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):212
                                                      Entropy (8bit):4.626981611044071
                                                      Encrypted:false
                                                      SSDEEP:6:QO6f6Fxq2H42/e8A2cAuAcmPiyQQ2e2mLlWC6Wi:QOKwM2HdeAcACQiTeHLld6Wi
                                                      MD5:A7668A020443882963592EBB99A67937
                                                      SHA1:8B66B54B1EAA05EB45D3DD5854C1A8976015FE35
                                                      SHA-256:0DB2E43F65C6124462C922C9D4B462F4CEBA6890895ED712789B7D573AAA0C35
                                                      SHA-512:7F7BB2B5F73A2982AE01B7BF113DC7F9C83930F0C38A7C5B1285362DEE0AED823345D3CBAA8E36D28892F02C5B529E6D306EB8E7837E4C35A881A72F826FD895
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.0K0.0n0.0.0.0.0.0.0.0....,g.0.0.0.0o0yr.kj0.`1X.0qbc0f0D0.0n0g0.0.0.0.0.0MOn.n0.0.0.0.0.0.0W0K0g0M0~0[0.0.0........P.O.S.I.T.I.O.N...M.O.U.S.E.....M.E.N.U.I.T.E.M...<..0.0.0.0.0.0.0>...3.2.7.7.6.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_UserBarAction.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1218
                                                      Entropy (8bit):4.50101278808909
                                                      Encrypted:false
                                                      SSDEEP:24:QoxdChM2x1k2xHF2x5NE2x6M2xeC/E2xRTN2xeTs0ZHDMclVy0sh2xeFbEx2xRJI:VxdChM2x1k2xHF2xDE2x6M2xeC/E2xRn
                                                      MD5:ABA4E751BEBF283A541787144DD70C1F
                                                      SHA1:88CD3FF58D74E6D76624C2455A6B26EC0A922003
                                                      SHA-256:3F59120F60BFEC7E42914825EC9F2511ABF0BAAD41A51633395890FB4977671F
                                                      SHA-512:08D8C83162B815D15767D76194601A0FC3B1EEA9A4C7B2A9DDC3D3179AD1D9C3FAB6B9D39FD93C02B4E2443EFA266A6F8886C53972D2BF81F46B62B1C061B43A
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.[...0.0n0.R\O.0.0.0.0n0.0.0.0.0g0Y0.0........M.E.N.U.I.T.E.M....NMO..d\x0.y.R(.&.D.).\.t.B.S...4.7.0.0.0.....P.O.P.U.P....e..\O.b(.&.N.).......M.E.N.U.I.T.E.M....0.0.0.0.0(.&.F.)...4.7.0.0.5.......M.E.N.U.I.T.E.M....eW0D0.0.0.0.0(.&.N.)...4.7.0.0.7.......M.E.N.U.I.T.E.M...x..b.0.0.0.0.0{v2.(.&.S.)...4.7.0.1.8.......M.E.N.U.I.T.E.M....0.0.0.0.0.0\Oc0f0.s(Wn0.0.0.0.N.b{v2.(.&.T.)...4.7.0.1.7.....E.N.D.....P.O.P.U.P....0.0._CQ.0.0.0.0.0.u.b(.&.B.).......M.E.N.U.I.T.E.M....s(Wn0.0.0n0.0(.&.N.)...4.7.0.2.8.......M.E.N.U.I.T.E.M...hQf0n0.0.0(.&.A.)...4.7.0.2.6.......M.E.N.U.I.T.E.M....N.e..X0.0+.hQf0n0.0.0(.&.C.)...4.7.0.2.7.....E.N.D.....P.O.P.U.P...S0n0..d\x0n0.N.b.d\O(.&.A.).......M.U.L.T.I.P.L.E....s(W.0.0h0.T.gY0.0(.&.S.)...4.7.0.2.2.,.4.7.0.2.3.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....s(W.0.0.0.N.b{v2.(.&.A.)...4.7.0.2.3.......M.E.N.U.I.T.E.M....0.0.0.0.0hQf0JRd.(.&.D.)...4.7.0.2.2.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...JRd.(.&.D.).\.t.D.E.L...4.7.0.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_UserBarNoSel.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):962
                                                      Entropy (8bit):4.591412275426875
                                                      Encrypted:false
                                                      SSDEEP:24:QjGex1mxBM2xeC/E2xRTN2xeTs0ZHDMclVy0sh2xeFbEx2xRJxQljxbSCXJ3n:fex1mxBM2xeC/E2xRTN2xeQ0pDnVjg21
                                                      MD5:1857D2D9D617746C13C976722F4FD24E
                                                      SHA1:0198FFA83049EC5286EAB8CD74550AE540B09E18
                                                      SHA-256:8B91FC0799BAB9E3AE3688BADA11266E03958C0D03CB2FD5DD0D7B90183E7D40
                                                      SHA-512:7EE6C4E058420604894041A0EB9DF9E670704CAABBD04F25DC99934167BC50189FD5D00CBDB3BA7495A8F3434B38B3ACD53ED2C24368A8603A06A7162350B9E2
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.[...0.0g0.0.0.0.0*gx..bBfn0.S.0.0.0.0.0.0.0.0g0Y0........P.O.P.U.P....e..\O.b(.&.N.)..... . . . .M.E.N.U.I.T.E.M....0.0.0.0.0(.&.F.)...4.7.0.0.5..... . . . .M.E.N.U.I.T.E.M....eW0D0.0.0.0.0(.&.N.)...4.7.0.0.7.....E.N.D.....P.O.P.U.P....0.0._CQ.0.0.0.0.0.u.b(.&.B.).......M.E.N.U.I.T.E.M....s(Wn0.0.0n0.0(.&.N.)...4.7.0.2.8.......M.E.N.U.I.T.E.M...hQf0n0.0.0(.&.A.)...4.7.0.2.6.......M.E.N.U.I.T.E.M....N.e..X0.0+.hQf0n0.0.0(.&.C.)...4.7.0.2.7.....E.N.D.....P.O.P.U.P...S0n0..d\x0n0.N.b.d\O(.&.A.).......M.U.L.T.I.P.L.E....s(W.0.0h0.T.gY0.0(.&.S.)...4.7.0.2.2.,.4.7.0.2.3.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....s(W.0.0.0.N.b{v2.(.&.A.)...4.7.0.2.3.......M.E.N.U.I.T.E.M....0.0.0.0.0hQf0JRd.(.&.D.)...4.7.0.2.2.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....g.en0.`1Xk0.f.e(.&.R.).\.t.F.5...4.7.0.0.1.....M.E.N.U.I.T.E.M....0.0.0.0.0.`1Xn0.f.e(.&.C.)...4.7.0.0.4.....S.E.P.A.R.A.T.O.R.....M.E.N.U.E.D.I.T...S0n0.0.0.0.0.[..n0.}.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_UserBarSelDir.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):724
                                                      Entropy (8bit):4.584395980290521
                                                      Encrypted:false
                                                      SSDEEP:12:QR86E7HLlurj7wHLlurQvJHLlX3kVcKxHLlX3xdjJHLlNuHLlNFLJHLlufljHLld:Q8xuroxurQvJxnktxxnfJx8xNFLJxQlf
                                                      MD5:D1BB3406EC472D2BB442F88A17195971
                                                      SHA1:DDA9DD48CE1C179B5B29AE136EFC5F27AB38927B
                                                      SHA-256:5F4C74FDA664ED8D2A240E0547C1E2EF363201D51BDE4F3066419CF56BA134D7
                                                      SHA-512:7718BE1C5EA3D6A746F790EABF880F70AB3BF7DAD4FFDC14145BC996ACB6F0208503831E2D728979CEC5D947D42721ECB162C2B603879A37E60FF49FF9C9D440
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.[...0.0g0.0.0.0.0.0.0x..bBfn0.S.0.0.0.0.0.0.0.0g0Y0........M.E.N.U.I.T.E.M....NMO..d\.0.eW0D0.0.0.0.0g0..O0(.&.G.)...4.7.0.1.0.....M.E.N.U.I.T.E.M....NMO..d\.0.eW0O0..O0(.&.O.)...4.7.0.0.9.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...hQf0..X0f0.NMO..d\.0.0.0.0.0g0..O0(.&.U.)...4.7.0.2.5.....M.E.N.U.I.T.E.M...hQf0..X0f0.NMO..d\.0..O0(.&.P.)...4.7.0.2.4.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...JRd.(.&.D.).\.t.D.E.L...4.7.0.0.3.....M.E.N.U.I.T.E.M....TMRn0.Y.f(.&.M.).\.t.F.2...4.7.0.0.2.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....g.en0.`1Xk0.f.e(.&.R.).\.t.F.5...4.7.0.0.1.....M.E.N.U.I.T.E.M....0.0.0.0.0.`1Xn0.f.e(.&.C.)...4.7.0.0.4.....S.E.P.A.R.A.T.O.R.....M.E.N.U.E.D.I.T...S0n0.0.0.0.0.[..n0.}.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_UserBarSelItem.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1202
                                                      Entropy (8bit):4.559259240885258
                                                      Encrypted:false
                                                      SSDEEP:24:Q5xuHT2xm2xg2xRAh2x9Rq2xdPE2xmnSX2x2e2xvSrFJx8xNFLJxQljxbSCXJ3n:gxiT2xm2xg2xC2x9o2xd82xmw2xZ2xvQ
                                                      MD5:E909826EBCD53699D1521D38A2582593
                                                      SHA1:C6DAE950C6B508FAF92422E1FE497B46F7B68866
                                                      SHA-256:86A72A20DB661C6DED569E20172E355AC3E272D1327416A6C0132CEA71397267
                                                      SHA-512:760AF6532CB0AF80E55CC537E53648C7D42D5113AAC3E4E9D96B37E63D39E11A4F58538A6383E0173A9963718A9F5F81398B510456B0E9E71B5AD17A52FFD449
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.[...0.0g0.0.0.0.0x..bBfn0.S.0.0.0.0.0.0.0.0g0Y0........M.E.N.U.I.T.E.M.....O0(.&.O.)...4.7.0.3.0.....P.O.P.U.P....R\O.0.c.[W0f0..O0(.&.A.).......M.E.N.U.I.T.E.M....0.0.0.0.y.R(.&.J.)...4.7.0.1.3.......M.E.N.U.I.T.E.M....eW0D0.0.0.0.0.0g0..O0(.&.N.)...4.7.0.1.4.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0g0..O0(.&.B.)...4.7.0.1.5.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....[L.(.&.O.)...4.7.0.1.2.....E.N.D.........P.O.P.U.P....}.(.&.E.).......M.E.N.U.I.T.E.M....0.0.0.0g0.}.(.&.E.)...4.7.0.0.6.......M.E.N.U.I.T.E.M....0.0.0.0.0n0.z^..0..R$R.[W0f0-..[(.&.D.).......\.t.A.L.T.+.E.n.t.e.r...4.7.0.1.9.......P.O.P.U.P....z^..0.c.[W0f0.}.(.&.T.).........M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.0h0W0f0.}.(.&.R.).........4.7.0.2.0.........M.E.N.U.I.T.E.M....b5_P[$R%R.0.0.0.0h0W0f0.}.(.&.X.).........4.7.0.2.1.......E.N.D.....E.N.D.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M...JRd.(.&.D.).\.t.D.E.L...4.7.0.0.3.....M.E.N.U.I.T.E.M....TMRn0.Y.f(.&.M.).\.t.F.2...4.7.0.0.2.....S.E.P.A.R.A.T.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_UserBarSetting.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1588
                                                      Entropy (8bit):4.447195597846636
                                                      Encrypted:false
                                                      SSDEEP:48:wx276ZD2x+2x32x22x02xMUlq2xs2xv2xaO92xaS2xWPm2xW1Hbp2xWce2xM2xwU:ww7oD2I2B242q2SF2m2d2r232Qe2Q11u
                                                      MD5:BBE4F02787919D328EA2D48D4B244DC2
                                                      SHA1:73CE4E59DCF28E5C89ACDDD7266021ECE437173D
                                                      SHA-256:BBD96D760BF5682D5BD3502B3F52D374077BA486FDE4621C32AB8B7AC04CAB4B
                                                      SHA-512:7B6B631E4F4906B9AF8E7A3DD20674479E09C8DE7CAC6915CD7E4C3B20CFE3A35106A9C64271D940471D05BE960DB025FD56F8D5C8103B710EB4622D61B05DC0
                                                      Malicious:false
                                                      Preview:...&.0.0.0.0.[...0.0n0-..[.0.0.0.0g0Y0........M.E.N.U.I.T.E.M...S0n0.0.0n0.{.t.0.0.0.0.0.0.0..O0(.&.M.)...4.7.0.0.8.....P.O.P.U.P...S0n0.0.0n0.j.nn0.R\O(.&.D.).......M.E.N.U.I.T.E.M....y.R(.&.M.)...4.7.0.5.3.......M.E.N.U.I.T.E.M....eW0O0..O0(.&.N.)...4.7.0.5.4.......M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0g0..O0(.&.B.)...4.7.0.5.5.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M....[L.(.&.X.)...4.7.0.5.2.......S.E.P.A.R.A.T.O.R.......M.E.N.U.I.T.E.M.....R$R.[(.&.A.)...4.7.0.5.1.......M.E.N.U.I.T.E.M...-..[.0.0.0.0k0._F0(.&.I.)...4.7.0.5.0.....E.N.D.....S.E.P.A.R.A.T.O.R.....P.O.P.U.P....0.0.0.0.0.0hQSOn0.R\O(.&.U.).......P.O.P.U.P....0.0.0.0.[L.._n0.R\O(.&.X.).........M.E.N.U.I.T.E.M...UO.0W0j0D0(.&.N.)...4.7.0.7.0.........M.E.N.U.I.T.E.M....0.0.0x0.0.0.0.0.0.y.R(.&.L.)...4.7.0.7.1.........M.E.N.U.I.T.E.M...^.h.:yk0Y0.0(.&.X.)...4.7.0.7.2.......E.N.D.......P.O.P.U.P...{v2.Bfn0.R\O(.&.S.).........M.E.N.U.I.T.E.M....0.0.0.0.0.0.0j0W0(.&.N.)...4.7.0.6.0.........M.E.N.U.I.T.E.M....0.0.0.0.0.0.0k0

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Menu\_ViewMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3190
                                                      Entropy (8bit):4.601251410083378
                                                      Encrypted:false
                                                      SSDEEP:96:34QHZQG+xQeJbZmosQcw/QTJxMwMcVSo/VYVYAWVoLv9V6V2VDVelmZC:34QHZQ3xQeJbEosQcwYTJxMwMcVn/VYe
                                                      MD5:91B86FAB3A5741DFFF0215DDBD0C8C0E
                                                      SHA1:3C3F743AD97C0F7BEC09C447DD4827786CE4FCCF
                                                      SHA-256:070116F4FF01105F1AC781D22AF2659D2A9AC44FC950679837967884B67B8E91
                                                      SHA-512:273829AF65502958B4DFEA876112D81B19C87F2DBB36A5FFCFB406109E74E219C6DF6BB17DC180A935D7B7168085E63FBB19C7B538EBB93CFD7E4C8C8A5B89F6
                                                      Malicious:false
                                                      Preview:...&h.:y.0.0.0.Y.f.0.0.0.0g0Y0........M.E.N.U.I.T.E.M....0.0.0.0..3.2.9.0.0.....M.E.N.U.I.T.E.M...s.0}.N....3.2.9.0.2.....M.E.N.U.I.T.E.M....N....3.2.9.0.1.....M.E.N.U.I.T.E.M...s.0}..3.2.9.0.4.....M.E.N.U.I.T.E.M...&Ny0f0h.:y..3.2.9.0.5.....M.E.N.U.I.T.E.M....0.0.0.0.0..3.2.9.0.6.....M.E.N.U.I.T.E.M....0.0.0.0n0.0..3.2.9.0.7........././.M.E.N.U.I.T.E.M....0.0.0.0(..eegn0.0.0.0.0.0.0.0.0.0.0.0.0x..bL0W0.0Y0D0L0'`..OUL.B0.0)...3.2.9.0.8....././.M.E.N.U.I.T.E.M....0.0.0.0n0.0(..eegn0.0.0.0.0n0.0.0.0.0)...3.2.9.0.9....././.S.E.P.A.R.A.T.O.R.........S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.\..3.2.9.1.1.....M.E.N.U.I.T.E.M....0.0.0.0-N..3.2.9.1.2.....M.E.N.U.I.T.E.M....0.0.0.0'Y..3.2.9.1.3.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0(..\)...3.2.9.2.1.....M.E.N.U.I.T.E.M....0.0.0.0.0(.-N)...3.2.9.2.2.....M.E.N.U.I.T.E.M....0.0.0.0.0(.'Y)...3.2.9.2.3.....S.E.P.A.R.A.T.O.R.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0.\U0O0..3.3.3.7.0.....M.E.N.U.I.T.E.M....0.0.0.0.0.0.0.0'YM0O0..3.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\PlugInCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):2422
                                                      Entropy (8bit):5.224261128465927
                                                      Encrypted:false
                                                      SSDEEP:48:9zeJr7LZT5qpDcnS/XqlMqlDqlRQ3/cZekhUuU3tZgcIuEA:9ULvqpwKX34NRkeukIub
                                                      MD5:735B00AB8824CE659AE64E1702C28205
                                                      SHA1:065D76A2353922ED20B404DCBDFFBD6BDA439099
                                                      SHA-256:2ADA1FEBC9CB25B383B822A1F3BAB45782D2CBC799B9B22D4C8399112D365667
                                                      SHA-512:385FE6A115965A1AD8C75EEA3661216DFFDD02082E0EA4018FE8ADC07CCAC53F5603057A4EC87EF4CB0740C9AD9736D17DE29B918F1AF151054B19C2D85186CD
                                                      Malicious:false
                                                      Preview:.././.D.L.L..Wn0.0.0.0.0.0.0.0.0.0...././..g.R.0.0.0.0I.D.n0.{.V:.4.1.5.0.1.^.4.1.6.0.0....././..0.0.0.0.N.io0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.h0.TX0g0Y0n0g0.0]0a0.0.0.SgqO0`0U0D0.0...././.S0n0.0.0.0.0o0.0.0.0.0.0.0.c.[Y0.0.0.0.0.0g0Y0n0g0.0.NMRk0.0.0.Tn0.x...0.0.0.0.0.0n0M.n..0.x..W0f0O0`0U0D0.0.......././.4.1.5.0.1...-.-.-...%.C.m.d.P.l.u.g.i.n._.D.i.r.%.M.P.I.D.u.s.t.B.o.x...d.l.l...T0.0.{.0zzk0Y0.0...././.4.1.5.0.2...N.F.D...%.C.m.d.P.l.u.g.i.n._.D.i.r.%.M.P.I.C.p.F.i.l.e.N.a.m.e...d.l.l....0.0.0.0.T.0.0.0.0.0.0.0.0x0.0.0.0...././.4.1.5.0.3...N.F.D...%.C.m.d.P.l.u.g.i.n._.D.i.r.%.M.P.I.C.p.F.u.l.l.N.a.m.e...d.l.l....0.0.0.0.T.0.0.0.0.0.0.0.0x0.0.0.0...././.4.1.5.0.4...N.F.D...%.C.m.d.P.l.u.g.i.n._.D.i.r.%.M.P.I.C.p.S.u.b.F.u.l.l.N.a.m.e...d.l.l....0.0.0.0.T.0.0.0.0.0.0.0.0x0.0.0.0...././.4.1.5.0.5...N.-.-...%.C.m.d.P.l.u.g.i.n._.D.i.r.%.N.o.w.D.i.r.I.n.f.o...d.l.l....s(Wn0.0.0.0.0.`1X...././.4.1.5.0.6...N.F.D...%.C.m.d.P.l.u.g.i.n._.D.i.r.%.M.a.m.e.P.l.u.g.i.n.S.a.m.p.l.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\ScriptCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                      Category:dropped
                                                      Size (bytes):386
                                                      Entropy (8bit):4.694828728192785
                                                      Encrypted:false
                                                      SSDEEP:12:Q1CKz+0kYrzAl4HyradebTyYrzAl4Hw1ONBu29:Qbz+nl4XYWl4wW9
                                                      MD5:4312FD05063B8F3750D395481C80B852
                                                      SHA1:8B08EA8F5BB7F49F822AF575C1377979FCAB0A2E
                                                      SHA-256:1929F5DB4AC68D4EE2A4E5749E6400CFBA72EFEAFCA87E6E3DFB224B5A97AC68
                                                      SHA-512:81B0363FECEC5FE3671ECF1CCDB7CF76D132BE367267F1B63BB15EF2BC421CC81160C846C6E00DE6CE776A5F8515373B16F5BB3802986BC07FA0A26BA4FCE00C
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0.0|Ts0.QW0.0.0.0.0...././..g.R.0.0.0.0I.D.n0.{.V:.4.0.0.0.4.^.4.0.5.0.0.......E.O.F........././..0.0.0.0.N.io0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.h0.TX0g0Y0n0g0.0]0a0.0.0.SgqO0`0U0D0.0...././.4.0.5.0.1.^.4.0.5.0.3.o0.N.}U0.0f0D0~0Y0n0g0.0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.g0.[..U0.0f0D0~0Y0.0...././.(.S0a0.0g0.[..Y0.0p0.0S0a0.0n0.eL0.g.Rk0j0.0~0Y0).....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\ScriptNaviCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):466
                                                      Entropy (8bit):4.892605416803553
                                                      Encrypted:false
                                                      SSDEEP:12:Q1SaS4WZ30kYrzAl4HyraOTyYrzAl4Hw1ONBu29:QEaS4WZnl4AWl4wW9
                                                      MD5:C0E80F5EFA9C655A1E046EE74D399540
                                                      SHA1:5577C2F142D627B12868B96E73F698D0581A0AAE
                                                      SHA-256:A5572752E11DECD02CCBCE02C97D85634BADBFEC03BEE0C427C22C855E0A45D0
                                                      SHA-512:86382A530B608455C0DB6D2324AF2B66253B4E77593C4118F0692534F0A6E4B4E46637D162BAD544B9334BFC540BAFFE39D8648D3387D510D62B78FE3ABE5244
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0.0.0.0B0.0n0.0.0.0.0.0|Ts0.QW0.0.0.0.0...0.0.0.0.0.Nk0.0.0.0.0.0L0B0.0h0.0.NMO..d\k0.y.RW0~0Y0.....././..g.R.0.0.0.0I.D.n0.{.V:.4.0.5.0.4.^.4.1.0.0.0.........E.O.F........././..0.0.0.0.N.io0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.h0.TX0g0Y0n0g0.0]0a0.0.0.SgqO0`0U0D0.0...././.4.0.0.0.1.^.4.0.0.0.3.o0.N.}U0.0f0D0~0Y0n0g0.0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.g0.[..U0.0f0D0~0Y0.0...././.(.S0a0.0g0.[..Y0.0p0.0S0a0.0n0.eL0.g.Rk0j0.0~0Y0).....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Script\BinEdit.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1292
                                                      Entropy (8bit):4.7478400215156995
                                                      Encrypted:false
                                                      SSDEEP:24:QbeVRyMU94ahxRFA1skmBQ071EHu36q3MnQoQpqQO3z9mQ3A3ByA3lYqv:LyMUaah3OlwQ06HQ6q30Qo2ojpqv
                                                      MD5:ACFBB2D1235FB1A99E17B8A9D36EFA2F
                                                      SHA1:4F3990C5EB4C8CFFF97F3B419DA06D16FB31EB27
                                                      SHA-256:7EC90E4CEB78268E9186B00A3A730EA5BC929D7B6050D33A16B7877EC7EE91E1
                                                      SHA-512:FB78DFCAFF76E31065141C30F05B94D299FFDA885A38FC3A3FFA8C5609BAA5FB647ACB6ACD818B10BD485D584972154DB2E2AD09AE7E8020D5CD3157F6245244
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0.0.0.0.0w..R(u.0.0.0.0.0.0.0.0.0...././..N.ik0..W0f0o0.0N.e.w.C.o.m.m.a.n.d...t.e.m.p.l.a.t.e..0.0.SgqO0`0U0D0.0...././. .S.t.a.r.t.u.p. .s.c.r.i.p.t. .f.i.l.e. .f.o.r. .b.i.n.a.r.y. .e.d.i.t.o.r. ....././. .S.p.e.c.i.f.i.c.a.t.i.o.n. .o.f. .t.h.e. .".N.e.w.C.o.m.m.a.n.d...t.e.m.p.l.a.t.e.". .P.l.e.a.s.e. .r.e.f.e.r. .t.o. .........C.o.m.m.a.n.d.L.i.n.e.O.p.t.i.o.n.=.?.S.e.l.F.i.l.e.?. .....M.u.l.t.i.C.o.m.m.a.n.d.M.o.d.e.=.0.....S.h.i.f.t.S.i.l.e.n.t.M.o.d.e.=.0.....B.o.o.t.D.i.r.=.....B.o.o.t.M.o.d.e.=.0.....O.p.e.n.M.o.d.e.=.0........././..%.b5_P[#..R.0.0.0.0.[L...h0.0B0H0Z0.0.0.03^g0..O0.0F0k0-..[W0f0J0.0~0Y0.....././. . .C.o.m.m.a.n.d.i.n.g. .l.i.n.k.e.d. .e.x.t.e.n.s.i.o.n. .(.n.o.w.,. .w.e. .a.r.e. .s.e.t. .t.o. .o.p.e.n. .i.n. .N.o.t.e.p.a.d.). .........F.i.l.t.e.r.=.....E.x.R.u.n.=.n.o.t.e.p.a.d...e.x.e............././..[..k0.O(uY0.0..k0o0.0.0.03^.0.0.0.0.0.0v}.[.0.0g0.c.[W0f0O0`0U0D0...././.W.i.n.d.o.w.s.n0.0.0.i"}n0*QHQ..MOn0.N.ik0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Script\Editor.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):2578
                                                      Entropy (8bit):4.905908538316009
                                                      Encrypted:false
                                                      SSDEEP:48:XtEDOlwQ06HdlC/iCTs1sMNdb1hdCDSdCDYdhR5LQD2ojpd:dESqQ38iSisI111IXVd
                                                      MD5:341A09B4476E358541AFAFB0D9677801
                                                      SHA1:222BDA6F2DA215F589A26BD57A03515B182B6EA9
                                                      SHA-256:AB0D893F3591ED9045C1CC7EFE180213C00A60A41FD3F703DC238E53BE51B29F
                                                      SHA-512:AEF62ABF26B8419B2D2726434EBEAEDBA5A5BF6144D1D28855A1CDF7989AA501C8CE3B3146F118C9D74C6117D294752A4BB23579C71933461B4590CA7ABCB7E3
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0w..R(u.0.0.0.0.0.0.0.0.0...././..N.ik0..W0f0o0.0N.e.w.C.o.m.m.a.n.d...t.e.m.p.l.a.t.e..0.0.0.0.0.0.0.SgqO0`0U0D0...././..0/./..0g0.Y~0.0L.o0.0.0.0.0n0qbD0k0j0.0~0Y0.0........C.o.m.m.a.n.d.L.i.n.e.O.p.t.i.o.n.=.?.S.e.l.F.i.l.e.?. .....M.u.l.t.i.C.o.m.m.a.n.d.M.o.d.e.=.0.....S.h.i.f.t.S.i.l.e.n.t.M.o.d.e.=.0.....B.o.o.t.D.i.r.=.....B.o.o.t.M.o.d.e.=.0.....O.p.e.n.M.o.d.e.=.0........././..%.b5_P[#..R.0.0.0.0.[L...;u.Po0.0.0.0.0.0]0n0.No0Y0y0f0.0.03^g0..O0.0F0k0-..[W0f0J0.0~0Y0.........././.C.S.V..0.0.0.0n0.O...././.F.i.l.t.e.r.=.c.s.v....././.E.x.R.u.n.=.D.:.\.T.O.O.L.S.\.E.d.i.t.o.r.\.C.s.v. .e.d.i.t.o.r.\.C.s.v.E.d.i.t...e.x.e........././.W.e.b..|n0.0.0.0.0.0I{k0i.W0_0.0.0.0.0.0|Ts0.QY0.O...././.F.i.l.t.e.r.=.s.q.l.,.j.a.v.a.,.i.n.c.,.t.m.p.l.,.c.g.i.,.P.L.,.p.m.,.s.h.,.i.n.c.,.r.x.t.,.j.s.,.h.t.m.l.,.h.t.m....././.E.x.R.u.n.=.D.:.\.T.O.O.L.S.\.E.d.i.t.o.r.\.o.e.d.i.t.\.o.e.d.i.t...e.x.e........././.H.T.M.L..0.0.0.0n0.}.k0i.W0_0.0.0.0.0.0|Ts0.QY0.O...././.F.i.l.t.e.r.=.h.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Script\Viewer.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1978
                                                      Entropy (8bit):4.251986082542406
                                                      Encrypted:false
                                                      SSDEEP:48:6kMUFah3OlwQ01IpArt6jyRmyFlMpqQgABg:pMWtqQX9+RmJpIcg
                                                      MD5:970F51A73B915C6AE4801E391F88A02B
                                                      SHA1:B6A58BE51DD2D6707C930B37EC262C6D4A1411C2
                                                      SHA-256:B4530E5F0617B02A693C98BEA8A511AA66A0445F1D06541CB17AB791A18F74FF
                                                      SHA-512:165836CC99AD6C218897E09E7D41ECDEB8C0415D2DD108C1C4D69A47683DE6859D23BE79F7CA9E270DE495DF8E60075BFD26EBABE7A4C959B381EC50ED7429B3
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0w..R(u.0.0.0.0.0.0.0.0.0...././..N.ik0..W0f0o0.0N.e.w.C.o.m.m.a.n.d...t.e.m.p.l.a.t.e..0.0.SgqO0`0U0D0...././. .S.t.a.r.t.u.p. .s.c.r.i.p.t. .f.i.l.e. .v.i.e.w.e.r. ....././. .S.p.e.c.i.f.i.c.a.t.i.o.n. .o.f. .t.h.e. .".N.e.w.C.o.m.m.a.n.d...t.e.m.p.l.a.t.e.". .P.l.e.a.s.e. .r.e.f.e.r. .t.o. .........C.o.m.m.a.n.d.L.i.n.e.O.p.t.i.o.n.=.?.S.e.l.F.i.l.e.?. .....M.u.l.t.i.C.o.m.m.a.n.d.M.o.d.e.=.0.....S.h.i.f.t.S.i.l.e.n.t.M.o.d.e.=.0.....B.o.o.t.D.i.r.=.....B.o.o.t.M.o.d.e.=.0.....O.p.e.n.M.o.d.e.=.0........././.;u.P.0.0.0.0.0...././.S.e.e.k.e.r...e.x.e.o0'Y.bn0.0.0.0.0L0..Q0.0n0g0rR.0S_f0f0D0~0Y0.0...././.;u.P.0.0.0.0o0.0c0h0o.D0.0n0L0.Q.Vc0f0J0.0~0Y0n0g0.0]0a0.0.0)R(uY0.0.N.0J0.R.0W0~0Y0.0....F.i.l.t.e.r.=.B.M.P.,.J.P.G.,.J.P.E.G.,.P.N.G.,.I.C.O.,.W.M.F.,.E.M.F.,.D.I.B.,.G.I.F.....E.x.R.u.n.=.%.V.i.e.w.e.r._.D.i.r.%.S.e.e.k.e.r...e.x.e........././.H.T.M.L..0.0.0.0.0....F.i.l.t.e.r.=.h.t.m.l.,.h.t.m.,.s.h.t.m.l.,.s.h.t.m.....E.x.R.u.n.=.%.V.i.e.w.e.r._.D.i.r.%.B.r.w.s...e.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Script\_ListNoSelClk.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):200
                                                      Entropy (8bit):4.536319779431185
                                                      Encrypted:false
                                                      SSDEEP:6:Q1UPQb5ClwnB7cpDbNEYazNFqvpbNEYalAoG:Q1UIdmg7EDpDiFyDuAV
                                                      MD5:441203C38671B88C1E0A4B82D266F6A9
                                                      SHA1:3FBFCD12C84AEA05F260D5900EE02A7909D6F53B
                                                      SHA-256:8F914565403906CB52708DCE148C85A84214657983CE30DB57F68269E09FF41D
                                                      SHA-512:9FCA876E41EEB6D2BF666173EDC2F47FD1E314D2A4D0E9CF46B6C02F55E1C2E56CCF3F6B902F0464C72C4F60E710542BC4D605F30ED87F00ADC99709BC8E3F57
                                                      Malicious:false
                                                      Preview:.././..0.0.0n0zz.k.0.0.0.0.0.0.0.0.0W0_0Bfk0|Ts0.QY0.0.0.0.0.......././..NMO..d\k0.y.R...././.P.o.s.t.M.e.s.s.a.g.e.=.3.6.2.0.0........././.hQf0x..b/..d.....P.o.s.t.M.e.s.s.a.g.e.=.5.7.6.4.2.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Script\_ListNoSelDblClk.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):198
                                                      Entropy (8bit):4.531415942597745
                                                      Encrypted:false
                                                      SSDEEP:6:Q1UxzQb5ClwnB7cpbbNEYazNFqZbNEYalAoG:Q1Uxkdmg7ENDiFCpDuAV
                                                      MD5:2A034C2FA03107892427DBCC67F70426
                                                      SHA1:CEC364333820853874BC5CC482AF796FFD07782E
                                                      SHA-256:BC1B4E9D574D4AC21A009B97DE2CD4D2770BED28B29DD7F8E3252363209FDD20
                                                      SHA-512:2857F5836E684C074CB91A9F212FBDDDE590B2DD1E0E71B18652B01DF3E306BB8202DE640516F5569510B1D3262BE55C52CD051606B5C5EF14EBE67B799F3AAD
                                                      Malicious:false
                                                      Preview:.././..0.0.0n0zz.k.0.0.0.0.0.0.0.0W0_0Bfk0|Ts0.QY0.0.0.0.0.......././..NMO..d\k0.y.R....P.o.s.t.M.e.s.s.a.g.e.=.3.6.2.0.0........././.hQf0x..b/..d....././.P.o.s.t.M.e.s.s.a.g.e.=.5.7.6.4.2.........

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Copy.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.1356774179462592
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jxR76JtJtt/z/z/z/zWUMGJtJtC686t6t6tktktktktktktktkVkVkVkVk/:e3jxVqtJttGUXJtJtC0t6t6td
                                                      MD5:6B4291309D532C06F567532EC9C2C827
                                                      SHA1:B24E9E7F9ABDD830500D89E78077A6F52F3CC349
                                                      SHA-256:A467E2E3B8BC8A0FCAC1EDC8AB03448F49B6C429D7165B28AD67BBF093C807D0
                                                      SHA-512:483660AA6DB5212FBB72DB7C27F4F0655268E3B4288F7C7993F92E445838789ADFB5F3AAC91E6148450C9E0B1180A3F8A55D6713622E75BD47F1AEFB7F97E9B1
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Cut.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.1061026888747587
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jsoY15p8i94WfIrSGINkkGAmlhqStJXYkt/kktm4AqowNiNibL/:e3jsoMkSDNtzmmSnXb+4AqowNiNi/
                                                      MD5:781F63671EC21F457DA5950A8AB92BC0
                                                      SHA1:2674F68DEA228E7CED34C70FFED92BD982C346C5
                                                      SHA-256:96840C98BE70969DD1F3BBDBA7DF1F8EA4EB6A8D5F13656922F46CB9CB1B7424
                                                      SHA-512:05B2B1B85DF68B4F028D3BED12DA1E37FCF82B6AD0A0FE67EB243FB246A31370ABD0A4662A47CBC0C8AB047966E49796B98863FA6932EA785FAFD09F003DB7DA
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Delete.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.5305332706875565
                                                      Encrypted:false
                                                      SSDEEP:12:e3MDlKjJpHQ5gGKFtJptqFYY3ge2lDe9n:dKjJdvTxhlDgn
                                                      MD5:CD2235B79C7E2FB1B18CAFD5669D6B1C
                                                      SHA1:8AD63BFD1A234440B0246084315FC095F5D699F0
                                                      SHA-256:7B57324B02E491DD0BE0FAA49E43EB74B479D99EE56A1CB5A1196258C963699A
                                                      SHA-512:08040A7D9086E7036AC488F665234F73F5A7D2258CC02E5155C5C8253090917B1393055CE8FC28D7FD345ADA617FDFE5031198E71D25440C43E282E8F54C8BD8
                                                      Malicious:false
                                                      Preview:..............h.......(....... ....................................&...3..*@..9M..GZ..dt..s.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Edit.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):0.8399733661025693
                                                      Encrypted:false
                                                      SSDEEP:3:/Ng/JFllvlNl/M8l9ltlTHRtXe/cS/tmPlZMCWtjjt/gRnkvll/Iq2lOl//5DlWr:ad91jCciCWtjjt4iIq2gR5D327n
                                                      MD5:E11CE0E33C279C7AE85088DC8CF0813C
                                                      SHA1:EF6053CB66E1DB8BD84FDB39A358907CE334CAEF
                                                      SHA-256:4F6693A66ACF5E3819397B6C0B017D4EBB174594876DA1070BD1AE7FBAA4E272
                                                      SHA-512:617EF52AA8B3328E2EF1A6BBC76AF42CEFB6167093A19A455A1FF89B362D1D2351B9D877961E3BD916A98F2400AFD5BF857C35DBE21EA310D5E9C6244DA77D53
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\FileNew.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.1315653763391018
                                                      Encrypted:false
                                                      SSDEEP:6:ad91j9Ega91WtoknvWae3mLUhoZ0vp0m8A5twn:e3j9Ega9qfnvC3mLGs0B0m1twn
                                                      MD5:F5395405FA09B661516AD698B17BF769
                                                      SHA1:EFEA08802FFFBADAE8C8112EF3480DBF56AD2F7F
                                                      SHA-256:DCA02FB259F33BEABA8956FD69BBE5DD862F7BD58D9393B568E46FF6B3094C2E
                                                      SHA-512:97E3331093D63D18E28682CE1272AB6AA081D722097AC0111DB3250FF1DC72B45E3353D57588D289A992A8A79D3D0C74B7833E9291D616CCEC847ACE7F84FA47
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.........................................................................!.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Icon Image L.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.5137506909569587
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2Xxey0uieMtezWkTk2HoWWR5MboW2dRuir4SWU///:e3iC2AyfxVakT/SjdR/r/r/X
                                                      MD5:E89ABF892FD9F4108002C3B9E5E76600
                                                      SHA1:3B6EE446D716CC0F1812F5234B7B2DCE2C754293
                                                      SHA-256:1B2FB0D1E4C0D9BF2034BE23603F08637A322B1ACD687EDD37B2F911B1BBC3B4
                                                      SHA-512:469C23023044ED0B62EA0E135BD5576855E1650DAFF1AFEB94C9E531DB224F2EE44217E20F2990B6E0C55E8FFB8E405412936C390A498C06B17DB21BA1ACB3A3
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Icon Image M.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4179040794848887
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2Xxey0uiezWkTk2HoWWR5MboW2diSWUttX5n:e3iC2AyfxakT/Sjd9rvpn
                                                      MD5:8CFDCB1C585A549E4B4FB1AAD63DA45D
                                                      SHA1:2DBD89F64D429D785E8571AF99149122BC978764
                                                      SHA-256:F63A1AD89E249A0989809423EC3D40CAA894A02094A7B5A786B36429C54B524F
                                                      SHA-512:6C2471DAC925AC0941B4183AD02EAFCC9D8CB1EA10FE3F7B9B871508ECCC728F01B4203C3721376E2DA2C795CC1447FC301F0C521287DA73B8023C5F2918A403
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Icon M.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4954723501562246
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxeWwhAZfWJTz1WTz1mTfuMOUD22hFM70lYot0E:e3iC2AWwhA6GgOSlt/
                                                      MD5:0FE063C7F2331E1EDB5869D6899596D3
                                                      SHA1:E3E39240775798A24EBB69005B71AC04E249B5FC
                                                      SHA-256:A5895C035A0D63C25E0F717EA150E3585AA8F71404CB7F52584B718A214540A4
                                                      SHA-512:E58A57EE9FE7079A1ED580075CE7B6DF6A5C082886C8C75AC1A17A73CC92DAE8B01B241F497463E9FB8DD7436EC445E4A47AFC1D9ED097C0FD7B9B5F8DCD58EC
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Menu.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.1441014583729603
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jCN8KJJ86qCn9q8t9A+n9mKt/9otBn9aebln:e3jCiKJJOeq8t9zmIe9aol
                                                      MD5:F54C55E7A89B8EBF5F6AD2DB566DA655
                                                      SHA1:C0ED9E0ADDFF6D89C622EF10C2AD5EF742C231BF
                                                      SHA-256:000372B7DAA7E2FF26831F7105292DCFCF1BA4ACC9EC5651251C981523B105E3
                                                      SHA-512:B83F05ED7918167106CDAF7D264EF893EEF7C52541DD7922801F95176F8519E5243FA337E17A907BC8D401C16CC6C4292701C91BAED5B13AEBF32B3A601E3519
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\MkDir.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.1962335065468312
                                                      Encrypted:false
                                                      SSDEEP:3:/Ng/JFllvlNl/M8l9ltlYauljRtnefzjjjjjjjlljnnnnHnnHnnHnnHnnHnnHLnW:ad91YZGkOXgLz2vZcWun
                                                      MD5:24F2CE3698ECF064093DF59FC410A163
                                                      SHA1:9DB07D78313C5845208E640C6DAC7CE3178A71A2
                                                      SHA-256:421E4E54CAFCCF09F8AB2E9B0D8CF67D6F552DDAF178295578C26036A7F5FE9D
                                                      SHA-512:DF4EE75E90B0AB430A9F56580D8839701B0D2B02D1ED6F53FB290A65A0C39E9104C9D532492D099E83567FE22D9DCC718EC5269182C5895A59340F88FFF10EDA
                                                      Malicious:false
                                                      Preview:..............h.......(....... ....................................}..z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Mode Contents.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4177856258658073
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxeyQni7i3Wni7i3Wni7i3Wni7i3W9z/N:e3iC2AySV
                                                      MD5:4D7737ACA5B822308A9471AEB2F47FC0
                                                      SHA1:6CEA8232DC35C5B783BA906BAEE25BF48A99AF61
                                                      SHA-256:8FEA0E6611417085E2A95CA6FBB7CEC5ABD7B77548B6F85AC1588D85F8F68625
                                                      SHA-512:E7A0C934B8D63C0BEDB3FCF587C3EE9A2A0CBD69B971028A151FCADDDE845445CDE888749525FBFFA4ADFCDDCCC132F22A04061E326A1807A501C1F105EB7519
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Mode Detail.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4025709007302753
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxeFuie2uieie2uieie2uieie2uiSWU:e3iC2AQxdxxdxxdxxd9r
                                                      MD5:D5A26CED9F4BBC3333B56E9D507FE135
                                                      SHA1:DFF1D7BB9BF7B8E0FDDC6A64D7E9EB377C503B14
                                                      SHA-256:4BC2966DC498113382DF3F15BF145E169D8FF671A165809F45A9A44A5332816E
                                                      SHA-512:E5D1C75B23961D1600747281E1B2E75D3F8702CEB58BEF03110102D44E4951441324B2481FB179753C3180599B54D788E530D87FA4D40F5F237205235C993092
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Mode Icon.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.2186855755217068
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2Xxey0aWWiWiWiWiWiWiWiWiW68GEj55tDz/55n:e3iC2Ay7tppppppppJ5tDr55n
                                                      MD5:1E0CB3BC280FA9AC9C099712CD006048
                                                      SHA1:507659D6FDA29A1299C2CF310429C638A03E51EB
                                                      SHA-256:2438A1351C1DAE0FE6EDCA819D68EB5718153C996DBAEC84AE9722EFDD840086
                                                      SHA-512:BC3560BC53779D56F5B7F4D7668DA02AB313277D3C1B38ECF94754EE3AB6FB8B1745DB7C389A40760CCCF8B39EA81A564A80B0F61DD276BD450AD9F568FA0D2C
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Mode Tile.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4159499543254501
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxeyQniHiHiHiHiLWniHiHiHiHiLW9z/N:e3iC2AyyV
                                                      MD5:E0899C17EC029A293A03E97B3EC4EC4E
                                                      SHA1:12B9F2EA7EF2B363DE3723894B7C4E950C851F93
                                                      SHA-256:14F4854507DCCBAA1BD183B724F05AD5ABA839AF951634BB0A1027B43D89C34E
                                                      SHA-512:1D6E3540A4892296E54C8C488F9E69FD510C96E12C1AECDAAD32D6CD05916412D3628A772ACB96B631138EEE01D86559FA7D2C611E86E91E1F54292720B08285
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Pack.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4361799995460387
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2Xxecgac1hhFx1hhFJeOjalWjalzRZNUUUUUUUUUUUUUo/:e3iC2ABa2ulWulzvNUUUUUUUUUUUUUo/
                                                      MD5:2C88DD98F58AA927BBDFF22DC7D6EEF1
                                                      SHA1:6C4748B5E451FBD1186B91E7EB28D173184F631B
                                                      SHA-256:05A3B5E910CF614AC9FD4310948CE7F15C90F2077F048428D2FF771F2F939632
                                                      SHA-512:92655F3AFFBB1AD5EBD8E82130EABA50CA1A5FAA2B87A2C7952E2683341B2DD998C49B94E2F0CA17C97C15A124515567B0F80226298EF7AB929A335975517054
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx.........................................O8.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Paste.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.095336667558701
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jnQ/n91/n91/n91/n91/n91WE3Tththt6obkOgUUoAQ:e3jnQVHHHHwE3Tththt6AkOgUUoAQ
                                                      MD5:D2F23F150ED8974B539F14BB384FAF8B
                                                      SHA1:A9F124775A1E2117F1352DC1D1AABEB234462752
                                                      SHA-256:F0FD98963D05A779EEEDF80D4BB151DD5989764A79D19DE7AC5783F01E97F204
                                                      SHA-512:2AF3E5C87F36457787CD5B8B97F94FBAF510346173C0986C2E3F9159D74666CF07C5AEC55713448760EA73F87A5CDD1B369DC9821DB4B9871760186E2E755A21
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Property.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.1653328267764533
                                                      Encrypted:false
                                                      SSDEEP:6:ad91tlc/U/fsdtllbqXSHlmtKJJFhj/G7hBdMkVkV0W:e3s/U/fsdX9qVwJJjj+fe
                                                      MD5:1700833BD9584B71662F4B6A6195F8B1
                                                      SHA1:FA5EBF729F135C12681A4BE1D0EEEAABA07DD1EF
                                                      SHA-256:5680BF683A28EFF63F0AE3A36085F72B6B8B89B35FFBFA491D63BA775760A29E
                                                      SHA-512:ACC19C4DF4E65E167F2C3C6E64E058A1FD5ACAEF218325B2B160417C3845132C1376D96B67BEC256FA174303A46FD7B816823F3122F93E8A89DC7D48826B33E2
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.YYY.ddd.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Refresh.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.0976236119384608
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jC4WuWQ6KRSXLlpqO7C8rq0WNW9l3tmUd/gymzdq2Ta/:e3jC4WuWxKgq4CiWNW95tmUlyzdq7/
                                                      MD5:AB7B1206F005C315B7B1F030F1389831
                                                      SHA1:400E24BF0366F1A6D2E277A72293971C91C987B5
                                                      SHA-256:0FADD3A35BA047602D3DF29E3CD1014661E2F20535EAC17E9A7030D9A7E77AF6
                                                      SHA-512:0A86937F2F5C2C86EB4A89D6EFD9214732CF5DC5BFA672DE40BFA82144AC627510FEB0C161873DE544A82055FB703E220361BC5BC086A831C5C94FDE447C8B70
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Rename.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):0.8857791091740479
                                                      Encrypted:false
                                                      SSDEEP:3:/Ng/JFllvlNl/M8l9ltlTHRtXe/a/A29T7k+Adsk+Adsk+Aunk+AA8ty8tZ/5AX0:ad91jCakty8tB5A0n
                                                      MD5:4B4344E0844882C74D7829EB56709A3B
                                                      SHA1:8992014DEB3EDC4260B184D3FE9DA3642EDCA9F3
                                                      SHA-256:C181D41625E37BF510330689C251413559115D586658FDF53A1A57FDFDF56E19
                                                      SHA-512:9C2B3FD247DD5903908EAB9884FAB63BE29B0A89B842CB4DB983CA6D471168C4D6695D3E92B34B54FDF9CDEB398A25FFB0E4176DDD692C20F699B15354724174
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\SelectAll.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.0185110452337114
                                                      Encrypted:false
                                                      SSDEEP:3:/Ng/JFllvlNl/M8l9ltlTHRtXe/4A6kWmmtDzkt9mtTTDkWLRmtKkVsmmm8nJmDW:ad91jC41Hmmtn4GFJmDMeAxS/k/ktif
                                                      MD5:DC76566A86ABCC0C9F53BFD41DC908D1
                                                      SHA1:CF2C8B8F598B71E7F8EE07BF56E9D87001B4285B
                                                      SHA-256:9C6923E0C2B223C0677342F444FD97C0A32DAEC07AC5230D5D04BC9FB8FEC1AC
                                                      SHA-512:91587485FF181ACE2A4FE7C9C20B2223BDE65C28C4D4635232CC24290A85710BB20DC32DE1536534711893605E435489116386494239E2C57F83BFE3AB129F45
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Sort Date.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.628235548189555
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxecgWKXIjiV/a/v+0DdariJCko42kplUqKt/E/ktmo/:e3iC2ABWSXqINne2Evo/
                                                      MD5:BE668FCE519CDB0A4060B42CB570065C
                                                      SHA1:7E8CF197BF9A5148940E0D761E23B40798FE34FA
                                                      SHA-256:4105A0629768D5409CCE288632FA87FA3A848C4F752CAF4B33FFF49E7AB83385
                                                      SHA-512:5F348E34E3827CE64386FA238FA4BF02D05413080DBD0184D382427BB0D0BC4261CF4FB6229A995BD9DDEDFCD97229555AF6ED5B606E402CEF70FFA6847DFA3A
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx.........................................O8.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Sort Name.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.5119525176680089
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxecgLiTmkaUyG/tR72DWHr6L9lj0P0JlUeovooo/:e3iC2ABmCSr2sRvooo/
                                                      MD5:5A87701A15EE4F22AB1D5251B2AAA20B
                                                      SHA1:01FA8F1B7B61EE86E5F10EC6C65604CEA089698E
                                                      SHA-256:80ED8FD8963C516B14B54CA49D226FBB96D482C3E5CEB891FB245DFDF240CCD3
                                                      SHA-512:D65840040EADB4C71B2F30249BED9509AACF009D52AE111684F59FCD428663789EBF83FBC992B2C496376AE3B7EADC005C67A1BD1D73ED5AC463842536C9C886
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx.........................................O8.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Undo.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.05946853998045
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jCJe5USCkOhWaQMW5zWVWDZQ8vQH9dqIRmoyktktktmQ:e3jCJe5gXWVMWlWVWDZTvQH9dqIRmo0Q
                                                      MD5:8B4920BA370D46D58AFF516C36DA4CF7
                                                      SHA1:1DBA603CD0275036CA5840362A20CD30B6839BA8
                                                      SHA-256:FBC2260320123D73C04183A5320FCB7766FD14B6EF1A0967C769A5D6629B6073
                                                      SHA-512:22F5B0DF50F15C87B66105754C50492107967609F06D02D755B0AFF9A6B09623D1BFD085CE0005B4C5B91D48D34719323431D17BB7AD2D0E5AF56C824CF79242
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Unpack.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.4328235613636149
                                                      Encrypted:false
                                                      SSDEEP:6:ad917yRtY2XxecgWkDDumWBn/DRM/yhi9FW2ssnxlAekUV/:e3iC2ABWFmWBn/D2YyFfsalAekUd
                                                      MD5:45828175F1FFBF78AE4D88A2353D58E4
                                                      SHA1:25D943D3765C95EB3AB6EB7F60A1711D7EE92041
                                                      SHA-256:4E2ED8184DBE00F0801182AE476CCA082CD8387B79F57837D3A2FB5602980E1E
                                                      SHA-512:519B29105773422AE0B4903FD1B0CCA7979141390A4EE8DD2F473CF92F6F3AC72F21723926DC1ED146C02016D23258D4E7277B7C657A82E52CCDCA39028082A1
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB.MMM.cbc.nmn.yxx.........................................O8.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\Icon\Viewer.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):1406
                                                      Entropy (8bit):1.115800553667765
                                                      Encrypted:false
                                                      SSDEEP:6:ad91jJT4tRNa7k+vmYvmKkNGBmvlt1GtSgA:e3jJEzNnCmomzGBkXwUv
                                                      MD5:C16FF3391C15E0E11CB4C1F03CCE454A
                                                      SHA1:0173D32B24F19EAA8489F6E57F54E6CDC10E8EB3
                                                      SHA-256:725FF3E5183F4A100ADDCF8243D5C298B6F1D32CB4CDAC883333EA241B8449B2
                                                      SHA-512:6255103D6C5D37D455BDCE664302E8759FE71CF6522AA9FCEBC26B54A0E72A74F6B9A73D311048DF0593B093B5EC8B4B5BA8D0D365CDD0F6B8D65AB9D48415C7
                                                      Malicious:false
                                                      Preview:..............h.......(....... ...................................BBB...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\EditorMode\Icon Image M

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):228
                                                      Entropy (8bit):4.085212046783786
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZhZAAMlEYazWlG4l+YoMztJ9a88:Qm5gPhzg+BHpN4ZhZclDHl3Lz1av
                                                      MD5:E1C7C7BF6D3668325C84C102D18DA6D8
                                                      SHA1:AFC7EE840F2C39BDB3DEC91CB2DDAD76FD4AE3E4
                                                      SHA-256:6D1BA09A3451164E2FAD754467352F105A2A0A6C162269C98853D86D29C6492B
                                                      SHA-512:186837EDF19F3229700EA75ED162C286B596C971CD8E454CEC4C8D89A3770E806D09ECCDD8B1959939488B671C852723A914FCD9730DA422AD7B28E16109C31A
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .I.m.a.g.e. .M...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.2.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..~.\;u.P..'Y..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\EditorMode\Icon M

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):216
                                                      Entropy (8bit):4.071480128340843
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZHAMlEYazWhv4l+YoM1jWnd8:Qm5gPhzg+BHpN4ZTlDHhwL19
                                                      MD5:72724A3B00AB7CAC782FF4460DE9F3F6
                                                      SHA1:939218C67E949AA92E6E24FA5B7C96DEC9EB138E
                                                      SHA-256:45F46AB66BDA2ABA5DB330F33345C8E9FF32A25F9AD8E4E193F05D6E884405BF
                                                      SHA-512:9E22433DE300A7835D2EC3B97654D27AD412D39ED83A50947620DE50031C4D66CC7F8FB6D13B2464B52A6FD2B4FBCB33DDC2E5E1CB64E8AD678CAF247F90730C
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .M...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.1.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0..-N..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\EditorMode\Mode Detail

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):220
                                                      Entropy (8bit):3.9674972225482494
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNHIc0AMlEYazWGwl+YoMWq088:Qm5gPhzg+BHpNHIrlDHGwL90v
                                                      MD5:470CE3D8E08C4A2243257441F549A441
                                                      SHA1:C53225DC51FA2235834AEC2B4D973E05E253E564
                                                      SHA-256:E70564FB80EC05C3BDE5483EE5FAF1C88BBF8A6CFB4CB09A2E193F8EB5EB3982
                                                      SHA-512:B2855AA5D9FAA004655539DD14920A9553A6EE45B2C493BBB594100990EE8F352BFD74C57684AB9A111C5523F1CF41CB541F8FB10EC0A44979539761BDA6B76D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .D.e.t.a.i.l...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.4.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.s.0}h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\EditorMode\Mode Tile

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):218
                                                      Entropy (8bit):4.000258030162403
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNkMPAMlEYazWIl+YoMsjX8:Qm5gPhzg+BHpNkAlDHILsQ
                                                      MD5:9B0F7CFDA9362A406A0A5FA331222E2C
                                                      SHA1:6C9B01E726773171535B99627774A682E8B93F5E
                                                      SHA-256:29C9E136914E43C695DEA18B9E91ED21AEB98712DE870292826ED705CD025CB5
                                                      SHA-512:66ED21F19481177B5B98B8B63E0F00F7F7BC1D649B57AE2A2DC307520BEF8F3568F865338FB44B2D7DA0E58F484128028925194AE291B9DC5AF29BFFF26C377D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .T.i.l.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ny0f0h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\EditorMode\Sort Date

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):222
                                                      Entropy (8bit):4.056513595257614
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNCAAAMlEYazIlQylql+YoMmGH8:Qm5gPhzg+BHpN4lDBlQylqLfc
                                                      MD5:8BD4E8C88DD6CA166B01128EA68FAD2B
                                                      SHA1:82066FF42B2858E5FE28C18BD5994351FB106B00
                                                      SHA-256:C3CB0F33AE769704BF6C782D0CF93BE78749394D02470252A8EADD70B92C850F
                                                      SHA-512:7431BD07065AC724DE0F9C09763DEF3B69306E59078B87DA05ECA9895B8CA118F571DE1DAFB3744E8B457E7E0F6A8DACA4E7089077EDE305328986A50AC3EE50
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.o.r.t. .D.a.t.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.4.0.9.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ns0...0.e.N..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\EditorMode\Sort Name

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):230
                                                      Entropy (8bit):4.130183863979898
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNYSaQPAMlEYazIlPl+YoMmuxgjW8:Qm5gPhzg+BHpN1aQrlDBlPL3x05
                                                      MD5:DD60965D3C3A3BABAF0898E2F975E1D7
                                                      SHA1:1859E447E49B935A310FB54A2993AC12268C53D8
                                                      SHA-256:D0B4E790D5D92E050E663C5E647D176F386A85607D1D4377288771AD79971159
                                                      SHA-512:BA467BD3326C8A45EE9F063E5A68AF4AB5F11FC3784B5877A0CC5AC30D4664951223CB5A624426550F70F22EE6ADD1A4EFAD3A84FDECAE9D5F5B1724DE38AAC9
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.o.r.t. .N.a.m.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.4.0.9.0.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ns0...0.TMR..(....).k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Copy

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):346
                                                      Entropy (8bit):4.1032013187902265
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopN5JcF25Ul+VCnpYoMwqEs2OvZ5oZAMlEYalBl+YoMKV8:Qm5gPhzg+BHpNs45Ul+mewqscHalDuBl
                                                      MD5:B0B08DEB53022E8D8A6E2FB5585FF151
                                                      SHA1:52A72BB912FBAA8FDBFDA0A6CE332EDC87880EF6
                                                      SHA-256:CC85FA3413448A18F57E8FEA27A7F8C748DDC4D7BE70C13CF787A8DFB7255140
                                                      SHA-512:D3F6C632F9B9BD2B945EA067C3CC2401AC7F54DC5FF102ECD50444745E236D48D531122F2A606313782348ED11A0AD2A1D31D3A1B4F063C9695880EB6C3902DA
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.C.o.p.y...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.5.7.6.3.4.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0.0.0k0.0.0.0W0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Cut

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):328
                                                      Entropy (8bit):3.9791988545751806
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNjXkK25Ul+VCnpYoMwqEs2OvZ5oZAMlEYalq2ql+YoMO:Qm5gPhzg+BHpNjw5Ul+mewqscHalDugi
                                                      MD5:832301F315A0E4CC75EEB4AE4F88BEBE
                                                      SHA1:79E0C5FE06EE52CEF55958B9B92519962770234F
                                                      SHA-256:599C47AAD89A3CED5C01CE74776187123BE53679297E9D3919C62066C6A7CD9B
                                                      SHA-512:C04432FC587E55779D363858A36BFAC71D920E4D2E4B10F90304B6A3A151669D980EBE13AF8BBFD4D9CF5135190321F01EB6124CE4EABA4D7990E70F57F05E63
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.C.u.t...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.5.7.6.3.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..R.0.S.0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Delete

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):346
                                                      Entropy (8bit):4.082883915543739
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNFRM25Ul+VCnpYoMwqEs2OvZ5oZAMlEYazw6l+YoMZTG:Qm5gPhzg+BHpNN5Ul+mewqscHalDOLnI
                                                      MD5:29BA148F5016A9AB0E3DAB6332031970
                                                      SHA1:1A479EFDA226F098E8E6DF17E0EBDA90A4500155
                                                      SHA-256:E761C99AD9378C3E912104EAF538B2DA55ADBCF824B31A27F9ED77BB45F714CD
                                                      SHA-512:364EC109696736443E25DD6835C0214AE9A3085CC4FB3FB9290F51C197FF4C0F93E78D3F9F895BDABC3E5EF2AACAB43460DCD46E1B6320B0F44589DF77F6113E
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.D.e.l.e.t.e...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.3.5.2.0.7.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.JRd..0.0.0.0.0zvL.W0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Edit

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):336
                                                      Entropy (8bit):3.975491657143344
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNNRRkK25Ul+VCnpYoMwqEs2OvZ5oZAMlEYadl+YoMHh1:Qm5gPhzg+BHpNO5Ul+mewqscHalDQLB1
                                                      MD5:963C03776641813CCF67A63A68A1D3EF
                                                      SHA1:BB227AD13CBEB90AD4CFDA217D29DB16F493BD0B
                                                      SHA-256:4C1FBBFEC62B39073F9CD7546BC4491C62C5E6C3470236E3E60732AEAFF26755
                                                      SHA-512:BA77C0C83417E5A1C96ADD990DCBF0E9FFC6F6D636275B2EBB17BB0ED235E1FF260A13DB9320A5A3A0D4BDE9C4DFB1DD5DEA7297E842AF83054E5AAAAFC35C5E
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.E.d.i.t...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.4.0.0.0.1.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0g0..M0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\FileNew

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):222
                                                      Entropy (8bit):4.1203400455281205
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNylrKQAMlEYazwO3l+YoMwfwLI:Qm5gPhzg+BHpNqKMlDq3LwYI
                                                      MD5:3AB0A0D5D3795A62CD8C5CB476FFAA3C
                                                      SHA1:7F0B021B3C8B4F0E5EC7F65B1DEA8922D7DD2875
                                                      SHA-256:BF20D5C84590AEC0A5341592075F6AB6665FC6E8AE3F0F9D696B9EE80F109736
                                                      SHA-512:3D2D2AA14ED55B9B0C358B39CEEE2CA01FB03912577DFEDC743E8C3788DA287967509FECFEC69956BAF80D0DDEA2BF6D4C064142F11586D5F2804766A111D20D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.F.i.l.e.N.e.w...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.5.2.1.4.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0\O.b.0.0.0.0.0.[L.W0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Menu

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):214
                                                      Entropy (8bit):4.014247242915339
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNGAAMlEYazi5l94l+YoMWEdqX:Qm5gPhzg+BHpNGclDd5wLPdqX
                                                      MD5:3D4AE51FAAA634EB9F6EFCD0193F266D
                                                      SHA1:792141B4B731403C0833B7B733FA2668695572BE
                                                      SHA-256:6586D176181C297A6E95F5BB03223B81E106E2FFF5F54F79864EBFB30600DF65
                                                      SHA-512:6D8E2C0662B8D856A86B6B2E9F29E0F8D3A68EB6D9E5B637FF1C9FDD34269E87B257A49CF139B288388A21D7C3A40BB1B5EB4AF806489BD477FB15014046F271
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.e.n.u...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.3.3.0.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0.0.0.0.0.0.0..M0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\MkDir

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):216
                                                      Entropy (8bit):4.137345343533784
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopN+aIAMlEYawl+YoMww1ywLI:Qm5gPhzg+BHpN+a0lDdLwwJI
                                                      MD5:E1E9F6EFC34435E605318E7DADB456C1
                                                      SHA1:C2DD251973822F39DC77C133EE28656E1E75694E
                                                      SHA-256:35561A7299776A0A6258A59E6EEDBB302830DA1D8375D27C1A68675BD3D350D4
                                                      SHA-512:5AFB4E1D8551D6BB8C9BB39622C348DE7EAB280AB0970FC9254863C96A4BD871DF8EB2F7105B34D768155210BFB1AD9CA83F53A701CE7E39B7A227750F206D67
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.k.D.i.r...i.c.o.....P.o.s.t.m.e.s.s.a.g.e.=.4.2.0.1.7.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0\O.b.0.0.0.0.0.[L.W0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Pack

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):338
                                                      Entropy (8bit):4.087111538525615
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNUqB25Ul+VCnpYoMwqEs2OvZ5oZAMlEYaJl+YoMCdXYN:Qm5gPhzg+BHpNUq85Ul+mewqscHalDEN
                                                      MD5:71E7104A9D0D0C400BF0189F920C7FAB
                                                      SHA1:06A560D273EA5F5678CA55DD5539B6BEC93B70F2
                                                      SHA-256:CE11A4D5EBC81A58A2495B1CE5542F250B3BAF4DD219C789B10B5B9D709F0383
                                                      SHA-512:63706FB4A933E18FF7D91B1EFEF36C180803FE5CFBF1AED38A45C8029AE5CC2B8E15F2831F327E9D547C518580585C0BA2A528EE8AC085340816117657638525
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.P.a.c.k...i.c.o.....i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.4.2.0.0.7.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.'W.~.0.0.0.0.0w..RW0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Paste

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):194
                                                      Entropy (8bit):3.80640718902998
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNWAMlEYalodl+YoMxN:Qm5gPhzg+BHpNalDuodL7
                                                      MD5:6E0C281327176F1117AB2B59E089FB79
                                                      SHA1:7E208FBFF3B2624B6828182A241AC87143E04ED4
                                                      SHA-256:BE385364F5247F185C1A07182F76093296B05A9AD361B92D003DC534657AE5E7
                                                      SHA-512:54F8B96FDE36DEB014C4E5B1913FDC600A433A3E362FC3ADD33EA8787DA9A32CD0300BABC3B3EBA9E37724D59DFBDA83AF5E09D7CE991EA9A24C7FB636BD145D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.P.a.s.t.e...i.c.o.....P.o.s.t.m.e.s.s.a.g.e.=.5.7.6.3.7.....T.a.b.l.e.t.B.a.r.T.e.x.t.=....0.NQ0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Property

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):360
                                                      Entropy (8bit):4.1723869521810295
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNI3RPF25Ul+VCnpYoMwqEs2OvZ5oZAMlEYazwql94l+G:Qm5gPhzg+BHpNIhP45Ul+mewqscHalDH
                                                      MD5:28D33D21BDA2430FFFFA5C8F198E8C4F
                                                      SHA1:3D3F6F01E4FAE7B72248EF8AFEB821729B83E1B4
                                                      SHA-256:2A7EE3199CFFCE5D8DA6E509D2A65C621AF2B8D65A41D16D53ED14D664452B72
                                                      SHA-512:A6A84E3B268376DB34F86395591903285ABFABD9F7A981927DA3F40A8BA0EE89662BB9A4B272BC59AC7FACBFF688524B5CE545AD17C3CD8010AC8850658FF096
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.P.r.o.p.e.r.t.y...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.3.5.2.0.8.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0h.:y.0.0.0.0.0.[L.W0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Refresh

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):200
                                                      Entropy (8bit):3.698437065800665
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNqlUJ1AMlEYazitl+YoMlbbVtI:Qm5gPhzg+BHpNbflDdtLlbb3I
                                                      MD5:B7C2DE7CE8F4384A4920D323C7B19A43
                                                      SHA1:66E51DAE49CF31284016EDC6DF437C8926806FED
                                                      SHA-256:4EEA6892FF8A8C24AA82A623D3599BE8F9A53EC7E316133AA471F9BD496E2A7D
                                                      SHA-512:BD0B40E5B057966C14F7A517E8ED5A997A17D02F8A58ECFBCB92F3F9C421EDED9F2CE79F3A4F53EA328DDA661868B87F8FDFA5689EE5106385856F1295E00385
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.R.e.f.r.e.s.h...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.3.3.0.1.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..f.eW0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Rename

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):350
                                                      Entropy (8bit):4.087247297564082
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNqlFc25Ul+VCnpYoMwqEs2OvZ5oZAMlEYaA4l+YoMtcb:Qm5gPhzg+BHpNCx5Ul+mewqscHalD4L6
                                                      MD5:8180B97FA23A5D43B898BA994A7919C6
                                                      SHA1:4F1574E7A4A4293F01900D72822DE46BC090B34C
                                                      SHA-256:5A510FF049CB2AE6BF8387DAEA723D3D4CB1EA7CD168C944EAF65903A985440D
                                                      SHA-512:729A462B40E159B1AA910C8E01DE47B460B9653739EC4C82CB53F3CC9BB7315A00C43BD99B32FDD36C57A67729FAE5B88182C2284BFE32FD911B0470FF851AAE
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.R.e.n.a.m.e...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....P.o.s.t.m.e.s.s.a.g.e.=.4.2.0.1.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0.0.0.0.0w..RW0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\SelectAll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):218
                                                      Entropy (8bit):4.079338882713915
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNKtzAMlEYalAo4l+YoMsLQaTa6I:Qm5gPhzg+BHpNKNlDuAtLsLQam/
                                                      MD5:A3A7274D155632FA952C6DBE905B5BE8
                                                      SHA1:5BB8A1616D64CD0CCD1ACAE34BAE14F99F122F36
                                                      SHA-256:050711975E5E1AAF8FD6DB2F1319CED6AC31B01865FF3F44AFB144759E36DA2D
                                                      SHA-512:61C787AC3CDFDED9A77F8754F6D44634A151EA3CBF0D5B2B9AA5455D73A7F00B0526C3C9D20CBA43C3A91FDC8E807B4AA2E1879C6CD814600A0A4E2CE9E45E6F
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.e.l.e.c.t.A.l.l...i.c.o.....P.o.s.t.m.e.s.s.a.g.e.=.5.7.6.4.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.hQf0n0x..b.R.0.fH0.0L.D0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Undo

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):212
                                                      Entropy (8bit):4.0631096156961615
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopN6GlRP0AMlEYalAMl+YoMmuiLI:Qm5gPhzg+BHpN6yZIlDuAMLpOI
                                                      MD5:3B4CCBB5C66C8E6210328C94621ED64E
                                                      SHA1:E57420360F991F91B2548766B1D55D79AA264828
                                                      SHA-256:FFBFAF5B9896BE0E698929445E7A2CE44C48E78131A50165D0C98FD1CD39E992
                                                      SHA-512:D0FAACF50827844CDABDDF5363C36906FDB39A6EB6338ACFF10945F1A7105A3E62DFCAF6C3B9FA4BFCEDCD1627CEE1D6A1B0B85BA43C3797B33EA68F3A6A6A41
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.U.n.d.o...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.5.7.6.4.3.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.CQk0;bY0.0.0.0.0.0.[L.W0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Unpack

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):738
                                                      Entropy (8bit):3.970721112151594
                                                      Encrypted:false
                                                      SSDEEP:12:Qm5gPhzg+BHpN681qx5Ul+mewqscHOblcUx/s7Xs9cn7YJKlcUmNmw9vlcUYCUlA:Qm5gZRD60qPUImefs3cUxY/7hcUmN1Xt
                                                      MD5:0E1C82AB0B5816DB4ABDAAAAD0E6C4BE
                                                      SHA1:BC8D4E096629081C190EA03DC14AFADD277AB46A
                                                      SHA-256:2A980D0052616DE4D394952D2D967403287A89D49DED2C18AACBDDE7E3527AC9
                                                      SHA-512:58DC8F7D3149DDA95B4B0666A6559B83E7488C4E50BF8A83765C9100111AFAAC0BC4AD101E7B9DFB3C41A0061AFCEE12EF80B282F7901B2FE98B9A545E765EBC
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.U.n.p.a.c.k...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....v.a.r. .$.I.s.F.i.l.e.$.....v.a.r. .$.C.o.u.t.e.r.$. .=. .0.....f.o.r.......$.I.s.F.i.l.e.$. .=. .I.s.F.i.l.e.,.?.s.e.l.f.i.l.e.?.......i.f. .$.I.s.F.i.l.e.$. .=.=. .1.........$.C.o.u.t.e.r.$. .=. .+. .1.......e.n.d.i.f.....n.e.x.t.....i.f. .$.C.o.u.t.e.r.$. .=.=. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?.......P.o.s.t.m.e.s.s.a.g.e.=.4.2.0.0.8.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.U\...0.0.0.0.0w..RW0~0W0_0....e.l.s.e.......T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0L0x..bU0.0f0D0~0Y0....e.n.d.i.f.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Viewer

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):736
                                                      Entropy (8bit):3.9281321791318597
                                                      Encrypted:false
                                                      SSDEEP:12:Qm5gPhzg+BHpN3U5Ul+mewqscHOblcUx/s7Xs9cn7YJKlcUmNmw9vlcUYCUl+Kp/:Qm5gZRD2UImefs3cUxY/7hcUmN1XcUri
                                                      MD5:E0BCEB21593CC458BA1F2CA3A4E7EA8C
                                                      SHA1:AA2AFCF9CEA4A8347044C035EDCC63C4164724E5
                                                      SHA-256:EACBCBA4BA48F0A60C09858F1D3764338F8922FB9B8C3E0EA2C4824A5A24975C
                                                      SHA-512:FEE90B2291CF324125CAFEEFD99C26F7E5BF6975BF1E702E641F39C23405BE579C69534569296518E6F84D056CB2B7FF7F9ACF0122FBFF653EBC69D0DD45BC95
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.V.i.e.w.e.r...i.c.o.........i.f. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?. .=.=. .0.......T.a.b.l.e.t.B.a.r.T.e.x.t.=.UO.0x..bU0.0f0D0~0[0.0......e.x.i.t.....e.n.d.i.f.....v.a.r. .$.I.s.F.i.l.e.$.....v.a.r. .$.C.o.u.t.e.r.$. .=. .0.....f.o.r.......$.I.s.F.i.l.e.$. .=. .I.s.F.i.l.e.,.?.s.e.l.f.i.l.e.?.......i.f. .$.I.s.F.i.l.e.$. .=.=. .1.........$.C.o.u.t.e.r.$. .=. .+. .1.......e.n.d.i.f.....n.e.x.t.....i.f. .$.C.o.u.t.e.r.$. .=.=. .?.S.e.l.e.c.t.e.d.C.o.u.n.t.?.......P.o.s.t.m.e.s.s.a.g.e.=.4.0.0.0.3.......T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0.0w..RW0~0W0_0....e.l.s.e.......T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0L0x..bU0.0f0D0~0Y0....e.n.d.i.f.....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Icon Image L

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):230
                                                      Entropy (8bit):4.1167256005505255
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZh3AMlEYazWmywl+YoMztEvd8:Qm5gPhzg+BHpN4ZhjlDHmdLzF
                                                      MD5:C7FC6EB274B5028DAA03397CF67EA94E
                                                      SHA1:F2347269074756D891076B25B278279CECEC0784
                                                      SHA-256:E664CED7A07FABDFFDD2F0B5599DEBCFC75DC50445030F06BA6BE81CCE732F98
                                                      SHA-512:2A630C7D4327318A5FEC5185409C4812341656FA15DC7C269313A6E7F968A48D564A18CA270C5A91A9A025CDFA08B795B365941FD6783FA6EE53B86F74F64DD2
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .I.m.a.g.e. .L...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.2.3.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..~.\;u.P..yr'Y..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Icon Image M

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):228
                                                      Entropy (8bit):4.085212046783786
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZhZAAMlEYazWlG4l+YoMztJ9a88:Qm5gPhzg+BHpN4ZhZclDHl3Lz1av
                                                      MD5:E1C7C7BF6D3668325C84C102D18DA6D8
                                                      SHA1:AFC7EE840F2C39BDB3DEC91CB2DDAD76FD4AE3E4
                                                      SHA-256:6D1BA09A3451164E2FAD754467352F105A2A0A6C162269C98853D86D29C6492B
                                                      SHA-512:186837EDF19F3229700EA75ED162C286B596C971CD8E454CEC4C8D89A3770E806D09ECCDD8B1959939488B671C852723A914FCD9730DA422AD7B28E16109C31A
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .I.m.a.g.e. .M...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.2.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..~.\;u.P..'Y..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Icon M

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):216
                                                      Entropy (8bit):4.071480128340843
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZHAMlEYazWhv4l+YoM1jWnd8:Qm5gPhzg+BHpN4ZTlDHhwL19
                                                      MD5:72724A3B00AB7CAC782FF4460DE9F3F6
                                                      SHA1:939218C67E949AA92E6E24FA5B7C96DEC9EB138E
                                                      SHA-256:45F46AB66BDA2ABA5DB330F33345C8E9FF32A25F9AD8E4E193F05D6E884405BF
                                                      SHA-512:9E22433DE300A7835D2EC3B97654D27AD412D39ED83A50947620DE50031C4D66CC7F8FB6D13B2464B52A6FD2B4FBCB33DDC2E5E1CB64E8AD678CAF247F90730C
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .M...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.1.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0..-N..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Mode Contents

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):232
                                                      Entropy (8bit):4.004891981118755
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNVuJDcAMlEYazWLl+YoMWEKjH8:Qm5gPhzg+BHpNVuSlDHLLPKo
                                                      MD5:B1FE0D40B315B1ED0CDFB1FA07F16AC2
                                                      SHA1:404DCBA87304E66F29335F2BA4ED13E8CAFF88B8
                                                      SHA-256:5303DC7E9BAD6B832B395B1FFA25572041EAB8B449DC927CC8C22004EB7F959D
                                                      SHA-512:3180CEF162B97351E57DB571FBED41E250CD2132DFC80D001F77DB28CF17D65F773CB7015359E88CC2277D4122E1413D08CF02CFBAF1FC41C5A1518331DB4669
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .C.o.n.t.e.n.t.s...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.6.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0.0.0.0k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Mode Detail

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):220
                                                      Entropy (8bit):3.9674972225482494
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNHIc0AMlEYazWGwl+YoMWq088:Qm5gPhzg+BHpNHIrlDHGwL90v
                                                      MD5:470CE3D8E08C4A2243257441F549A441
                                                      SHA1:C53225DC51FA2235834AEC2B4D973E05E253E564
                                                      SHA-256:E70564FB80EC05C3BDE5483EE5FAF1C88BBF8A6CFB4CB09A2E193F8EB5EB3982
                                                      SHA-512:B2855AA5D9FAA004655539DD14920A9553A6EE45B2C493BBB594100990EE8F352BFD74C57684AB9A111C5523F1CF41CB541F8FB10EC0A44979539761BDA6B76D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .D.e.t.a.i.l...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.4.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.s.0}h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Mode Icon

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):220
                                                      Entropy (8bit):4.001207464819435
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNfpXMlG0AMlEYazWtl+YoM1jW48:Qm5gPhzg+BHpNBclxlDHtL1g
                                                      MD5:F62B03B8CA91C7F95AF44511EEA923E5
                                                      SHA1:E51864651A302B3BC15ED28A62120560D914385C
                                                      SHA-256:D74C7195E2E9A9030DD41AA5AF1A669C94555F7BC7B72109BCAA98B673164AAE
                                                      SHA-512:C14238F65E0A2130DC428F3F01781C127E97702F6F2957BAEC38BF598EB6E8F86222EFC0BB43D858189EDC112AAA6BBAAE307D410E72CA59A071003F38F95F50
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .I.c.o.n...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.0.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Mode Tile

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):218
                                                      Entropy (8bit):4.000258030162403
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNkMPAMlEYazWIl+YoMsjX8:Qm5gPhzg+BHpNkAlDHILsQ
                                                      MD5:9B0F7CFDA9362A406A0A5FA331222E2C
                                                      SHA1:6C9B01E726773171535B99627774A682E8B93F5E
                                                      SHA-256:29C9E136914E43C695DEA18B9E91ED21AEB98712DE870292826ED705CD025CB5
                                                      SHA-512:66ED21F19481177B5B98B8B63E0F00F7F7BC1D649B57AE2A2DC307520BEF8F3568F865338FB44B2D7DA0E58F484128028925194AE291B9DC5AF29BFFF26C377D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .T.i.l.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ny0f0h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Sort Date

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):222
                                                      Entropy (8bit):4.056513595257614
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNCAAAMlEYazIlQylql+YoMmGH8:Qm5gPhzg+BHpN4lDBlQylqLfc
                                                      MD5:8BD4E8C88DD6CA166B01128EA68FAD2B
                                                      SHA1:82066FF42B2858E5FE28C18BD5994351FB106B00
                                                      SHA-256:C3CB0F33AE769704BF6C782D0CF93BE78749394D02470252A8EADD70B92C850F
                                                      SHA-512:7431BD07065AC724DE0F9C09763DEF3B69306E59078B87DA05ECA9895B8CA118F571DE1DAFB3744E8B457E7E0F6A8DACA4E7089077EDE305328986A50AC3EE50
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.o.r.t. .D.a.t.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.4.0.9.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ns0...0.e.N..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ShellMode\Sort Name

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):230
                                                      Entropy (8bit):4.130183863979898
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNYSaQPAMlEYazIlPl+YoMmuxgjW8:Qm5gPhzg+BHpN1aQrlDBlPL3x05
                                                      MD5:DD60965D3C3A3BABAF0898E2F975E1D7
                                                      SHA1:1859E447E49B935A310FB54A2993AC12268C53D8
                                                      SHA-256:D0B4E790D5D92E050E663C5E647D176F386A85607D1D4377288771AD79971159
                                                      SHA-512:BA467BD3326C8A45EE9F063E5A68AF4AB5F11FC3784B5877A0CC5AC30D4664951223CB5A624426550F70F22EE6ADD1A4EFAD3A84FDECAE9D5F5B1724DE38AAC9
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.o.r.t. .N.a.m.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.4.0.9.0.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ns0...0.TMR..(....).k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\Icon Image L

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):230
                                                      Entropy (8bit):4.1167256005505255
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZh3AMlEYazWmywl+YoMztEvd8:Qm5gPhzg+BHpN4ZhjlDHmdLzF
                                                      MD5:C7FC6EB274B5028DAA03397CF67EA94E
                                                      SHA1:F2347269074756D891076B25B278279CECEC0784
                                                      SHA-256:E664CED7A07FABDFFDD2F0B5599DEBCFC75DC50445030F06BA6BE81CCE732F98
                                                      SHA-512:2A630C7D4327318A5FEC5185409C4812341656FA15DC7C269313A6E7F968A48D564A18CA270C5A91A9A025CDFA08B795B365941FD6783FA6EE53B86F74F64DD2
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .I.m.a.g.e. .L...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.2.3.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..~.\;u.P..yr'Y..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\Icon Image M

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):228
                                                      Entropy (8bit):4.085212046783786
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZhZAAMlEYazWlG4l+YoMztJ9a88:Qm5gPhzg+BHpN4ZhZclDHl3Lz1av
                                                      MD5:E1C7C7BF6D3668325C84C102D18DA6D8
                                                      SHA1:AFC7EE840F2C39BDB3DEC91CB2DDAD76FD4AE3E4
                                                      SHA-256:6D1BA09A3451164E2FAD754467352F105A2A0A6C162269C98853D86D29C6492B
                                                      SHA-512:186837EDF19F3229700EA75ED162C286B596C971CD8E454CEC4C8D89A3770E806D09ECCDD8B1959939488B671C852723A914FCD9730DA422AD7B28E16109C31A
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .I.m.a.g.e. .M...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.2.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..~.\;u.P..'Y..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\Icon M

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):216
                                                      Entropy (8bit):4.071480128340843
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNvwZHAMlEYazWhv4l+YoM1jWnd8:Qm5gPhzg+BHpN4ZTlDHhwL19
                                                      MD5:72724A3B00AB7CAC782FF4460DE9F3F6
                                                      SHA1:939218C67E949AA92E6E24FA5B7C96DEC9EB138E
                                                      SHA-256:45F46AB66BDA2ABA5DB330F33345C8E9FF32A25F9AD8E4E193F05D6E884405BF
                                                      SHA-512:9E22433DE300A7835D2EC3B97654D27AD412D39ED83A50947620DE50031C4D66CC7F8FB6D13B2464B52A6FD2B4FBCB33DDC2E5E1CB64E8AD678CAF247F90730C
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.I.c.o.n. .M...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.1.2.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0..-N..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\Mode Contents

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):232
                                                      Entropy (8bit):4.004891981118755
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNVuJDcAMlEYazWLl+YoMWEKjH8:Qm5gPhzg+BHpNVuSlDHLLPKo
                                                      MD5:B1FE0D40B315B1ED0CDFB1FA07F16AC2
                                                      SHA1:404DCBA87304E66F29335F2BA4ED13E8CAFF88B8
                                                      SHA-256:5303DC7E9BAD6B832B395B1FFA25572041EAB8B449DC927CC8C22004EB7F959D
                                                      SHA-512:3180CEF162B97351E57DB571FBED41E250CD2132DFC80D001F77DB28CF17D65F773CB7015359E88CC2277D4122E1413D08CF02CFBAF1FC41C5A1518331DB4669
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .C.o.n.t.e.n.t.s...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.6.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0.0.0.0.0k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\Mode Icon

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):220
                                                      Entropy (8bit):4.001207464819435
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNfpXMlG0AMlEYazWtl+YoM1jW48:Qm5gPhzg+BHpNBclxlDHtL1g
                                                      MD5:F62B03B8CA91C7F95AF44511EEA923E5
                                                      SHA1:E51864651A302B3BC15ED28A62120560D914385C
                                                      SHA-256:D74C7195E2E9A9030DD41AA5AF1A669C94555F7BC7B72109BCAA98B673164AAE
                                                      SHA-512:C14238F65E0A2130DC428F3F01781C127E97702F6F2957BAEC38BF598EB6E8F86222EFC0BB43D858189EDC112AAA6BBAAE307D410E72CA59A071003F38F95F50
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .I.c.o.n...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.0.....T.a.b.l.e.t.B.a.r.T.e.x.t.=..0.0.0.0h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\Mode Tile

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):218
                                                      Entropy (8bit):4.000258030162403
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNkMPAMlEYazWIl+YoMsjX8:Qm5gPhzg+BHpNkAlDHILsQ
                                                      MD5:9B0F7CFDA9362A406A0A5FA331222E2C
                                                      SHA1:6C9B01E726773171535B99627774A682E8B93F5E
                                                      SHA-256:29C9E136914E43C695DEA18B9E91ED21AEB98712DE870292826ED705CD025CB5
                                                      SHA-512:66ED21F19481177B5B98B8B63E0F00F7F7BC1D649B57AE2A2DC307520BEF8F3568F865338FB44B2D7DA0E58F484128028925194AE291B9DC5AF29BFFF26C377D
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.M.o.d.e. .T.i.l.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.2.9.0.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ny0f0h.:yk0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\sort Date

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):222
                                                      Entropy (8bit):4.056513595257614
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNCAAAMlEYazIlQylql+YoMmGH8:Qm5gPhzg+BHpN4lDBlQylqLfc
                                                      MD5:8BD4E8C88DD6CA166B01128EA68FAD2B
                                                      SHA1:82066FF42B2858E5FE28C18BD5994351FB106B00
                                                      SHA-256:C3CB0F33AE769704BF6C782D0CF93BE78749394D02470252A8EADD70B92C850F
                                                      SHA-512:7431BD07065AC724DE0F9C09763DEF3B69306E59078B87DA05ECA9895B8CA118F571DE1DAFB3744E8B457E7E0F6A8DACA4E7089077EDE305328986A50AC3EE50
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.o.r.t. .D.a.t.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.4.0.9.5.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ns0...0.e.N..k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\ViewerMode\sort Name

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):230
                                                      Entropy (8bit):4.130183863979898
                                                      Encrypted:false
                                                      SSDEEP:6:QmKcUoOSShzg+av6AvopNYSaQPAMlEYazIlPl+YoMmuxgjW8:Qm5gPhzg+BHpN1aQrlDBlPL3x05
                                                      MD5:DD60965D3C3A3BABAF0898E2F975E1D7
                                                      SHA1:1859E447E49B935A310FB54A2993AC12268C53D8
                                                      SHA-256:D0B4E790D5D92E050E663C5E647D176F386A85607D1D4377288771AD79971159
                                                      SHA-512:BA467BD3326C8A45EE9F063E5A68AF4AB5F11FC3784B5877A0CC5AC30D4664951223CB5A624426550F70F22EE6ADD1A4EFAD3A84FDECAE9D5F5B1724DE38AAC9
                                                      Malicious:false
                                                      Preview:..C.h.e.c.k.G.r.a.m.m.a.r.=.1.....I.c.o.n.=.%.U.s.e.r._.d.i.r.%.T.a.b.l.e.t.\.I.c.o.n.\.S.o.r.t. .N.a.m.e...i.c.o.........P.o.s.t.m.e.s.s.a.g.e.=.3.4.0.9.0.....T.a.b.l.e.t.B.a.r.T.e.x.t.=.&Ns0...0.TMR..(....).k0.R.0.fH0~0W0_0....

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\_ChangeDesktopMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):4104
                                                      Entropy (8bit):4.639065246141864
                                                      Encrypted:false
                                                      SSDEEP:48:C6W+9euU5FVYPFO9ziBwKPZwhEwyzwAwzDwzewziwzTXoDXZ8FNqcocrNkH2LNP4:bjBUCFO9ziWKGhxy8tgb3KMkWh4
                                                      MD5:C6BF6A22D3892CEC9E0B113FEB546A0D
                                                      SHA1:DBE2FED27054E0149ED9D84511AF6B7695A7F6A0
                                                      SHA-256:1ECA5B6A915E73524B5889446BDF75399F158D68E23F70758342C7A714FF46E6
                                                      SHA-512:C23AEFEFEAE3644CD981EC4F05D4FE6297A6474C37AC679B128C533A8AA261C750B782F1EE07D925B335FB36141EE30DA41D53DD7A9675AACD03F6170C9C4C13
                                                      Malicious:false
                                                      Preview:.././..%L0....U0.0f0D0.0L.o0.0-..[n0B0.04X@b.0:yW0f0D0~0Y0.......././..e.l.0.0.0.0.0.S.[k0L.F0....C.h.e.c.k.G.r.a.m.m.a.r.=.1............././.._..j0.0.g.Rk0W0f0O0`0U0D0...././..0.0.0.0.0/e.c.0.0L0h.:yU0.0f0D0.0p0.mY0...././.i.f. .?.S.t.a.t.e.:.T.a.b.l.e.t.A.s.s.i.s.t.B.a.r.?. .=.=. .1....././...P.o.s.t.m.e.s.s.a.g.e. .=. .4.1.0....././.e.n.d.i.f........./././././././././././././././././././././././././././././././././././././....././.qQ...d\O..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!hQSO.!qQ...d\O...././..0.0.0.0...Y.01..SY0.0:.O.N.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.C.a.n.D.r.a.g.,.1........././..W.0...0HQ.}.n0.0.0.0.0.01..SY0.0:.O.N.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.I.n.p.l.a.c.e.R.e.n.a.m.e.,.1............./././././././././././././././././././././././././././././././././././././....././..0.0.0.0.0.0.0-..[..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\_ChangeTabletMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3736
                                                      Entropy (8bit):4.922633496751184
                                                      Encrypted:false
                                                      SSDEEP:48:7WmjpHWBHIxJqLi7SoYPcEwuabV2LHn+CsX066EQF:7tpgpnmYTUxi
                                                      MD5:D9C72EF5F289D34F1A18BA521AEFD21E
                                                      SHA1:2A975217AB33803C8DA85FA94FC70F89DC0D3A96
                                                      SHA-256:7A38DDE08641555250DE73CC17D8A1D6550BD636368E209276E7A85F341BDCBA
                                                      SHA-512:1AC42229247CCE2E27E01DF0055AB927F083677E16B89726BBB09E95393DB0E11D90DDA7F9B2303BCA7386FB4BC02491A76045C2F9F0F7475CF22FE4046A2CB2
                                                      Malicious:false
                                                      Preview:.././..e.l.0.0.0.0.0.S.[k0L.F0....C.h.e.c.k.G.r.a.m.m.a.r.=.1............././..x...0.0.0.0.0.0h.:yU0[0j0D0.0F0k0Y0.0k0o0.0.N.Nn0.x...0.0.0.0.0n06R._.0.0.0.0.0.e.0.mY0K0.0HQ-.k0/./..0.NQ0f0.0.0.0.0k0W0f0O0`0U0D0.0...././..f.0K0k0.Qw.j0....g0Y0L0.0.x...0.0.0.0.0.0...0.p0W0f0...d\O.0W0_0.0h0D0F0.[..k0B0c0_0.0.0.0.0x0n0.[V{g0Y0.0...././...pen0-..[.0~0h0.0f0.Y.fY0.0h0D0F0n0o0.0.N.iL0.0.0.0.0k0j0c0f0D0.0h0o0D0H0.mqNY0.0.S..'`n0.D0.R\Oj0n0g0.0T0.N.bO0`0U0D0.0................/././././././././././././././././././././././././././././././././././././..x...0.0.0.0.0n0.0.0.0.0.0o0S0S0K0.0/././././././././././././././././././././././././././././././././././././.....v.a.r. .$.m.s.g.$........././..0.0.0.0.0o0D0/.D0D0H0.0.0.0.0.0.0.0.0.0D0D0H0.0.0.0.0.0.0;u.P.0.0...0k0W0_0.0.0.0.0.0.0.0.0.0....$.m.s.g.$. .=. .M.e.s.s.a.g.e.B.o.x.,.0.x.0.1.2.4.,..0.0.0.0.0g0.OD0.0Y0O0Y0.0_0.0n0-..[.0.0.0.0i.(uW0~0Y0K0.....0.0.0.0.0.z+g.0.`.[W0_0.chY-..[k0.N.fM0W0~0Y0.0-..[n0.0.0.0.0.0.0_j..j0i0g0.s(Wn0-..[n0.0.0.0.0.0

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\_EditorMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3952
                                                      Entropy (8bit):4.6405312506922884
                                                      Encrypted:false
                                                      SSDEEP:48:C6WfYUrY/UHFaPZO9ziwwrZwhEwyzwpwzJkwzKJwzRTwz8XoDXcFNqSocrNrLiKk:bcuUwZO9zi9yhxy8O9Reulc9GrLitu+
                                                      MD5:AD104DEEFE28AAFA1A5590A74F51E6CF
                                                      SHA1:62F2E94F003D5931B1696332B1174837E59A189A
                                                      SHA-256:246F3355FCD518E1E885E9FBA0F1AF48775FBCEBC7F8D1B33C7959E9AB683485
                                                      SHA-512:3A74C739A1BCC9800052AA890BFEC92AF12EBB918402178FA1EE8C355B4E8AF938681CCC16A8A6012A3CEBF1F3A85ECF17D5923E7E111AC19506897465F71B70
                                                      Malicious:false
                                                      Preview:.././..%L0....U0.0f0D0.0L.o0.0-..[n0B0.04X@b.0:yW0f0D0~0Y0.......././..e.l.0.0.0.0.0.S.[k0L.F0....C.h.e.c.k.G.r.a.m.m.a.r.=.1............./././././././././././././././././././././././././././././././././././././....././.qQ...d\O..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!hQSO.!qQ...d\O...././..0.0.0.0...Y.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.C.a.n.D.r.a.g.,.0........././..W.0...0HQ.}.n0.0.0.0.0.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.I.n.p.l.a.c.e.R.e.n.a.m.e.,.0............./././././././././././././././././././././././././././././././././././././....././..0.0.0.0.0.0.0-..[..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!.0.0.0.!.0.0.0.OX[n0h.:y...././.s.0}g0.NL.x..b:.-..[....W.r.i.t.e.R.e.g.N.u.m.=.L.i.s.t.D.r.a.w.,.F.u.l.l.R.o.w.S.e.l.,.1........././..%.0.0.0.0.0.!.0.0.0.!h.:yqQ.....././..0.0.0.0.0.0.0.0.0.0.0.0k0Y0.0:.O.N.(.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\_FileManageMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3990
                                                      Entropy (8bit):4.642396052557253
                                                      Encrypted:false
                                                      SSDEEP:48:C6W69rY/UHF+9PZO9ziBwKPZwhEwyzwAwzDwzewziwzTXoDXZ8FNqwWocPhLiKu1:b7uUU1ZO9ziWKGhxy8tgb3K7hLir9qI
                                                      MD5:4ACBD1FD1DF0832223E52EE8FB55E49F
                                                      SHA1:10671B9E10725343292E59B6F6F0E85B8A5E8071
                                                      SHA-256:D2C326E09B460A31AB632C3CBEC430081F51259820357A994E77428E546B8F52
                                                      SHA-512:9AA46D62EE2910B5C8C6129F884DB5CE3AC7203AFE1ECAD28310364B07842F6F5965F5C64FA0B4A594111E8CC5CEDBF457FD46FABBF58D878D83AB8E5B12AD8A
                                                      Malicious:false
                                                      Preview:.././..%L0....U0.0f0D0.0L.o0.0-..[n0B0.04X@b.0:yW0f0D0~0Y0.......././..e.l.0.0.0.0.0.S.[k0L.F0....C.h.e.c.k.G.r.a.m.m.a.r.=.1............./././././././././././././././././././././././././././././././././././././....././.qQ...d\O..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!hQSO.!qQ...d\O...././..0.0.0.0...Y.01..SY0.0:.O.N.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.C.a.n.D.r.a.g.,.1........././..W.0...0HQ.}.n0.0.0.0.0.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.I.n.p.l.a.c.e.R.e.n.a.m.e.,.0............./././././././././././././././././././././././././././././././././././././....././..0.0.0.0.0.0.0-..[..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!.0.0.0.!.0.0.0.OX[n0h.:y...././.s.0}g0.NL.x..b:.-..[....W.r.i.t.e.R.e.g.N.u.m.=.L.i.s.t.D.r.a.w.,.F.u.l.l.R.o.w.S.e.l.,.1........././..0.0.0.0.0.!.0.0.0.!h.:yqQ.....././..0.0.0.0.0.0.0.0.0.0.0.0k0Y0.0:.O.N.(.L.V.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\_ShellMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3950
                                                      Entropy (8bit):4.6382183164423765
                                                      Encrypted:false
                                                      SSDEEP:48:C6WfYUrY/UHFaPZO9ziowPZwhEwyzwpwzJkwzKJwzRTwz8XoDXcFNqSocrNkLiKm:bcuUwZO9ziFGhxy8O9Reulc9GkLiKbs
                                                      MD5:4B31E38B076B397F8CA1D2739619BA58
                                                      SHA1:9E3B3163DBFDEFC51A7BD0999BF600C27154D0F7
                                                      SHA-256:0A1380B2C5936AC8D569BF3F482A92B6A7294F89FF81F0FECE5092D1A243923F
                                                      SHA-512:2F9671CB21FE953CE7B2391574DBD3561A3587092968031C4EE97684F9FF0307304E08930E31F7B3F8328B86D874A8989D1A286C62502F79A33EA35FAC2EC731
                                                      Malicious:false
                                                      Preview:.././..%L0....U0.0f0D0.0L.o0.0-..[n0B0.04X@b.0:yW0f0D0~0Y0.......././..e.l.0.0.0.0.0.S.[k0L.F0....C.h.e.c.k.G.r.a.m.m.a.r.=.1............./././././././././././././././././././././././././././././././././././././....././.qQ...d\O..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!hQSO.!qQ...d\O...././..0.0.0.0...Y.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.C.a.n.D.r.a.g.,.0........././..W.0...0HQ.}.n0.0.0.0.0.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.I.n.p.l.a.c.e.R.e.n.a.m.e.,.0............./././././././././././././././././././././././././././././././././././././....././..0.0.0.0.0.0.0-..[..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!.0.0.0.!.0.0.0.OX[n0h.:y...././.s.0}g0.NL.x..b:.-..[....W.r.i.t.e.R.e.g.N.u.m.=.L.i.s.t.D.r.a.w.,.F.u.l.l.R.o.w.S.e.l.,.1........././..%.0.0.0.0.0.!.0.0.0.!h.:yqQ.....././..0.0.0.0.0.0.0.0.0.0.0.0k0Y0.0:.O.N.(.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\Tablet\TabletAssist\_ViewerMode.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):3954
                                                      Entropy (8bit):4.638054859469006
                                                      Encrypted:false
                                                      SSDEEP:48:C6WfYUrY/UHFaPZO9zixwhPZwhEwyzwpwzJkwzKJwzRTwz8XoDXcFNqSocrNkLiC:bcuUwZO9zimhGhxy8O9Reulc9GkLicXv
                                                      MD5:C781765C2B7744247D0860DB9627CF49
                                                      SHA1:01F14AA1968212093698E87C5562CA1202251E10
                                                      SHA-256:798E3128BF0C0FBC3DA22A546DFD4B78AF8A40429D212F9DE03A1FCF50D79726
                                                      SHA-512:CB36510E8D2646CA148D2671ECCDEAE7634A31B8A95C4E11B7D0213E0A43B860D3B7135501447132CEA2D6BE65D03ADDEE49B860C69C9CE3827F4820BF6E60EE
                                                      Malicious:false
                                                      Preview:.././..%L0....U0.0f0D0.0L.o0.0-..[n0B0.04X@b.0:yW0f0D0~0Y0.......././..e.l.0.0.0.0.0.S.[k0L.F0....C.h.e.c.k.G.r.a.m.m.a.r.=.1............./././././././././././././././././././././././././././././././././././././....././.qQ...d\O..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!hQSO.!qQ...d\O...././..0.0.0.0...Y.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.C.a.n.D.r.a.g.,.0........././..W.0...0HQ.}.n0.0.0.0.0.01..SY0.0:.O.F.F.....W.r.i.t.e.R.e.g.N.u.m.=.A.p.p.I.n.f.o.,.I.n.p.l.a.c.e.R.e.n.a.m.e.,.0............./././././././././././././././././././././././././././././././././././././....././..0.0.0.0.0.0.0-..[..../././././././././././././././././././././././././././././././././././././........././..%.0.0.0.0.0.!.0.0.0.!.0.0.0.OX[n0h.:y...././.s.0}g0.NL.x..b:.-..[....W.r.i.t.e.R.e.g.N.u.m.=.L.i.s.t.D.r.a.w.,.F.u.l.l.R.o.w.S.e.l.,.1........././..%.0.0.0.0.0.!.0.0.0.!h.:yqQ.....././..0.0.0.0.0.0.0.0.0.0.0.0k0Y0.0:.O.N.(.

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\UserImages.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 176 x 15 x 24, image size 7922, resolution 2834 x 2834 px/m, cbSize 7976, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):7976
                                                      Entropy (8bit):5.814725152188228
                                                      Encrypted:false
                                                      SSDEEP:192:9pR6AOOByDXw4tZRHf5RF2N0cegYKBdfvq:9iLrw4tZRxaau/Hq
                                                      MD5:72CA2AAFDA61B0B1BEEB631361A687BD
                                                      SHA1:3E52CE6E8C694F5208E4B640D5367135EB49012B
                                                      SHA-256:9EDF29B8D95FACB4128E91959E6E6A63AF2F6C4988FB14A02497AC64ECEDE32F
                                                      SHA-512:D56A5539591539A5CDB93C43FF7EC0F599D5F490E75332C9007D38331E968711B9ED0B2FC54638C8224307D68B193A55EC8EA67CCF5841146A8571E6A063433E
                                                      Malicious:false
                                                      Preview:BM(.......6...(...........................................................w..n..n..n..............................o..D..%..Q.............................................K..K..~.........................................................................................................................................................................................O^.O^.........................................G.G.{......................................j..U..'..1......................................Q.Q..............................................................................~R.\..U..Y..Y..Y..Y..a..^...................a........3....,........B............................K...s..z........}..q.6.....................vx.vx.vx.vx.vx.vx.vx.vx.vx.vx.vx.vx.....................`.[...`.[....................................................................................Q`.....%..&..&..$..*.;L.........................H.j..o..y..{..q..h..|2.......................n.................)...

                                                      C:\Users\user\Desktop\Asr\Common\InitTemp\UserMenuCommand.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                      Category:dropped
                                                      Size (bytes):492
                                                      Entropy (8bit):4.579957935551163
                                                      Encrypted:false
                                                      SSDEEP:12:Q1RjVK0kYrzAl4HyrargolBRzskVXGKjolBRhEskAGKColBRJskQuvy:QzhKl4plBRwoWlBRjdXlBRSGvy
                                                      MD5:7061B6EF83B59143B09CFC31ACC354CC
                                                      SHA1:9160B703821092719D9A4DC504B3925DA3943CAC
                                                      SHA-256:C4217696FD4695FD1A428BED56987AAE053011E1839676A740151810F73A976A
                                                      SHA-512:E1A05DDE9FDCB67B9826E128C9FFB3CCA907C61DA71DFFE5828BED076AA0EA88E0E446781077CBAA1D60E9934F02CC71094A2D11ECC7913187A606732EF11A78
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0.[...0.0.0.0.0.0.0.0...././..g.R.0.0.0.0I.D.n0.{.V:.4.1.0.0.1.^.4.1.5.0.0..././..0.0.0.0.N.io0E.x.t.e.r.n.a.l.D.e.f.C.o.m.m.a.n.d...t.x.t.h0.TX0g0Y0n0g0.0]0a0.0.0.SgqO0`0U0D0.0......4.1.0.0.1...N.F.-...%.M.e.n.u._.d.i.r.%.U.s.r.M.e.n.u.1...t.x.t....0.0.0.0.0.0.0.0..n0h.:y....4.1.0.0.2...N.F.-...%.M.e.n.u._.d.i.r.%.U.s.r.M.e.n.u.2...t.x.t....0.0.0.0.0.0.0.0..n0h.:y....4.1.0.0.3...N.F.-...%.M.e.n.u._.d.i.r.%.U.s.r.M.e.n.u.3...t.x.t....0.0.0.0.0.0.0.0..n0h.:y........E.O.F.....

                                                      C:\Users\user\Desktop\Asr\Common\Lang\Msg.ja-JP.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):16320
                                                      Entropy (8bit):5.4298273753232635
                                                      Encrypted:false
                                                      SSDEEP:384:gZxpaOqesVmu/nlkRz6JN3xSIH6cCjCvdryCEb:25stWRzyvJHyuwxb
                                                      MD5:867B1AAB58623B812F3761AFFBFD5FAA
                                                      SHA1:77D8D28CCBDF8A4D1AEEB10EF9015C22789AA25E
                                                      SHA-256:EDC12CEF29F9F3CE4A6A8AE5814F504205B7E27CBC1CC4562CEEC37268398A18
                                                      SHA-512:609C1E1F261B784CBF54369E26F322BB4831CC116B21835D9F3E9B4DACAC4A05FD70110DD2AB7F9FE8E9B8AFB50EB566964EA4F1D9A1D43212BA68F8C89AFAC8
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0.0.[...0.0.0.0.......././.Nl(u.0.0.0.0.0.0.0.0...Nn0.e..h0D}.0.T.0U0.0.04X.TL0B0.0~0Y0......6.2.3.0.1...UO.0x..bU0.0f0D0~0[0.0....6.2.3.0.2...UO.0eQ.RU0.0f0D0~0[0.0....6.2.3.0.3...w..Rg0M0~0[0.0....6.2.3.0.4....0.0.0.0.0.c.[L0.Nckg0Y0....6.2.3.0.5....0.0.0.0.TL0eQ.RU0.0f0D0~0[0.0....6.2.3.0.6....fM0...0g0M0j0D0.0.0.0.0.0g0Y0....6.2.3.0.7....ek0{v2.U0.0f0D0~0Y0....6.2.3.0.8....Q.RHQL0.c.[U0.0f0D0~0[0.0....6.2.3.0.9....0.0.0.0.0n0\O.bk01YWeW0~0W0_0....6.2.3.1.0....0.0.0.0L0x..bU0.0f0D0~0[0.0....6.2.3.1.1....[SO.0.c_0j0D0.N.`.0.0.0.0.0K0.0o0.[L.g0M0~0[0.0....6.2.3.1.2....0.0.0.0n0...0...0k01YWeW0~0W0_0....6.2.3.1.3...-..[g0S0n0.R\Oo0.ybkU0.0f0D0~0Y0....6.2.3.1.4....0.0.0.0.0g0o0B0.0~0[0.0....6.2.3.1.5...._.....vL0eQ.RU0.0f0D0~0[0.0....6.2.3.1.6...-..[n0.NP.pek0T.W0~0W0_0....6.2.3.1.7....R.0.S.0.Qegj0D0.0.0.0.0L0+T~0.0f0D0~0Y0....6.2.3.1.8....0.0.0.0.TL0w.Y0N0~0Y0....6.2.3.1.9....O(ug0M0j0D0.eW[L0+T~0.0f0D0~0Y0....6.2.3.2.0....0.0.0.0.0L0x..bU0.0f0D0~0[0.0....6.2.3.2.1....0.0

                                                      C:\Users\user\Desktop\Asr\Common\NewCommand.template

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):12992
                                                      Entropy (8bit):5.325495426940393
                                                      Encrypted:false
                                                      SSDEEP:192:V21p9+mkUDuuu++BCQqd+60U7BooKig1oY9MThFUwHRwdFzFVyGKbeuLhuNv:VAGJ7BXqCEaUhFxQyGwhKv
                                                      MD5:EADD454E791BCCE05671809127305C49
                                                      SHA1:9790851048C1D478AC2B78E7C93EE9FA9FB5FAD7
                                                      SHA-256:DE96F4719EBDC2603B7719BF3CE35EEC889E70171C90C1691328190361D3F7F5
                                                      SHA-512:7D48D3D784955BA9D0E8A064076A00D3D2F1EBF78D225ACEC5AD7D28F5440C2938F3467BC113F22DFDC545F6B583850C474CA8100FB348BDA77B4BA03EF69FE0
                                                      Malicious:false
                                                      Preview:.././..0.0.0.0.0.0.0.0.0(u.0.0.0.0.0...0.0.0.0.0.0.....././.; ,g.0.0.0.0.0.0n0..o0._...g.\P.n0....W0K0B0.0~0[0.0.0s.0}o0.0.0.0.0.0.0.0.0.0.SgqO0`0U0D0.0.......././..%..#.n0B0.0.0.0.0.0.0.0.0.0U.R.L....././..W,g.vj0.0.0.0.0.0.0.0.0.0...././.h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./.8...C.u.s.t.m.i.z.e./.1...U.s.e.r.F.o.l.d.e.r./.2...S.c.r.i.p.t.C.o.m.m.a.n.d./.0.1...h.t.m.l....././.]0n0.Nn0.0.0.0.0.0.0.0.0.0...././.h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./.8...C.u.s.t.m.i.z.e./.1...U.s.e.r.F.o.l.d.e.r./.2...S.c.r.i.p.t.C.o.m.m.a.n.d./.0.2...h.t.m.l....././..0.0.0.0.0n06R._.i.e...././.h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./.8...C.u.s.t.m.i.z.e./.1...U.s.e.r.F.o.l.d.e.r./.2...S.c.r.i.p.t.C.o.m.m.a.n.d./.0.5...h.t.m.l....././.n..c.0.0.0.0.0.0.0.0.0...././.h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./.8...C.u.s.t.m.i.z.e./.1...U.s.e.r.F.o.l.d.e.r./.2...S.c.r.i.p.t.C.o.m.m.a.n.d./.0.7...h.t.m.l...........

                                                      C:\Users\user\Desktop\Asr\Common\StatusAnime\Note\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):34
                                                      Entropy (8bit):3.718953282045021
                                                      Encrypted:false
                                                      SSDEEP:3:QJe7NV4vldKBV4vln:QJe7NI9n
                                                      MD5:0BDDAE1FC312FC5F5AB992664C560D2A
                                                      SHA1:A20568E12BC08401AA2DC863E324D46DC33803D1
                                                      SHA-256:60CA5D70C07C31770F17B70A890D902D73E0A72A94068083C8C60EDCC788A7B0
                                                      SHA-512:45F23CE73E0F03EE04B473CB833C3BF3964EC38AF163CA1DE4D2D0DA3BE165E438E3A7B7D4070E8EA27460D18E40185F3A965DFA230DBBB258CA11B0EA912FE4
                                                      Malicious:false
                                                      Preview:...&{g0Y0.0....\O.0K0Q0g0Y0.0....

                                                      C:\Users\user\Desktop\Asr\Common\StatusAnime\Note\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 64 x 16 x 24, image size 3072, cbSize 3126, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):3126
                                                      Entropy (8bit):3.777122596984976
                                                      Encrypted:false
                                                      SSDEEP:48:mO+OLnQ9XOOtOO+Yz0mem0meYQAKt4QAKtr:mPcJTYwmYmfdKqdKp
                                                      MD5:DA4AB72CB51538C4B1012A3305971EAA
                                                      SHA1:1B583C084FA5DDF0E9D6EE49A4A10B87E2F9939B
                                                      SHA-256:B9BC245CEA7ECF7D0BBDD176DB870F3D1ADEB0C661C7AD698032CA2DB8E776F7
                                                      SHA-512:3C5043FA3030D31BB1E8369FD9F5D1557BD07DFB497614C9F9C05136738D18E3A8932CCF4A9D9B5D5081538B2065AD39A61BCA7B5D35223D060A6407735051EA
                                                      Malicious:false
                                                      Preview:BM6.......6...(...@....................................................................................................r..........................................................................................r..................................c..l...........................................l.........r...x...........................c..l...........................................l.........r...x.........................@.....~.........................................)...........}.........................@.....~.........................................)...........}.........................J..............................................1.*..................................J..............................................1.*.....................................<.&............{..|...a......................^.0.1.".............j...................<.&............{..|...a......................^.0.1.".........

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\Default\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):378
                                                      Entropy (8bit):5.225415059987447
                                                      Encrypted:false
                                                      SSDEEP:6:Q3xWhNQyiOVkqFWwvaNUIO8bYV/VUuyVlDz/VFd6280lNfmXVWVOQKLB3bvwmq3Q:QCQykqIwvaiXaYAuGt9q03g9QKLBbwPq
                                                      MD5:A3FC26B072213D060D0869279165F7C0
                                                      SHA1:E8AACE4DDAEA958C408C3BC3D5E502BB32542169
                                                      SHA-256:66DAFD3B313B06712D5AE858ECD947AE0D5DFF5049D134C21DE8F3C7922FF159
                                                      SHA-512:AAA4AA205ED02572B02A7BBFFE374D662B796AA48D5F0542528AAB76D9CB3DECBF7BC9D95C1E14262F6F279F28DBAE3D89143730F17FA6ED2B1211D5B8E4D4BF
                                                      Malicious:false
                                                      Preview:..;Nk0.0.0.0.0(u..g0.O(uW0f0D0.04X.Tk0.0e`Z0K0W0O0j0D0..V.ln0;u.Ph0D0F0...eg0Y0.0....;u.P.0.0.0.0.0.0h0W0f0.OF0-..[.0.chYW0~0Y0.0.........N..n0)j)R.0.O.[Y0.0irg0j0Q0.0p0.0.0.0.0.0U0.0K0.0.c.OD0_0`0D0_0.0.0.0.0.0.T.hU0[0f0D0_0`0M0~0Y0.0....]0n04X.T.0S0a0.0k0o0J0}YM0j0.e...0h.:yY0.0S0h0L0g0M0~0Y0.0....FU(u)R(u.Sg0Y0n0g0.0.Omi.[.O.0.^1X;m.Rk0.0T0)R(uD0_0`0D0f0.0.iD0~0[0.0.0....

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\Default\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 64 x 16 x 24, image size 3072, cbSize 3126, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):3126
                                                      Entropy (8bit):1.6843535739981055
                                                      Encrypted:false
                                                      SSDEEP:24:XkAwWwwmAwWwwmAwWwwmAwWwwmAwWwwmAwWwwmAwWwwmAwWwwmAwWwwmAwWwwN:T
                                                      MD5:C15FF4BFE3C3149B61F2D099621DD5BE
                                                      SHA1:93C18F277E1757D603CD08A48D1EBD895403AA92
                                                      SHA-256:33083BCD5248631F27C304255901C742C5066167CEBE2AC13C1F96687B5C44BE
                                                      SHA-512:C8D69024A7CE7D9D21E0001CDF72BF1FF333EC222FC8EB41E99E2AD9326018A25C69230D6D393676B181170785F42B92AE863E101A4AF719575102B00318A7FF
                                                      Malicious:false
                                                      Preview:BM6.......6...(...@.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$.............................................$...........$..................................$...........$...........$....................................................................$.............................................$...........$..................................$...........$...........$

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\MameHip\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):148
                                                      Entropy (8bit):4.783111653153572
                                                      Encrypted:false
                                                      SSDEEP:3:QqqvVkaVVMhEnV4vlXCljkl2Y3NlSkRdiRgEQVCl9QC7wMcUuyV/vln:QqqvVT/MunIis23qtEQVCvIUuyVln
                                                      MD5:DB8CCF772C418EBD7ED4CCA086AC524B
                                                      SHA1:95E1BA65A072584BA0DBB75E605D74790B42C519
                                                      SHA-256:9416A76D34F04DFE4420B3A8C2D8FC80831139B099DAB951BB7429C464D2BC4C
                                                      SHA-512:D5604F24F55295FB43F76F6964AF2526273390C2F0BF4B404E500B84056121A653395C70C9FBEE68842051590C56E7719052189372F577478EA3F14E7EB4541E
                                                      Malicious:false
                                                      Preview:...e\On0.0.0.0.0.0n0~0.0U0.0n0._.Yg0Y0.0.....NMRo0H.T.M.L..0.0.0.0.0(.B.r.w.s...e.x.e.).n0.0.0.0.0g0W0_0.0....;u.P.0._.tU0[0.0-..[.0.chYW0~0Y0.0....

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\MameHip\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 4, image size 256, resolution 3780 x 3780 px/m, cbSize 374, bits offset 118
                                                      Category:dropped
                                                      Size (bytes):374
                                                      Entropy (8bit):3.3663062190968573
                                                      Encrypted:false
                                                      SSDEEP:6:Gl5lAjvIyi5RamS86RE8lSLtAeLgAERIN6/ftDtrtN:y5i7IZZMSueYftDV/
                                                      MD5:4D818CFA07E93248F1B960C68FDC32F9
                                                      SHA1:ED7C5F0E1E67638C2476470845C83C5FC0FBBEBB
                                                      SHA-256:DF08BAA24C23968D9A79953DAF37D6AA0B13684A6CE22AB29752550DE4E46600
                                                      SHA-512:C74F58B80998180D277BA985C7908E8B29104D2929461CA3D3F0C38C5D4B2A51697A9256293C62ACCD3AD5693315E6F0203BD232A5E8352773FD53DFBA6978BF
                                                      Malicious:false
                                                      Preview:BMv.......v...(... ......................................................................................................................................0wp....w.0w.....;........;...............................................................333.....333.....3330....3330...3333....3333....3333....3333....3330....3330.....30......30..........................................

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\Mame\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):176
                                                      Entropy (8bit):4.781284624960117
                                                      Encrypted:false
                                                      SSDEEP:3:QqqvVkaVVMH8KH4vlhEpGlV+amYVYCLDv1Q/OmOOVjvl9QC7wMcUuyV/vln:QqqvVT/McKmhHlV+aHSyPIvvIUuyVln
                                                      MD5:8A5101310144EB585A3EEC4A947CF3D5
                                                      SHA1:B52F750B5EE17244B6B1A382AFB5E298ADFACB48
                                                      SHA-256:C03EBBB0D092F478CC81BF422690108B2C2AFBF59E58D456848E668DBAE48376
                                                      SHA-512:3293C95F43B5342FB2B43ECFF7A1B7179EBA0950BF8B93E55FAA16E8D1475BE580AFCDBEEB2DFBDC5F8E037F29DD78C2C452ABAE79C1D6C9629317743BAD04C9
                                                      Malicious:false
                                                      Preview:...e\On0.0.0.0.0.0n0~0.0U0.0n0.0.0.0.0g0Y0.0.....a@w.0.cc0f0D0_0`0D0_0.e.0.\j0O0j0O0.0._;mn0...g.0P}.i.YD0n0g0.0.0.0.0k0W0f0.0~0W0_0.0....;u.P.0._.tU0[0.0-..[.0.chYW0~0Y0.0....

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\Mame\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 4, image size 256, resolution 3780 x 3780 px/m, cbSize 374, bits offset 118
                                                      Category:dropped
                                                      Size (bytes):374
                                                      Entropy (8bit):3.7172776472622155
                                                      Encrypted:false
                                                      SSDEEP:6:Gl5lAjMrdnXCNXYFnqVn6A/j2exFx+cflWNm6lcRu19Paamc:y5iQpSNIFq16A/j2e3E+u19Paamc
                                                      MD5:3D535E958345C5B9E94F990F2CE5E03A
                                                      SHA1:395EE2064DB185B3DB42BCC491DD809C2C1003FE
                                                      SHA-256:3C493E870AB77F2965A34AC9369A7D8F29537AF0FBD36EED8D6219EA911C2287
                                                      SHA-512:282A922660946A664E920960EB3582BF970B72D333DE0E2075B2D48F3CCE2F9D2159F8303BD74324996329E31DA021EB43640F015774DB1621705CBBA7EE47DC
                                                      Malicious:false
                                                      Preview:BMv.......v...(... .....................................................................................................................wwww....wwww...8....0..8....0..8....0..8....0..8....0..8....0..8....0..8....0..8....0..8....0..3....0..3....0...................................0..3....0..3....0..0....3330....0..3....3333....3333....3033....0003....0003..................

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\SimpleNumbers\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):134
                                                      Entropy (8bit):4.866990815845867
                                                      Encrypted:false
                                                      SSDEEP:3:Q66J0ObPKVOOdXbmaqNunhHVe/1CLvlQo8gZVHUwYV/VUuyV/vln:Q9PKVHLmaqNN0O8bYV/VUuyVln
                                                      MD5:E44A34815CD26B30B96A4FB4D212F9A7
                                                      SHA1:F300B85B1FB762059DF15A9D5E196622688D2304
                                                      SHA-256:3340D15A45EDEF1BD3899F4699378090E15F8BC36FDD045865A06E5C281F25A6
                                                      SHA-512:B94964711DCE6F64329BA210BBA58C7466BA03D9B5260AF846A8BF7897F985CE567FCF54AAA16BA0F484D24830E84300AE32B54BB5BFEEFDC9B57920DB0312A3
                                                      Malicious:false
                                                      Preview:...0.0.0.0.0.0.0.0n0.0.0.0.0pe.0.f:y.vk0h.:yU0[0_0D04X.Tk0.O(uY0.0.v.vn0;u.Pg0Y0.0....;u.P.0.0.0.0.0.0h0W0f0.OF0-..[.0.chYW0~0Y0.0....

                                                      C:\Users\user\Desktop\Asr\Common\StatusImg\SimpleNumbers\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 160 x 16 x 24, image size 7680, resolution 3780 x 3780 px/m, cbSize 7734, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):7734
                                                      Entropy (8bit):0.40476601883386304
                                                      Encrypted:false
                                                      SSDEEP:3:8l7l9WlFlj9X3llllllllllllllllllllllllllllllllllllllllllllllllllH:zlfx
                                                      MD5:ADC2DCC6B887331F00F9138F8C77BA96
                                                      SHA1:337046B1629397529E9CEB65137905861DEA2840
                                                      SHA-256:17B34B48591C11A3E674E8AB3B630779FDEE83E3084BE755A4C1DA82AA7388DB
                                                      SHA-512:650E66ED7A01BDEE99544F0BEFF92052F8DA9666104062B38D4F4BB47E8CAF2BEF61FF52F796403067FC732EACF41F7FA65EE7D0F700737C2BB4B393D67FFCB9
                                                      Malicious:false
                                                      Preview:BM6.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\????????????????????????(Don't edit this folder).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Non-ISO extended-ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):244
                                                      Entropy (8bit):5.310743758981503
                                                      Encrypted:false
                                                      SSDEEP:6:chueHbntKncs9xCmpMQBMpRkSHNglu7KOPy:MuM8cAQmpMQ6p5yEGgy
                                                      MD5:EB9BEE5E6C07FAE2FE2E39D1F41D6983
                                                      SHA1:71751E6AD7B163E9339668F5874E8FF7BE5EF922
                                                      SHA-256:7FC9E657DB7CABC2560220455F6228E4B4845D379872FAD2FEE81B7F8E2EBD62
                                                      SHA-512:72A54711EB4C8EB67D88963F7913D65F5F96D7223A0DE9BAC123A2DD5B916112D836B27C881982C92AAF34C15383970C8D529FE531431BD4F96585086E0CB9E1
                                                      Malicious:false
                                                      Preview:...[.U.[...........X.L...Z.b.g............A........Q.......A.t...Z.b.g....................B...X.L...e.[.}...........img......A.t.H..._................B.iDefault........A.....W...................j..

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\Back.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):2.468316401324332
                                                      Encrypted:false
                                                      SSDEEP:6:JglfZFAYAb8GoA18GoAb8yBA18ycj4AeA1j4AjwaAfSAjwaAjwaABRAjwaAl8aA0:JgfZFlXHfHXCfehs1SHkH3H9/HNJFg
                                                      MD5:75D08C80F15F928161A294DCBAD906A6
                                                      SHA1:5894DE4A9ACDF0322DCADE33D4828A1BC4A500CF
                                                      SHA-256:20F480B91914BAE5B7A23F0B457C99F662C2325C02A805FF6A188CE32A0554D6
                                                      SHA-512:2ACEAEBBB5207F29142EF1E85DBEB58D33499185A4FB3ACA1619552984D85E0B88B37BD11165E8A6605AC75E2DD2C8B2EAB758A3025C99FD0F09CBCBE1730499
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.S..S...\...................................................................................\.S..S...\......................................\.S..S...\...................................................................................\.S..S...\......................................\.S..S..l..........................................BBB......................................\.S..S..l......................................\.S..S..S..S..S..S..

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\FilterClear.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.7446872925508807
                                                      Encrypted:false
                                                      SSDEEP:12:xf+s3A8k3A8CmdmqI8IFI5ra9Ara9buduquEu6ucuiut25ut2x9P9zahra7raN:xE4qI8IKra6raBsV5xBJkek49P9zaB
                                                      MD5:1B170CB998BC258F27A235B11D76DDFD
                                                      SHA1:E18F2824F85AEFAC2ACBBF3198007F4E2D6A7BA2
                                                      SHA-256:CE763AE9D877CB8BB4F87D17402EB6A54054DDA9013FA0370559DD2168215B28
                                                      SHA-512:9849DD4EF8954CEE897E2A80141717FE6935DBD09A0111808A30DAC16C9444B9CE53BB9DF800A6FB2A6A8E867A9B97FCB0FF8FB59B1B99F0DD923C689B2B8E5F
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..................................................................................................n\.wd.q^....................................n\.wd.q^.....................................j..u.........cI5........................j..u.........cI5................................................cI5.......................................cI5.................................................cI5........................................cI5.................................................cI5........................................cI5.................................................cI5........................................cI5.................................................cI5.........................................cI5...............................................z^J.........................................z^J................................................|h..........................................|h.......................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\FilterClose.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):4.105894335026386
                                                      Encrypted:false
                                                      SSDEEP:12:xf+UtF1N1STVTDXTVTD5yPeyPpGM4xGM4qojAojrQPVpQPV2ONo0Jo0LoVHrAVHF:xiD5DAPfPo62OC0m0UNMNYIf/N/Dwowg
                                                      MD5:18192A851398DA2C4D81039F3D4A8653
                                                      SHA1:3D30EC0AE2DC8DF4FCBD56E1F233B93A8C76B099
                                                      SHA-256:5F11C40A99E32493644137CBD379DB1F8E2F493D873C3BAE47FF23B18B76DBC1
                                                      SHA-512:287A6CE0823AE03C7FB1857B74B7C24E64B1E563BD5E2AA4F02BFDCF0F1211BB6E7A441FC13E33652EE6EB3E2234B893200BA970C8B227B09CEC3A3620E9C18F
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..............................................................................................................................................................................................................................................................................................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB.............................................BBB..........................................BBB............................&..3......................9M.................&..3......................9M.......................3..&.9M.................3....................3..&.9M.................3.............................3..&.9M.......dt..&..........................3..&.9M.......dt..&..................................9M..&.9M.dt..&.......BBBYYY..................9M..&.9M.dt..&.......BBBYYY...........................9M..&..&.dt....BBBB

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\FilterDlg.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.816182475217639
                                                      Encrypted:false
                                                      SSDEEP:12:xf+8F1N1f7/WbAbEP2Pxn/F79X99X7+w9+w79X99X7ege69X99X7ZPtL:xA+tvKwIwBvKbavT
                                                      MD5:38909B4E93DFFB00470B446A486DAC14
                                                      SHA1:BEC360B7CC4BA4BFDB03722060C20AD1FAB9F401
                                                      SHA-256:4AA5E47BE3AE06821CA21A5BFF647EF1F68640462012F12A022FB9C5985322C7
                                                      SHA-512:05F0B835D2087B385D0349C157A4D4AE8BD763E410E5F6E198E13794F36732971EE2CB53F7AFE0BD5FE97E238BFA2840CB29337885F6F0B89E63390C56BBD0F0
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..................................................................................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB.............................................BBBBBB......BBBBBBBBBBBBBBBBBBBBB............BBBBBB......BBBBBBBBBBBBBBBBBBBBB...............BBBBBBBBBBBB.....................BBB.........BBBBBBBBBBBB.....................BBB............BBBBBBBBBBBBBBBBBB......BBB.........BBB......BBBBBBBBBBBBBBBBBB......BBB.........BBB.........BBBBBBBBBBBBBBBBBBBBBBBB...............BBB...BBBBBBBBBBBBBBBBBBBBBBBB...............BBB....................................nmnnmn......BBB..............................nmnnmn......BBB........................BBB.....................BBB..................BBB.....................BBB........................BBB...BBBBBBB

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\FilterVisible.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.2503080877039556
                                                      Encrypted:false
                                                      SSDEEP:12:xf+UtF1N1N1fT75Z5LXLXxLn8kLn8E5x5zf7fjwt8rHwt8rvt9:xdjbbJn84n8cr7zkt8Mt8r
                                                      MD5:D898F1D6C6A3C59037F4E980E5083F00
                                                      SHA1:55C491A40B96E0EAC71020619F8D3F7AB0BE861B
                                                      SHA-256:B56B756D4CFAD88BD1E7CA3392DC539CCA2AE3CCA48C78D56438FF1EF64B8D1E
                                                      SHA-512:82B8AB4B986E64813B9CB1C425E2673E2D11E54F3A36A039C3844C37B11901CD4BC9B6B94674E494E882FD67C7E61EC8A5DA2A266355B8CE24C4454A8EC85BA7
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..............................................................................................................................................................................................................................................................................................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB.............................................BBBBBB.......................................BBBBBB..........................................BBBBBBBBBBBB.................................BBBBBBBBBBBB....................................YYYBBBBBBBBBBBBYYY...........................YYYBBBBBBBBBBBBYYY.................................BBBBBBBBBBBBB

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\Forward.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):2.434191566025133
                                                      Encrypted:false
                                                      SSDEEP:24:JgDl3HfH3Hh3HEH1EHqHCqHCHECHkHMkHXHiXHXHVXHtBtA:8lXPXhX414+C+GEGYMY3i33V3tBtA
                                                      MD5:F47865CFFE736DFD63058E64947BFC10
                                                      SHA1:FD3CC7FF6BF6B36FF855E702D833A16DD967A29C
                                                      SHA-256:175D24DD7ED38322ECA22B0CD9E352FF07BE3ACAEA411E8F06A1639FDD9AA9B9
                                                      SHA-512:84854322ECD04C1F0F29FA67C9292B17F005C5E99A686C59D960B137F8C530A2D406DDAB814771FD4545F733C1EF80C1DA11B7CE47C1CA1438FDED9B9287A470
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.S..S...\...................................................................................\.S..S...\............................................\.S..S...\...................................................................................\.S..S...\............................................\.S..S...\.................................BBB...............................................\.S..S...\......................S..S..S..S..S..S..S..S..

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\Go.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.563076719801134
                                                      Encrypted:false
                                                      SSDEEP:6:rlf+cQAfmRAfaRAfSRAf4OiOQRAf4OiOQRAfSRAfaRAfmRAfQAd:xf+cnPLz4OiOl4OiOlzLP1
                                                      MD5:2F8A736FC03EF73A9D3B354F1E2BE7D2
                                                      SHA1:F78E6804EEE86046DA070644F942B3B74A418F40
                                                      SHA-256:F51D2BFB57F07EB30C402CC2F4830DB47952E780DD47729147A1D4C2EF4C9E5F
                                                      SHA-512:D6D73EFDD91523730E7041FE97AE26A9B30884E82415EE15B8D2786A32FCF4D510B7D34E888146BA251356658784AB1EF7754D117557B84D12CF8750C96D1685
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .........................................................................................................................................................................................................................................................................................................................................................................................BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB......BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB............BBBBBBBBBBBBBBBBBB.......BBBBBBBBBBBB......BBBBBBBBBBBBBBBBBB.......BBBBBBBBBBBB............BBBBBBBBBBBBBBBBBBBBB.......BBBBBBBBB......BBBBBBBBBBBBBBBBBBBBB.......BBBBBBBBB............BBBBBB.........................BBBBBB......BBBBBB.........................BBBBBB............BBBBBB.........................BBBBBB......BBBBBB.........................BBBBBB............BBBBBBBBBBBBBBBBBBBBB.......BBBBBBBBB......BBBBBBBBBBBBBBBBBBBBB.......BBBBBBBBB............BBBBBBBBBBBBBBBBBB.......B

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\History.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):1.2048312256992761
                                                      Encrypted:false
                                                      SSDEEP:3:JxllelFlZtDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDq:JglfZyEeEADaHE8Oaf80Ga30+aP
                                                      MD5:0956E5E02892598E9B1D3E143969B488
                                                      SHA1:5FA296919500C989E732825D2FFD7A4028EE4E5C
                                                      SHA-256:BEE5A1CCA577AC628F82AF68782EBC66E81A3585EA653C8D1404D65982E83F18
                                                      SHA-512:E61D0A8495271E4F8B3765BEF96B3C864267C7FA5D90E5FF24F413FA2413E2CB3630494256F4CCF61542E0BFB238C74E12C043AAE1DC4689E86A85ACBE15C293
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\Refresh.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.7729091050186603
                                                      Encrypted:false
                                                      SSDEEP:24:x8LHLxvBQnmQnC6k6ugOuKHKRsiKsiNA5ZA/Q5QJkGA7AvJ/43:izMJzx7siKsiNUZcQ5QxA7Al43
                                                      MD5:9D0DF95C88A029E24DA252243A2F6218
                                                      SHA1:62E766B4D3C1963F941DA1B78166CBE705B2BE95
                                                      SHA-256:167468F95189D47AB91DA155EC0B4B949E5CAC94B6AEFB0C108533E7F6B33BAE
                                                      SHA-512:A79775D2F1813C4A36E988267770D8659E73F2823BC010CCD7C9F6D016A745042419ADFC1978CF78BB809630CD97A2D830B8114C7AE97D19E8F6758EA3B92AED
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................oooBBBBBBBBBBBBooo...........................oooBBBBBBBBBBBBooo..............................BBBBBBBBBBBBBBBBBBBBBBBB.....................BBBBBBBBBBBBBBBBBBBBBBBB........................BBBBBBYYY............YYYBBBBBB...............BBBBBBYYY............YYYBBBBBB..................zzzBBBMMM..................MMMBBBzzz.........zzzBBBMMM..................MMMBBBzzz...............BBBBBB........................BBBBBB.........BBBBBB........................BBBBBB...............BBBBBB........................BBBBBB.........BBBBBB........................BBBBBB...............BBBBBB........................YYYBBB.........BBBBBB........................YYYBBB...............MMMBBB.......................................MMMBBB................................................BBBBBB.........BBB...........................BBBBBB.........BBB.................................MMMBBBBBB......BBBBBB.

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\SerchClose.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):4.68448438219758
                                                      Encrypted:false
                                                      SSDEEP:12:xf+8ntn2C/nFMT/hT/7KIXIKI+WRlm5hoBoGQPVq9QPVq9Cn+o+no+7oVhV9+W+r:xZIXHIyc4cCnF+o+k3fJGpNpvb9
                                                      MD5:C940012650DB3C6369EB81BC0802B19A
                                                      SHA1:78981453631E17FDCA073B4CF796C88803BE9F5C
                                                      SHA-256:60B74972E51666B891B7082E8DD7DE3C6E21D694A3B4BB2444C358F938A52B2C
                                                      SHA-512:AEA81956791E9604EAED1BBF3B77A2E92D48C5C914060FB37C10C9D8EEF30BC83D38124202594E585CE27865AE7C024ACEA5E0CDB3859DA6DE6B0CE7696C87D8
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...............................................................................................................................................................................................ddd..........................................ddd.............................................dddBBBBBB....................................dddBBBBBB..........................................dddBBBBBBBBB.................................dddBBBBBBBBB.............................................BBBBBBBBB....................................BBBBBBBBB..................................&..3.......BBBBBBBBB......9M.................&..3.......BBBBBBBBB......9M.......................3..&.9M.......BBB.......3.......BBBMMM.......3..&.9M.......BBB.......3.......BBBMMM................3..&.9M.......dt..&..........nmnBBBzzz.......3..&.9M.......dt..&..........nmnBBBzzz...............9M..&.9M.dt..&................BBBBBB.........9M..&.9M.dt..&................BBBBBB..................9M..&..&.dt........

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\SerchHighlighting.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.1866698258324684
                                                      Encrypted:false
                                                      SSDEEP:12:xfNcYaY7HYaY7vYaY7HYaY7vD8DU5T57k1Yk1YdwdwSgnSgd7qT7qB7aW7aSWSVb:xWYjYrYjYogSgwSgTpozoid
                                                      MD5:D29EDF485FDE7BC930EDFD0FEC47C1C0
                                                      SHA1:A9C14EABBFF896A618870DBB3E51C671C5A957AD
                                                      SHA-256:820EB579A028F51FB39B3577346C8654A1CD3BD7ED3B2BC7D56EFA8336CA0740
                                                      SHA-512:0F3FE7F9A8F6F9D9FD2D7D72FF62BEB5D73FEFB1AD085DBA2D847B1EAF2062203B59F459F184139BD3864BFF8199CA4C54ED9BEBB9815F76276423EFC4984A9A
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..................................................................................................$..$..$...................................$..$..$.........................................$..$..$...................................$..$..$............................................................................................................................................YYY..........................................YYY.............................................MMMBBBBBBddd.................................MMMBBBBBBddd..........................................BBB......ddd.................................BBB......ddd.......................................ddd.......ddd..............................ddd.......ddd.......................................ooo.......ddd..............................ooo.......ddd.......................................ooo..............ddd........................ooo..............ddd.................................ddd....

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\SerchNext.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.9615594378572756
                                                      Encrypted:false
                                                      SSDEEP:12:xf+8tnfHk/8k/cU0UcU0UcMEDy0Dy8Dy0DyUkOy8kOycKUK8t3:xkrbjbjFLDLVNzrw
                                                      MD5:946A829C3D1CA7B72A8D9BC1E3C00CA8
                                                      SHA1:C20A633453301F3A0FFD9DEDADE7B19BBADE3BBB
                                                      SHA-256:402FA9B77AB5CC420F2DECC7857F1B7C4E90871A6E98BD0A2DA4F4D950D46460
                                                      SHA-512:A293E8C80B568CC98D689C1D2A06068FEE2442D098B80E5807022A80EFF754C7AF40F689572DBC02FB2844CA7153A368FC707D5EB076F438EFBDD21B67B805B0
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................MMMBBB.......................................MMMBBB................................................MMMBBB.......................................MMMBBB................................................MMMBBB.......................................MMMBBB................................................BBBMMM.......................................BBBMMM..........................................BBBMMM.......................................BBBMMM..........................................BBBMMM....

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\SerchPrev.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.9615594378572756
                                                      Encrypted:false
                                                      SSDEEP:12:xf+ctnfNntnnDy0Dy8Dy0Dy8AA0AAcU0UcU0UcBTtBTPKUK8tP:x4LDLXAfAbjbjbrQ
                                                      MD5:DDA1CF5A644602179EA2F9518009D779
                                                      SHA1:F97C4BAE4179A98E6427645C089F818F40B7711B
                                                      SHA-256:B3A71D163612306CEDAFECA4295969D40673A117CB615D73C0673D1BF501006C
                                                      SHA-512:085CF333055705E3D2EE31C8B446D3A54E3D2CA44195C51D4B78F1DA564B34478EB37917815D7D51D4003CA7D9937FBC86B147BDB576AF677E929A366D32F437
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................BBBMMM.......................................BBBMMM..........................................BBBMMM.......................................BBBMMM..........................................BBBMMM.......................................BBBMMM..........................................MMMBBB.......................................MMMBBB................................................MMMBBB.......................................MMMBBB................................................MMMBBB....

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\SerchSelect.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.6378638295623187
                                                      Encrypted:false
                                                      SSDEEP:6:rlfOFNihT9hT61IxCIxuKQKDG1QKDGaJgL0GOgL0GmgTeL+QTTeL+QhTmgRTmgUa:xf3va9gEtgCgJqjqRaeaPwdstkjld
                                                      MD5:778612B12A00487471EF717F600B06B2
                                                      SHA1:F13EBFCE70B645269DD71032876A786D2CE5CED9
                                                      SHA-256:0E83890FF5C7DA1176346EC2896F588228C32166B5289423AF7E04B4F6DBE801
                                                      SHA-512:E0E1C2B906DAF86381116C14D1D8873B76334E489C67A724FDD461D45726336B2093C5D29EB47EA63AF689DE2B1A194C17985AEBC536EBD2C024A8D40A67B441
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .........................................................................................BBBBBB......BBBBBB......BBBBBB......BBBBBB...BBBBBB......BBBBBB......BBBBBB......BBBBBB.........BBBBBB......BBBBBB......BBBBBB.........BBB...BBBBBB......BBBBBB......BBBBBB.........BBB................................................BBB..........................................BBB.....................YYY........................BBB...............YYY........................BBB.........BBB......MMMBBBBBBddd..................BBB...BBB......MMMBBBBBBddd..................BBB.........BBB.........BBB......ddd...............BBB...BBB.........BBB......ddd...............BBB.........BBB.........ddd.......ddd............BBB...BBB.........ddd.......ddd............BBB.........BBB............ooo.......ddd...............BBB............ooo.......ddd.....................BBB...............ooo..............ddd......BBB...............ooo..............ddd............BBB..................ddd....

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\SerchVisible.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.1959107618708957
                                                      Encrypted:false
                                                      SSDEEP:12:xf+8ntn2C/nF3cjcxcK8cK0coQ6coe0LTL/59574Or4O95957od6odgQoQqQoeU1:xckfRnEO0OnnkdNdlU
                                                      MD5:20846A5429ED577B197E4F88F43627F0
                                                      SHA1:A24C8C660D4D63950C2560F5EC8546183EA48959
                                                      SHA-256:423BD66C5031F2EB8325A2043F4A907424BC09C3CB2EEAEBB746BC5AFA2B9317
                                                      SHA-512:C34E792AD884DBA80D6A061233A6686B1DA9246BC260E045B9D0E2414B99139FD8870DA5DE83AF8A8994EB78FC0531F5F439068A3E838DFF57B64BF1397D5BBA
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...............................................................................................................................................................................................ddd..........................................ddd.............................................dddBBBBBB....................................dddBBBBBB..........................................dddBBBBBBBBB.................................dddBBBBBBBBB..........................................dddBBBBBBBBB.................................dddBBBBBBBBB..........................................dddBBBBBBBBBdddBBBBBBBBBzzz..................dddBBBBBBBBBdddBBBBBBBBBzzz...........................dddBBBBBBBBBBBBBBBBBBBBBMMM..................dddBBBBBBBBBBBBBBBBBBBBBMMM...........................YYYBBByxx.........nmnBBBzzz..................YYYBBByxx.........nmnBBBzzz........................BBBBBB...............BBBBBB..................BBBBBB...............BBBBBB........................BBBBBB.......

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\Stop.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.6470870611124298
                                                      Encrypted:false
                                                      SSDEEP:12:xf+UtMHy3MHy1styyyyyLetyyyyyLtEEyyIsEyyI9RsKVsKewlbEi3yh83y0y3yT:xnzzJPbE+bEkJ681
                                                      MD5:BBE82B15A906C86A022A1CD64CF5FBD4
                                                      SHA1:C643E1C568DE80EC01D15A2C129F65BC45585EF2
                                                      SHA-256:D4A29C7C7FB5E2961145145E3DDCD04725CA516EEDCE99D4F006CD153682AA92
                                                      SHA-512:4ED8321608743A59246788FF562A40F9ECA46EDB7C1EA90AEC1C35FF43885CE774FBE01CDF79128DB0D55DC287C36FD16A3D528A8DE552A3E202CF6F3229713D
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................M[.............M[..........................M[.............M[..........................lw.........................lw................lw.........................lw...................\i....0@.0@.............0@.0@....lw..........\i....0@.0@.............0@.0@....lw...................0@.......0@.......0@.......0@..............0@.......0@.......0@.......0@..............M[....0@..........0@.0@..........0@....M[....M[....0@..........0@.0@..........0@....M[...................0@...................0@......................0@...................0@...............................0@.............0@............................0@.............0@..................................0@.............0@............................0@.............0@...............................0@...................0@......................0@...................0@...................M[....0@..........0@.0@.....

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\TreeVisible.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.940131728021024
                                                      Encrypted:false
                                                      SSDEEP:12:xf+cne6e6e6e6e6e6e6e6e6UQi5p61I1U:xAQhIU
                                                      MD5:2449F33F839DDE92A516FF6F527B13A9
                                                      SHA1:10500E99D2895EBC266375EDE24346B50AEBABAA
                                                      SHA-256:81906F2DD628E1A2ADA41EDA71675881B3A7114A393D1A82F2EC93D75403AAC8
                                                      SHA-512:9C9D13B7212A7326C468AAFACE119A08D74770795EF7F0449D3D9197DD340AD34902D87F85DC00B6218114A634E608653D297609F17A9123E62B8CB46DC80490
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .........................................................................................................................................................................................................................................................................................z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z..z..z..z........z..z..z..z..z..z..z..z..z..z..z..z..z..............z..z..z..z..z..z..z..z..z..z

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\AddressBar\up.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.484089901058299
                                                      Encrypted:false
                                                      SSDEEP:12:xf+8tFPkXspbDpbrooo0oUfxfJKpKBLA0LAhHBHXHfH9VdVA:xPRWl1UhA8AhHBHXHfH9VdVA
                                                      MD5:ED5F7DE3742028426CABDD00D95B6518
                                                      SHA1:48D529CA8AAE48B2579571B2B1CB283C870F554F
                                                      SHA-256:7F8799FBC325C4632B90A00E66AAC3C42EEFEE86E988DECE8E07C21CF53F4FB7
                                                      SHA-512:C9892D9D94EBC3DEF4CDD61437844FEC0890C9BA33DD3CC4395DD17B02E84AA850F5C17C66F2979BFE419A9298D3AA9FDD533F371D2EB34F6A1AF3221A627163
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ............................................................................................................................................................................................................S..S.........................................S..S...............................................S..S.........................................S..S...............................................S..S.........................................S..S...............................................S..S.........................................S..S.......................................\.......S..S.........\.......................\.......S..S.........\............................S...\....S..S......\.S.......................S...\....S..S......\.S.............................S..S..l.S..S...\.S..S.......................S..S..l.S..S...\.S..S..............................\.S..S..S..S..S..S...\.......................\.S..S..S..S..S..S...\................................\.S..S..S..S..

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Bar\Baricon.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 144 x 16 x 24, image size 6912, cbSize 6966, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):6966
                                                      Entropy (8bit):4.383119489976303
                                                      Encrypted:false
                                                      SSDEEP:96:j0Yfffff6KfffffOqCfffff2P3+90DcjkW:j0VX
                                                      MD5:3DB21B983D242BA38F4DC2683AAD9BE0
                                                      SHA1:25E9E378BB0B15545E1C562B3FC18D9CDE269E8E
                                                      SHA-256:5EDC7F89521B12D28E3F3491A5C6E610F1DDA92BA37D3BF104F38ECD049CD4C8
                                                      SHA-512:CB80C07B67096B42D0B1148940A79D482DDBFE6C260E4506589DEBF29275608CEC02D286469E03632EE4CFC44A08A4823F6EBF311B0A76B0A0C3F53A4931FD81
                                                      Malicious:false
                                                      Preview:BM6.......6...(..........................................................................................................................................................................................................................................................................................................................................................................................................................................f..wwwfff___UUUMMM999)))..............................................................................ddd...ooo..........................................................................................................................................................................................BBBBBBBBBBBBBBBBBBBBBBBBBBB...............................................................h...Dw.Du.Ev.Fx.Fu.Eu.Dw.Eu.Ex.ExHl.............f....................3f.3f.33f)))...............................................................BBBBBBBBBBBBBBB......BBBBBBB

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Bar\Tabicon.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 64 x 16 x 24, image size 3072, cbSize 3126, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):3126
                                                      Entropy (8bit):3.9866734332735656
                                                      Encrypted:false
                                                      SSDEEP:24:XlVUMyMrMzV9iwqljAO27c3AO2EAOSGK+AOxyxdlTdAOGxdZAOK5TEEAOL4L6AOP:PpyMrsSlsLh7HIsu2TodTz8plvvfyW
                                                      MD5:082478B890419A2C459FAF71ECA1BB6C
                                                      SHA1:AFA90B75845A38FB1233A9792F00701A2E4F7A2C
                                                      SHA-256:A88322BF3220566862B399FB67DABA3CDFA187FBA230D98CC79BD55547BB232B
                                                      SHA-512:F244E1CD3C9E03FDED7E2AA5D838C89E69C5FCFF4C0912B69AA092FB122BB4D377D7CE91A13F353FD01048C39C0B277AC44DCFF723AB2E2655D2FF7FF3EC4994
                                                      Malicious:false
                                                      Preview:BM6.......6...(...@...............................................................................................................................................................................................................................................oooooo.............................................M.........M....................................................................................................................BBBoooMMMMMMoooBBB..................................l.................\............................................................BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB.........ooo..........ooo...............................l......x............x.....\.........................................................BBB...............BBBBBB...............BBB......oooXXX...MMMMMM...MMMooo..............................................................................................................BBB...............BBBBBB.......

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Check\CheckExplore.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):4.279885890072709
                                                      Encrypted:false
                                                      SSDEEP:24:xEZFA8B8UAn7ncYZrPCo4/eq2CCP+/NHEQaSQaeGlRiPqk8enhZZA:C1HVGqLkQZQRq
                                                      MD5:BB3E1DD4EDCB7121817FB22E24C42A54
                                                      SHA1:A5B24882247315890404E55CDEABC5CADF80BDD2
                                                      SHA-256:3BF6E4C877DB60116EAD0058B8D2DFC82F36E9FBAD751DE04B7FD33BC0DAF4D8
                                                      SHA-512:FD320F9A9197B9E84089FA4CF0A1A548E024FF98479440592CBE452C5E53C5756E3E6778D365EC05EC94806EFAF37D337F69643ED7268243E3CA89DD54CAEC81
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .......................................................................................................................................................................................................................................R..R..R..R..R..R..R..R..R..R..R..R..R...........R..R..R..R..R..R..R..R..R..R..R..R..R...........R...................................R...........R...................................R...........R...................................R...........R...................................R...........R............."."...................R...........R...................................R...........R.........."."".""."................R...........R...................................R...........R.......".""."".""."".".............R...........R...................................R...........R.......".""."..."."".""."..........R...........R...................................R...........R.......".".........".""."".".......R...........R.............................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Check\CheckItem.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.8726126611753595
                                                      Encrypted:false
                                                      SSDEEP:12:xf+1umQ1ZtYAlGKjjPCueu1Bkah1y1yaa1jH2aeWM1O1ionmhq:xgwZi8jPCWlhwxaZHzU1GiomM
                                                      MD5:D58F6D129763E8F08A368322446CD5DB
                                                      SHA1:125CA909A5E97621CD6C19217775FC3D225831A0
                                                      SHA-256:FFB4CEE4CA11664BC384343FC5BE443413BF9FFE83E92A3FC90CA9C1292B2864
                                                      SHA-512:5EF589B5C389B16327DB35C58F731AC949E2AB89B00782714970906D63CE2253BBC924C2BB6AEA2FD80F3947901BE5ACDEE11BCD0C197C5AF9712998FDC7A8CE
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..................................................................................................................................................p.p3.33.33.33.3p.p..........................................................................3.33.33.33.33.33.33.33.3.................................................................|.|3.33.33.33.33.33.33.33.33.33.3..............................................................3.33.33.3............3.33.33.33.33.3.........................................................p.p3.33.33.3............3.33.33.33.33.3p.p......................................................3.33.33.3..................3.33.33.33.33.3......................................................3.33.33.3..................3.33.33.33.33.3......................................................3.33.33.33.33.33.33.3.........3.33.33.33.3......................................................3.33.33.33.33.33.33.3.........3.33.33.33.3.....................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Check\CheckLock.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):5.221274284285654
                                                      Encrypted:false
                                                      SSDEEP:24:xsFwnFw63ezDOzDPD48D/O3UuIF8+U8WG5fplXwkuW2RZMQaVaVJVaVn:KwFw63ePOPb4Kv6oRlhORZMQ1yn
                                                      MD5:986F11A58A17A6F6B91C45C7270741C2
                                                      SHA1:589062037AB203954BA7CF0FBA3BD0387510B863
                                                      SHA-256:A7DDB557B6EBD2CBE0753EC1539C55592D5FB1B99ACE1B6A0556C58034AD9DE6
                                                      SHA-512:4B70039EA9CC6463FDA68C85BC969707F051586F3F59E658589BA6FBAE65B2405734E2C77AAC7DDCFF9065B62F9233A1E0B6F879B10EEED819C9F476735BE2AF
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ......................................................................................................................................................................................................................................................................................................................................xf.......................................xf......................................fL7.............................................fL7............................................jO;..........................................jO;............................................nT?.........+''...............................nT?...........................................tXC......EBD...FBB............................tXC...........................................y^H...mfc.......?<;.........................y^H...........................................~cM..................744......................~cM.........................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\LookDir\LookDir.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 2834 x 2834 px/m, cbSize 822, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):822
                                                      Entropy (8bit):3.9907164812417606
                                                      Encrypted:false
                                                      SSDEEP:12:Efw6Ys1DivthBtti9h+OXs0IjZWwD/iVu1E:EY9MDM8+S89L9E
                                                      MD5:9A7B1119BFFCDBE6187F4CEAFC3F31FD
                                                      SHA1:AC853BE8A43DFE2A0B695E50127FEDBBB8E47AD1
                                                      SHA-256:3FA5DA10AFFAC7F1EDE47FBC5951E0C241C659E8E794AB2AA5C0CA4FEEC999C3
                                                      SHA-512:89626C0BD1D9740D9F0E8FEC5CC95083A0C1822CA48402D9C4BAFFE9E4649D95F4FBA1D29C76064EBA64E58413813D3AA902B9D1683E508443CBC1B255B56439
                                                      Malicious:false
                                                      Preview:BM6.......6...(..................................................................................................................6..................................................}.....................z..z..z..z..z..z........6...}......z...........z..z..z..z..z...............}..}...............z..z..z..z..z.....6...}..}..}..}..}............z..z..z..z..z.........}..}..}..}..}..}.........z..z..z..z..z........6...}.m....................z..z..z..z..z..z.........}..}.m.................z..z..z..z..z..z........6...}..}.m..............z..z..z..z..z..z..z.........}..}..}.m...........z..z..z..z..z..z..z................................................................z..........................z..z..z..z..z..z..z..z.....................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\LookDir\LookSystem.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, cbSize 822, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):822
                                                      Entropy (8bit):4.039559256199591
                                                      Encrypted:false
                                                      SSDEEP:12:EfTby9timkXBLXH4FDOXN4FETCXXXliah5N1OxXDaVzsx/A1P:E/qLRSCXlXTjIx/6
                                                      MD5:8829664E1C93A0D5D03CB7B49C4669EC
                                                      SHA1:4E5870D8C61CD426CD632BB3C3D5B3399D4CDE2A
                                                      SHA-256:1895B6E19C1FFBC0D08B38191870FD5835155F7C950E9401F22007EE0A3B051B
                                                      SHA-512:91D2862E967E20BFF348323D9B43FF117468E6B248E529FDC84C07EA4EE07D3D5A6BA322BF8987FAD6182D9F6DF35BE3C818A5C80CDB610CED96246B08F5D204
                                                      Malicious:false
                                                      Preview:BM6.......6...(...................................................................................................oooooo......6............................BBBoooMMMMMMooo.......}........................ooo................6...}..................oooXXX....................}..}...............oooXXX..........6...}..}..}..}..}...............ooo................}..}..}..}..}..}............BBBoooMMMMMM......6...}.m.............................oooooo..........}..}.m.........................................6...}..}.m................................ooo.......}..}..}.m.............................ooo................................................ooo..........ooo..............................BBBoooMMMMMMoooBBB....................................oooooo............................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\LookDir\NoLook.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, cbSize 822, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):822
                                                      Entropy (8bit):4.607856101722242
                                                      Encrypted:false
                                                      SSDEEP:12:EfTaP4czGfSOfyyyyy9EbIyRDBmUg9Ds9RuUHJLs/ntrteAyybU7mRbSl9uOMyyV:EpcC1LISIUg9SuKxKrtNpXWl9u/S6TD
                                                      MD5:589CF7AF1A2364548C604B964A1B21CA
                                                      SHA1:38363C078E9180FDC886BECDB0E323E94037E2E5
                                                      SHA-256:1F8372F3354E4F036E4A63CE9794FC4E37AA655DB959E25A1F08979B4BA095CA
                                                      SHA-512:3A8E1E37ABBA869237DCAC7F8EB19F500385BE7CB6CE6465DB3B09D11FD4B2A5A5D0D530B5E857807FA2E1F99CF62AF49EE1D12949946E1C72BF345898E0C0EF
                                                      Malicious:false
                                                      Preview:BM6.......6...(......................................................................................................\i..0........".\i....................................................lw..........................".lw.....0.......lw....................>.................".................\i....."................."....."..0....M[........0....lw..............".....".................................."........................................>..............................".........>................................\i.....0..>.....................>....M[...................................\i.................lw........"............>.......\i................lw.........................\i.........................M[.............>M............................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):392
                                                      Entropy (8bit):5.437385203486167
                                                      Encrypted:false
                                                      SSDEEP:6:Qkx8tbx6BED2lh4GIVuDz/VFd6280lNfmXVWVOQKLB3bvwmq3Jl3DNMb6on:QIaFrTxVs9q03g9QKLBbwPl3ZMb6o
                                                      MD5:65724B893D8D2BB4A50EB243CE08570E
                                                      SHA1:4662BEE130E2E7E04F72366B14884CC7FA1D85B0
                                                      SHA-256:4440298B5EDB44808CB28D8E15DC54C1AD324F86E6F3CBC55BEB136E2C09BF3E
                                                      SHA-512:865C00D6E6E312AD018125B2770290B82E1769A946006B04953A999864AC5E2264C1D34C22CF7DA59BB3D453CE0A74B9D613DF4D7BF1A513C5BCEC3436A552BB
                                                      Malicious:false
                                                      Preview:..V.e.r...7..NM.(uk0\O..n0.NL0\Oc0_0;u.P.0.0.0g0Y0.0.....W,g.vk0V.i.s.u.a.l. .S.t.u.d.i.o.n0.QM..^...}.L0.S..j0;u.P.0CQ.0.0k0\O.bW0f0J0.0~0Y0.0.........N..n0)j)R.0.O.[Y0.0irg0j0Q0.0p0.0.0.0.0.0U0.0K0.0.c.OD0_0`0D0_0.0.0.0.0.0.T.hU0[0f0D0_0`0M0~0Y0.0....]0n04X.T.0S0a0.0k0o0J0}YM0j0.e...0h.:yY0.0S0h0L0g0M0~0Y0.0....FU(u)R(u.Sg0Y0n0g0.0.Omi.[.O.0.^1X;m.Rk0.0T0)R(uD0_0`0D0f0.0.iD0~0[0.0.0....

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Tab\NewHere.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.3515172594003197
                                                      Encrypted:false
                                                      SSDEEP:24:xW4AOl+Ol4OqOsO/OaOoZOo/OcOqOZO/OEOyOAOkOAOf:s4Ar95fgVpvXxuI7t3134
                                                      MD5:57556AF8A7AC1658DCB8A5007EA28233
                                                      SHA1:591CA3FFD0694F655F6486A785D8D6166189ACEE
                                                      SHA-256:C83893DC7B42AAC944D4F3D49D5AE9BD8A76F17745E542ED1219AF645DD528BD
                                                      SHA-512:BB0AA085FFB77692195E775481E8182AD3BB0131BB13541343480A302B10FD33782992ED979A4E190998FC77070B7F196BB8D98912B2C0E8F75D80CC7D893875
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .........................................................................................................................................................................................BBBBBBBBBBBBBBB......]..S....BBBBBBBBBBBB...BBBBBBBBBBBBBBB......]..S....BBBBBBBBBBBB.........BBBBBBBBBBBBBBB....]...\............BBBBBB...BBBBBBBBBBBBBBB....]...\............BBBBBB.........BBBBBB.............S........\.S...\...BBB...BBBBBB.............S........\.S...\...BBB.........BBBBBB.............]...\........\.S..r.......BBBBBB.............]...\........\.S..r.............BBBBBB...............]..S..S..S..S..S......BBBBBB...............]..S..S..S..S..S............BBBBBB........................r..S...\......BBBBBB........................r..S...\............BBBBBB......................r..S...\...BBB...BBBBBB......................r..S...\...BBB.........BBBBBB..............................BBBBBB...BBBBBB..............................BBBBBB.........BBBBBB...............BBBBBBB

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Tab\NewWindow.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.9270596205239494
                                                      Encrypted:false
                                                      SSDEEP:24:xyOWOQOPpOPvOjOVOrO9OUOiOyOUOEOyOAOkOAOf:wx3WQM6UibNVj7t3134
                                                      MD5:E989804A11B13A5E095006965ABD13E8
                                                      SHA1:75E03BC9C0E886E15A4D396AF7D6DB1FA303EF04
                                                      SHA-256:CFA9F6C24197DEF884678DB439E71C85A76CF26545CF6F5FB4C7EEA47C546792
                                                      SHA-512:6D9048C031BF27B9437F6AE80FD44B308FA4DB08F35326D0F53A6C76C7F6131E12F2CE0917431E0BD61A48463F8EBB1FF76646E86FCF351E79367FC1BCB620D1
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ........................................................................................................................}............................................}...................BBBBBBBBBBBBBBBBBBBBB....}.....}.....}.......BBBBBBBBBBBBBBBBBBBBB....}.....}.....}.............BBBBBBBBBBBBBBBBBB..........}..}..}..........BBBBBBBBBBBBBBBBBB..........}..}..}................BBBBBB................}..}..}.....}..}..}....BBBBBB................}..}..}.....}..}..}..........BBBBBB......................}..}..}.........BBBBBB......................}..}..}...............BBBBBB...................}.....}.....}.......BBBBBB...................}.....}.....}.............BBBBBB.........................}.............BBBBBB.........................}...................BBBBBB..............................BBBBBB...BBBBBB..............................BBBBBB.........BBBBBB..............................BBBBBB...BBBBBB..............................BBBBBB.........BBBBBB...............BBBBBBB

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\Tab\WindowMenu.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.789684844720889
                                                      Encrypted:false
                                                      SSDEEP:24:xf1oN1ou4jjPq76Wf6W3bt5V6Wf6WePq4j+y1oN1on:tuoPq76G6Obt5V6G6vPq+ui
                                                      MD5:81F1A0B478EFB24602A4595653DE6770
                                                      SHA1:95AB270F1F8ECE63E7E0092BAF3DEA58E3EDD9BC
                                                      SHA-256:682B83B87798B8CB0F0C2F12C62A0E72B49707F7565A6824C3DA24269C6C8427
                                                      SHA-512:ECD706A6716827E961C1A9129F5F065510995107BB502B9693340E2621213E70F74AACCF7DCCCEC952C8440A914CBE1A78987341658E87567A0796B0287573EF
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...........................................................................................................BBBBBB.......................................BBBBBB.............................................BBBBBB......................................BBBBBB................................BBBBBBdddMMMBBBBBBMMMdddBBBBBB...............BBBBBBdddMMMBBBBBBMMMdddBBBBBB.....................BBBBBBBBBBBBBBBBBBBBBBBBBBBBBB...............BBBBBBBBBBBBBBBBBBBBBBBBBBBBBB.....................dddBBBMMM............MMMBBBddd...............dddBBBMMM............MMMBBBddd.....................MMMBBB..................BBBMMM...............MMMBBB..................BBBMMM...............BBBBBBBBBBBB......BBBBBB......XXXBBBBBBBBB...BBBBBBBBBBBB......BBBBBB......XXXBBBBBBBBB.........BBBBBBBBBBBB......BBBBBB......BBBBBBBBBBBB...BBBBBBBBBBBB......BBBBBB......BBBBBBBBBBBB...............MMMBBB..................BBBMMM...............MMMBBB..................BBBMMM.....................dddBBBMMM............M

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeContents.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.598115121179629
                                                      Encrypted:false
                                                      SSDEEP:12:xfXybxqQxqpEdPWxTa1yIR0RYxZkWxTa1ybxqQxqpEdPWxTad3:x4q4qedexgGExdq4qedexw3
                                                      MD5:BFBA1993B8E090832B74288E32C40DD1
                                                      SHA1:22D57A21D311C86CF01B5CFDE1E884B428C9F4C9
                                                      SHA-256:B69B18E6D391FD5D21B73A3C188A6CA0BF43A835955608987CD2D8CA8041747C
                                                      SHA-512:A9E5DB64E187A0BBDCDA8D5A5EC7E88987C1A28B5199AB1C65E8DCCFDFC8381893978DFE19E8CAE64CDB275042704C3593D5ABD56B09B91744DC1131C688C475
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ............................................................................................................................................................................................P\:bqL..p...........k..k..k..k..k..k..k......P\:bqL..p...........k..k..k..k..k..k..k..........................................................................................................................vvvvvvvvvvvvvvvvvvvvv........................vvvvvvvvvvvvvvvvvvvvv.............................................................................................................................................................................................................~.-................k..k..k..k..k..k..k.......~.-................k..k..k..k..k..k..k.................].y.........................................].y............................................................vvvvvvvvvvvvvvvvvvvvv........................vvvvvvvvvvvvvvvvvvvvv.....................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeDetalList.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.474164774021347
                                                      Encrypted:false
                                                      SSDEEP:6:rlf9BDalDahDalDaTc7Ec7iDalDahDalDaRnR6c7gnR6c7iDalDahDalDalc7ecJ:xfCDAxexXhZ3
                                                      MD5:3BF340738EBD6EE9F828ED2BCA2E0D4A
                                                      SHA1:13069A2B3826E4A76AB2CCBAAE91C9B0CB4210F5
                                                      SHA-256:53F848D685E1F3F6B4497AA225CE12772DAF1FB3B1CFA6F11EFCEF76026D5422
                                                      SHA-512:ECD41A2DFD38773B34907F1CF8C7B2886C1924F6DC6ACE7CAD7FA441461F81C2225BA09DCF915C87EE5948A06FA5B16305395F77E756CCA0C47762AFAB6223CD
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..................................................................................................................................................................................................................................................................................................................................................................................................-/...........................................-/...................................................................................................................................................................................................................................................................................................................................................m............................................m...................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeIcon.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.363599689991121
                                                      Encrypted:false
                                                      SSDEEP:24:xHc0chZhRBRjiSaSaSaSaYiSaSaSaSa3ynvr083:hDeZhRBRjippppYipppp3yB3
                                                      MD5:8E5A7399A55E43DB77907676841E3855
                                                      SHA1:F7D9E9484E088F2AD99358B8C2781DE8C1C09B77
                                                      SHA-256:CDF3B4E21BDA8FA54E052AB5E1B2C107D3842EE8274A0D4E0278FFAA816C1580
                                                      SHA-512:E0DA26B5B9C525ABABD3D34CE5080D9C360745659433C563072DDDE9BD8EDC26F9EDDFC51CE717616C68E17523F1D443CFCC6AC22EBEE4C9C1EDE30B4608B8E5
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................sC.tD.zL..`..|..........................sC.tD.zL..`..|...............................w]7v^8v_9.{].vX..............................w]7v^8v_9.{].vX....................................DN/DS2Lh?YsJe~U..`..p.......................DN/DS2Lh?YsJe~U..`..p.............................i|Vj.Vy.b....................................i|Vj.Vy.b........................................................................................................................................{............{..{.

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeIconOnly.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.0998524808006915
                                                      Encrypted:false
                                                      SSDEEP:12:xfwaF23kaAhkaAWVcLAvxO3OcLAvxO3ZGHp2aF2+d945aw5akNdVdk2aG3:x2kBhkBqJxO+JxOsHfdGTrzH3
                                                      MD5:AAE7BB8A3ACBAED936E5D5B23EC46C1A
                                                      SHA1:33A6372A64B881D39C38F97CEE3D705C0AEBE440
                                                      SHA-256:BEDD18354685B3C2BD49637ACF5AAFF7D81CB5A1571429AEB7B73CC1A769AC2B
                                                      SHA-512:48B716481278A96AF46047E2D97830F9333B64323F0BC4FD7158A8D4DCF1C3379483289C16A045278CC5199CF5960D4C8D9CE47E8DE3AED698EA3B837FBD56F7
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...............................................................................................................................................................................................................................................................................................................................................................................................[...m..Fp.........GT.Kvy.wm..j...............[...m..Fp.........GT.Kvy.wm..j.........................X.1............rN............................X.1............rN...........................%?....S_...............{mrj.ws............%?....S_...............{mrj.ws..................................................................................................................................................................................................................................................................................................................v]7..d.............q.`

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeList.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.7968195395937059
                                                      Encrypted:false
                                                      SSDEEP:12:xfwapakavqavSapaYYavYqYavYSapaSa5ca5Saq3:xnavqavdYavYqYavYna5ca503
                                                      MD5:C33D20FF48C6D092840BD2953C5C3AD7
                                                      SHA1:2048D99E732171509FC4810E94914A7C71FEFF08
                                                      SHA-256:43B8992694AA79A08519EFF226ED3D0D8BDFBD86307DC5825DB3148063010163
                                                      SHA-512:0E8621BBF9C2261C3C2AAAA38A07335EA31916CCF9CEF565C9A8615B6561189B7634442E663C54298CF69FBB4E720676B80B042D37F0825830C908BF46896DF2
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ............................................................................................................................................................................................................................................................................................................................................................................................-/.......vvvvvv............-/.......vvv......-/.......vvvvvv............-/.......vvvvvv...........................................................................................................................................................................................................................................................................................................m......vvvvvv..............m......vvv........m......vvvvvv..............m......vvvvvv..................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeReport.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.6429046091916444
                                                      Encrypted:false
                                                      SSDEEP:12:xfwap6eYg/Yqap6YSYg7SYqap6kYgJYqaq3:x7d/mSd7SadJ53
                                                      MD5:960469B9AB5154326C61EC9D3D33F569
                                                      SHA1:1DFF9B0774FAFDC5D19DCEB0E6F28200D3080983
                                                      SHA-256:8B27CBCBF903B68AFE5A31C35D30A1E0499596A530233F597B9446FE03ABC6BF
                                                      SHA-512:B8812C13F1A8FBC4AA95B9329DB295B43DA46A5C6C3828523242DC61A5CE53F4C039C521B0A8D5F1D4F2489ED046C3DE3AA1AA6A783CDCB1A11664D5BC8313D9
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ............................................................................................................................................................................................................................................................................................................................................................................................-/..........vvvvvvvvvvvv......vvvvvvvvv......-/..........vvvvvvvvvvvv......vvvvvvvvvvvv...........................................................................................................................................................................................................................................................................................................m.........vvvvvvvvvvvv......vvvvvvvvv........m.........vvvvvvvvvvvv......vvvvvvvvvvvv..................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\ViewMode\modeTile.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.9589519666937787
                                                      Encrypted:false
                                                      SSDEEP:12:xfZa5KIuzxzHAXRvhG9TKa5KhyPqyPtXu07eu07H0IlYflkTKaZ3:xvzxzgXbiNBlp7ep7Cub3
                                                      MD5:E4203888A863FE9A7B415EAE71FECF18
                                                      SHA1:912F6FD695BD661BA648C4CD602DA60CA4070025
                                                      SHA-256:3B9B9B3DD87D4545EB02970453D5EB998AAEECBD21A0D5738DBAEDAD0FE72DDD
                                                      SHA-512:E75C630E8E8B1136EA12DB7B47504874F41E0D2C5F48DDEEDC5D612E822FABEA1552C0F7D7F8ED21FE86B336C5333DB0B8FD260818EB2383A39EB3679244107F
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ............................................................................................................................................................................................................................................................................................~.d..U.we...................................~.d..U.we............................................]..Z.{...............vvvvvvvvv...............]..Z.{...............vvvvvvvvv..................'i.3y.i....................................'i.3y.i..........................................Q..Ix..................vvvvvvvvvvvvvvv......Q..Ix..................vvvvvvvvvvvvvvv............................................................................................................................................................................................................................................................................................................]R1`[9uwX..s.............

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\icon\NetWork.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 24 bits/pixel, 32x32, 24 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):4150
                                                      Entropy (8bit):5.437651641816077
                                                      Encrypted:false
                                                      SSDEEP:96:5IfIFbcGDt8hXegVbMzsVU0rH3vkCabUr7XH9eVCW:5IfIi6pgaOU0z8CUUrjH9eT
                                                      MD5:AA0D0694DBE4B3B355AC590CB2248B32
                                                      SHA1:D67DEAEE5C8D4A3020289F6758F2439F93D2A93C
                                                      SHA-256:1F480781EE22EC4BA46A9AC4EBCA0801E5C663A9B470BD55326256A28CA30278
                                                      SHA-512:CCE20F39CEFB324CB9B2DA6E87982B1E52D352E2ADBD78AE9FD60186EAE82ACBCFE2A37A4DCA3F8FD4BEC77028D97939BAED441F4A8131B297CA526824D1AB73
                                                      Malicious:false
                                                      Preview:..............h...&... ..............(....... ...........................................t.?t.?t.?t.?t.?t.?t.?..........................................................................r..r..r.....t.?r..r...................................r.....t.?.......................................M..W..Oh+.............................................................................1/.%!.!..C3.YG.V@.............................1'.......XF.q.u^.............................A8.......y...................................(.....7............2&.VD.R=........................WA.........E7.q.u^.......................................n_...........................................+............................................VA...............................................................................................................................?..............................................(... ...@.................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Default\icon\NoImage.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 24 bits/pixel, 32x32, 24 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):4150
                                                      Entropy (8bit):2.9813776037519366
                                                      Encrypted:false
                                                      SSDEEP:48:CA5HFzHHU7rFtih797LNdDLNjtttL3lL3ltttLNBLNBttMQ:A4jN
                                                      MD5:26FBA7C4A56D5981B0909714171A8D3A
                                                      SHA1:C06A7D235AE91AA67097B0F18AA75C3F06DEB90F
                                                      SHA-256:3F831975A123F927384FF069AD5310997EDD50D6BCDC07A7C3ACB3F4E42B2EFC
                                                      SHA-512:7F025A87388913BFA1EC6161917200745FB457133C0C2825367548EBAB642FE699402DAD18E5605FA76C188025A4937576EA4B2D0FB5DD85B2285642F5C71517
                                                      Malicious:false
                                                      Preview:..............h...&... ..............(....... .....................................................................................MMMcbcnmnnmnnmnnmnnmnnmnnmnnmnnmnnmnBBB......MMM....................................BBB......BBB.........BBB...BBB...BBBBBBBBBBBB...BBB......BBB.........BBB........................BBB......BBBBBBBBBBBBBBB........................BBB......BBBBBBBBBBBBBBB...BBB...BBBBBB.........BBB......BBBBBBBBBBBBBBB........................BBB......BBBBBBBBBBBBBBB........................BBB......BBBBBBBBBBBBBBB...nmn...BBBBBBBBBBBB...BBB......BBBBBBBBBBBBBBB........................BBB......BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB......BBBBBBBBBBBBBBB.................................MMMBBBBBBBBBMMM....................................MMMBBBMMM.................................................................................................................................................(... ...@.................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\Back.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, resolution 3779 x 3779 px/m, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):2.8376161908163553
                                                      Encrypted:false
                                                      SSDEEP:24:JgK0if+u1F+uOuff+HHWjxp6ElDEl2blSElw5hl0ysW/9qDWGm:vb///vff+H2jxp85Iyss9qDWGm
                                                      MD5:8C493CAA594547E9611BCCF514FC1B67
                                                      SHA1:549E22B4ADAAD3B8E63A5C176D1B145728730B1E
                                                      SHA-256:E6AEB75437FFCEC8A8523525BCF7507BA97FD5E2F73D2B9ADF18F07205DD8331
                                                      SHA-512:A597F096F1D55E17C29874A34272137CD30A1D3B1E9670BDA087790525F2791F067A51401A0B5D9331816870724D48C84F4469DD188ED11DABB88EF872A00480
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\FilterDlg.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):4.09840380783631
                                                      Encrypted:false
                                                      SSDEEP:24:xeY35U9F9UBaeLaeKyajxajJaexqRaexVawlawCiisBMqK:biDUBaGaXyataVayOayVawlawNisBM
                                                      MD5:2966B68408F653E0404827495DB4F553
                                                      SHA1:A422304577301979F1E9C476516D0AC70641B9FE
                                                      SHA-256:5295DB6ABE3092E18092D05912E2AFDBBF51102135DFDF909072D11265861EC2
                                                      SHA-512:70FD2F9744C5A8518151E5D5E7C3EA701B40E06B594DD075A13EBCBC4106CD2B4756CF164AE481CFE8917788715EDB684EEEAFDF3B8BC8A96708B4342304B0B2
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ..............................................................................................................................................................................................................................................................................~..~..~..~..~..~..~......................~..~..~..~..~..~..~............................~.................~....t<................~.................~....t<......................~.................~...t<....t<.............~.................~...t<....t<...................~.................~....t<................~.................~....t<.....................~.................~.....................~.................~...........................~..~..~..~..~..~..~......................~..~..~..~..~..~..~.................................................................................................................................zg.zg..........

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\FilterVisible.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.7981594162555083
                                                      Encrypted:false
                                                      SSDEEP:3:kl7l/9+lFlJgtDDDDDDDDDDDDDeuRtDDDDDDDDDDDDDDDDDDDDDDDDDDDDeuRtDy:rlf+nPP0JKvvvvvPX30Ty4
                                                      MD5:71C50276D9DCC4966EFAA9C33703942B
                                                      SHA1:289315C2E54A0237773B840F10D760B79F169A1F
                                                      SHA-256:6DB96DD4DD5A713C29D435D8B8E5A3B41F855617FF09DC999900D8097ECB00A5
                                                      SHA-512:8C0B4673788C40F70FC2B59670BD86E9E87C9859F9F27DE0D3804F6CFE01B5A331DC84E497E8AB9A1261478487AF2AE05C678ABB2E3131DE4FD4BEF71276397D
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\Forward.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):2.957705280789514
                                                      Encrypted:false
                                                      SSDEEP:48:nz7iIkHiIZmMYwD+3c+TEqcD1m6mDc6btIbTztIMIfQInNCmm:XivismMHDrcxcZmTwwtQtNHR
                                                      MD5:9D8433F6D676F56851E354973505ABAB
                                                      SHA1:2ACCCCCEC21913AC27363C0D1EB4BB24AB3F7F7B
                                                      SHA-256:3B8D5ED69F6962E4246CEE287B9BC86DEF26A3417763000554B6FCF1B194312B
                                                      SHA-512:6E4864902CB930C961790C556D0EFFE914F0677E42BB0004B27ED67CC231D85698077F05E140C3C1F1C00D86C92E564B86E3B0CEF595BBFABF50796FA1A46709
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\Go.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.703570167812637
                                                      Encrypted:false
                                                      SSDEEP:12:xf+nPPPPJMahMIpMSAMnMwAYIYnUUvsUH0UPPP:x+MSMCMSMY3UUkUUU
                                                      MD5:A3DA6E2671768F02F510CA30F471CE61
                                                      SHA1:36B1C4C0A3272D4A831C564654FEF487D1402628
                                                      SHA-256:677DF153FBD0035BD31E8B8A485D07C981216376A4B54588C21FEDB42F8A59BB
                                                      SHA-512:AE1DD7EDC41585912E405D9820BA024B2BAB641B4676CD1AC189BBB489DFAFF8D7C7B1F49759B1D9FEA13360B02E514C285A50481B1BC8C166F0D3FFA145C495
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\History.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):1.2581087730148897
                                                      Encrypted:false
                                                      SSDEEP:6:JglfZgAtavAtatOavAta1Oa1GaHOa9Ga9+afGaF+af+aP:JgfZgWKWWOKWmOmG6O2G2+qGG+q+q
                                                      MD5:15734D314F9362C4E30EFDF7F22D1088
                                                      SHA1:B940477EA1D63154095BCF0E18FFD46023AEB7A1
                                                      SHA-256:5C08BFDD9569311FD0408771D9CA6AA04BBC330F2097792AE0AA002B27E8B88A
                                                      SHA-512:F546CD30C900FF99E5D2AF29496292AA465B765360C59453228916656F926BEF976E7B129541F855F3FF6F3E76B0EC0042E2EF285BF40B7BA4925A2B46D0EA69
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\Refresh.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.384591513984851
                                                      Encrypted:false
                                                      SSDEEP:24:xgSRpOpZRMpjpIuLmuL2LTLetfrIm7o7o:YRMFzLXL2LTLetcm7c
                                                      MD5:757531C54FE4C334AE91B5E50F64D0C0
                                                      SHA1:55362BD748F917CB5365A9901DCB1388F5A25CE1
                                                      SHA-256:67A33D76405ACBE86CCEB4FD94DA87667863B58A230C5D28423E1023FCAC7E03
                                                      SHA-512:71A6FB2C7AEFDF53F7B23B4768185A1D0F5376088FC179421EC3DCE99AB0E1A96FCE08C68FCF8161B3F7D4E41B0D0D8BAEC70E57C4809DE4CF8435B9DA989A1D
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\AddressBar\up.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.8563260189061794
                                                      Encrypted:false
                                                      SSDEEP:12:xf+vHHMTJTcMTJTcMTJTcMTJTcMTJTcMTJTcEbTbBbTb2ETNNBTNN2an3nqCTvTN:x9dVdVdVdVdVdzdJNN1NND3N7xfljV
                                                      MD5:F93D17AF0C82A0A6F3680EE66E0DCFAF
                                                      SHA1:EEDDC3981F4818656F6A65EC5DDC63247DB5669A
                                                      SHA-256:D0CFD8CA4861B568DAD97AC82CC2B2A818D77DEB959EC48A3FF5FC2D7AF84B12
                                                      SHA-512:B0F576DD9AD2B94D041AE2A87551715BEB2EA11676D0D19B16C107BC2274C34DE1708034F1C9C00219382862C279A7A4E07486AC1EC40CC99305D5E7AEEF268B
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...........................................................................................................................................................................................................................................................................................................~~~~~~.......................................~~~~~~.............................................~~~~~~.......................................~~~~~~.............................................~~~~~~.......................................~~~~~~.............................................~~~~~~.......................................~~~~~~.............................................~~~~~~.......................................~~~~~~.............................................~~~~~~.......................................~~~~~~....................................~~~......~~~~~~......~~~.....................~~~......~~~~~~......~~~...........................~~~~~~...~~~~~~...~

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\Check\CheckLock.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.7491279884800415
                                                      Encrypted:false
                                                      SSDEEP:48:gv5u5upu5umu5uru5u2u5uqu5uyu5ucu5ucu5uZu5u5u5uvva:gvMMcMXMKMHMzMrMxMxMsMMMvva
                                                      MD5:193CD89A4DA5A1BA008FDD82E70CFB52
                                                      SHA1:ED760C12B0F88FE478134CDF07DB88E36DCE15B9
                                                      SHA-256:6EADA79889D96EF7B0B59831FEB6AA0236A4C892F0F9F6B5893D8CF29DD0DB56
                                                      SHA-512:B16D71A7920A05B365921740B6219E6D3F4E2D0744E5E168CB84DE3A81C75ED1FD2655AA8D23ED41F0935CAB1F8DA44E28369699F31F0597D8CE13992C56B491
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ......................................................................................................................................................................................................................................ppppppppppppppppppppppppppppppppppppppp.........ppppppppppppppppppppppppppppppppppppppp.........ppp.................................ppp.........ppp.................................ppp.........ppp.................................ppp.........ppp.................................ppp.........ppp............___..................ppp.........ppp.................................ppp.........ppp.........???......///............ppp.........ppp.................................ppp.........ppp......///........................ppp.........ppp.................................ppp.........ppp................................ppp.........ppp.................................ppp.........ppp..................OOO...///......ppp.........ppp............................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):384
                                                      Entropy (8bit):4.944966729818945
                                                      Encrypted:false
                                                      SSDEEP:6:QEGVj+SViySCJjvvmxVmfPIh5tEymYdCeK8T5xo1YmzQVDAjcbQO1N96L/IVi5b3:QlVCdzWvFPuESAgvoFEz7Vi5bV1
                                                      MD5:4C8AA1CB37F86F36FB270B6E1D580BD9
                                                      SHA1:2A27645742E758E331D33A1B8E684C9324022E84
                                                      SHA-256:63DD00282F5C8425E21F017FCF25D98118F927D288DEE9A6A6F3544133AB642E
                                                      SHA-512:DCE986D2B8339BA0A9B5EBD64692E11780A66108277133CD6CC38A2E3BEE011B93BD3B1E5E5A3071F51DA959782A73E8694EC0CA70BF32C0CF3E37B80760E90B
                                                      Malicious:false
                                                      Preview:..j0.0h0.0j0O0W.i.n.d.o.w.8..0.aX.W0_0..sTn0.0.0.0\Oc0f0.0~0W0_0.0........S0n0.0.0.0.0.0.0.0\O.bW0_0BfK0.0.0_j..L0...RU0.0f0D0.0n0g0.0.0.0.0;u.Pk0 k=.L0B0.0~0Y0.0.....lk0eQ.0j0Q0.0p0.0T0..g0...RW0f0O0`0U0D0.0....~0_0.0.0.0n0.c;un0.0.0.0.0g0.0B0.0~0Y0.0.....0.0.0.0.0.0.0.0eQ.0_0.0.0b_.0.0.0.0.0.YH0_0.0.0.0.0....'`L0.O0j0.0.0F0k0W0_0.0.0J0}YM0j0.0F0k0.Y.fW0f0D0_0`0D0f0.iD0~0[0.0.0

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\TabImg\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 20 x 312 x 24, image size 18720, resolution 3780 x 3780 px/m, cbSize 18774, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):18774
                                                      Entropy (8bit):2.7576387519769177
                                                      Encrypted:false
                                                      SSDEEP:192:Z11111J111111p11111J111111L1111d1111x111Z111rEX:FEX
                                                      MD5:37FD79413B1F3AB00A3B562D60CF034F
                                                      SHA1:34C69FB28D5DF455AB60C90C3A8A7BA949DAE105
                                                      SHA-256:9698808756BF46F68EC344EE0F3A09F2CB830CCB4F811111F0346C7316034739
                                                      SHA-512:9F91839AA0BFD45CAFC50F9C4836F4B3462DEE0AE8E58B50E0EB3617CD38F9E5EEEB2285A064B211A61BBBAF89F2067F082DDF74A25024FDC31427313C173361
                                                      Malicious:false
                                                      Preview:BMVI......6...(.......8........... I.....................................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p..p..p..p..p..p...................................p..p..p..p.

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\TabImg\img.ini

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):70
                                                      Entropy (8bit):3.236661422561559
                                                      Encrypted:false
                                                      SSDEEP:3:Q+rl6lqlodWslRy7adWylUY:Q+MAloROWfOY
                                                      MD5:72E465929FD48D55C859163FB77D5F44
                                                      SHA1:90ECDD8E9B4812691BACAB4FDB0F28BAF70360F0
                                                      SHA-256:2DF630F958A14BA35354A90300346AE9CF4CF7A5C2DE278FAC0327978B7FD3D6
                                                      SHA-512:83C10DD608D3F5471A79A6451E25001F193C25ED506358D130E985F5DB37E650D21A29BCA999BF3460D1452BDAA1FCB6A45B2A1634542FB90980D569AB228438
                                                      Malicious:false
                                                      Preview:..[.T.a.b.I.m.g.].....F.i.x.S.i.z.e.L.=.4.....F.i.x.S.i.z.e.R.=.1.....

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeContents.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.433931005724137
                                                      Encrypted:false
                                                      SSDEEP:12:xfA+1SslXDaXDRLiYLiEyvEMb1vX1Ssv4XDy4XDKri1riEyvEMb1vX1SsXXDYXDq:xh58Q9azKrCrI9vmq
                                                      MD5:9AF53B2ECE221BC8B7DB02E6D9284E2B
                                                      SHA1:5573FE75B775076FA14B45D575F5F2A0EF49BAB0
                                                      SHA-256:024A2860FF2863E470966A002134FE2B4B9C3958D883402E66F388CBC9CB56BA
                                                      SHA-512:8249491D99997A86E1D2CDE52CE239728B1EA06D2F91D0D185D928535D0BA8FAEFB7A6FACA16652214C2BAA370230271F6AA1D7C01F33201D213F41C9F16A72D
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .......................................}..}..}..}...................................................}...........................................}......................................p.F........}....].].].].].].]........p.F........}....].].].].].].].........................}...........................................}.................................................}...yeTyeTyeTyeTyeTyeTyeT...................}...yeTyeTyeTyeTyeTyeTyeT.............}..}..}..}.................................}..}..}..}...................................................}...........................................}......................................._83=B.....}....].].].].].].]........._83=B.....}....].].].].].].].................wj.....}...................................wj.....}.................................................}...yeTyeTyeTyeTyeTyeTyeT...................}...yeTyeTyeTyeTyeTyeTyeT.............}..}..}..}...............

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeDetalList.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.941869983997995
                                                      Encrypted:false
                                                      SSDEEP:24:xb+6FqooKqooWn39yoo7ooWn39IoohooWnfV4VE:x+6joqoWn39po0oWn39/oqoWnn
                                                      MD5:91AFF77E2B55ABF50DEC4FBC31A5850D
                                                      SHA1:13073242634C36DABD21EB195DF522BFFB6ECD65
                                                      SHA-256:99CABE8B2E00F2B3828CE74D7DDFB87522B477A9C97683B749F69ABE4E1DED0D
                                                      SHA-512:2183AF40C63683621A3C9A3AF737BBB06F270D04A54D6FE6AD507A59F46800F650674A6565DA6AF8FC25F3ABA973D05FCA326D1244F38785D6038B6D5BD44E7A
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .................................................................................................................................................................................................x...........................................x....................................................x............................................x..........................................h.......$..$..$.....$..$..$.....$..$........h.......$..$..$.....$..$..$.....$..$................................................................................................................x..........................................x....................................................x............................................x..................................................$..$..$.....$..$..$.....$..$................$..$..$.....$..$..$.....$..$................................................................................................................x..................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeEasyReport.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.938737625512872
                                                      Encrypted:false
                                                      SSDEEP:24:xb+6FAfMAf4nNP4fRf4nNPafnf4nfV4VE:x+6ef7f4nNP4fRf4nNPafnf4nn
                                                      MD5:06539C5CC76EBD607CADFE8C8E91394D
                                                      SHA1:59E302AA8D12F5A45C30E6D34F225AEAFDB75DF8
                                                      SHA-256:4AB595F22556CDA8E1190F94EECBB53ED62A174833ECF4D686E7120700F3F623
                                                      SHA-512:7EB25B4D1A373F7E3ED9CD30BCAFA14E9A62F5FC01091C5A5B6B9B8B02248ED7C776AB671B0D8A519ABF497CB12893F10B05157A98E258AC1C68050B9FF16D5B
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .................................................................................................................................................................................................x...........................................x....................................................x............................................x..........................................h..........$..$..$..$.....$..$..$..$........h..........$..$..$..$.....$..$..$..$................................................................................................................x...........................................x.....................................................x............................................x.....................................................$..$..$..$.....$..$..$..$...................$..$..$..$.....$..$..$..$................................................................................................................x...................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeIcon.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):4.739191521522219
                                                      Encrypted:false
                                                      SSDEEP:48:errrrrrrrr2krrrrrrrrr276gJMJH9csENz:errrrrrrrr2krrrrrrrrr2ZJMJH9csEF
                                                      MD5:40D9DD55F1722DD4ECC15BD913407671
                                                      SHA1:F10FF4E746C26ADC33D3F74D99BF64E639EE7D5A
                                                      SHA-256:0FF66A03AEF1210E5E6D8C723597AB10BCD4A582CCF6AB66D29838020EF4FE88
                                                      SHA-512:AF6972DD84C7933B4668C5B0759F772619217114961428CF4963FF5BAEE26BEEEF883978875AFA05F6D8784C3A80CE0B959E66350FAE9ADAE6BED65FC54C830E
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .............................................................................................................................................................................................................................................................................................}..}..}..}..}..}..}..}..}..}..}..}.........}..}..}..}..}..}..}..}..}..}..}..}...................................................}...........................................}...............^..z,..9..I.Y.\.f..........}.........^..z,..9..I.Y.\.f..........}..............gH..a-.g3.x=.|?..O..Q..`..k..~.....}........gH..a-.g3.x=.|?..O..Q..`..k..~.....}..............(I.,V.Dn1`.Gy._..W..h..h..........}........(I.,V.Dn1`.Gy._..W..h..h..........}..............Ue5i.Y.............................}........Ue5i.Y.............................}................u...............................}..........u...............................}..................................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeIconOnly.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.662289480013408
                                                      Encrypted:false
                                                      SSDEEP:12:xfA+cL6t11I+V1I0tiLFPRoTLFPRJthtMMbcLmXcL6t1wQbwQ1tTreqre0thtMMh:xp1HCPulPdRTrFrliQtWnnnnQ
                                                      MD5:CD040CA51EA75122041A492C6D1E4A2E
                                                      SHA1:18A04E08E001652D73DFA4537EC26420E3417F3F
                                                      SHA-256:B990BDCDB9C7EE569EFD1E45F9C43DE734A2AFDDB7E3CBB1B707E9CAF9B9A6E0
                                                      SHA-512:B86357A509F0CFBD32869561052C8F1CDFE7CE4B83CA26411E5BD872BFB95DB3B31962ACD3A14275087C4A305414EA09A2AD6C56744027970D0F9DF98CB76350
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .......................................}..}..}..}....}..}..}..}....}..}..}..}.....................}..............}............................}..............}..............}........p.F........}...._83=B.....}.......C.........p.F........}...._83=B.....}.......C......}...................}......wj.....}......Vx....................}......wj.....}......Vx......}...................}..............}............................}..............}..............}.......}..}..}..}....}..}..}..}....}..}..}..}....}..}..}..}....}..}..}..}....}..}..}..}.....................}..............}............................}..............}..............}........._83=B.....}...^..........}.....Qs..........._83=B.....}...^..........}.....Qs.......}...........wj.....}.....t.......}....................wj.....}.....t.......}..............}...................}..............}............................}..............}..............}.......}..}..}..}....}..}..}..}.

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeList.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.588092314627301
                                                      Encrypted:false
                                                      SSDEEP:24:xbi+i6Fv9vV9H91Ft319H91Ft3F9H9/VIV4VIVE:xi+i699H91Ft319H91Ft3F9H9B
                                                      MD5:DE843FC9DE48EF2511CEA7D68E462D7B
                                                      SHA1:0B53D2FF4B73BFD38F4F0880C052053F506F4988
                                                      SHA-256:E62EC287BBD18CE1F8A43CD43847E3E9BCFE97A279F187D934FED4F663895D46
                                                      SHA-512:F916AAFF80819099D39249FEAD52D7F79E337A63EDBD9B5EE3A8BA9AF3EE939FAA6927DF9FB8879E90886F868F44F68E147AD1D28CAF033DD31AEED1DA270CC4
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .................................................................................................................................................................................................x......................x...................x......................x............................x.......................x....................x.......................x..................h.......wcRwcR.........h.......wcRwcR......h.......wcRwcR.........h.......wcRwcR............................................................................................................x.....................x...................x.....................x.............................x.......................x....................x.......................x..........................wcRwcR.................wcRwcR..............wcRwcR.................wcRwcR............................................................................................................x.................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeReport.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.938737625512871
                                                      Encrypted:false
                                                      SSDEEP:12:xf+vMkBkClT/lGFJBDL6YDSY0lT/lG9DL6YDSY0lT/lGVDLfVkUYVk4o:xb+6FJBnNP9nNPVnfV4VE
                                                      MD5:977665750C9426F4D1C0126BD003F54D
                                                      SHA1:333C3B2DF9554B56CDB673AF7D375C585F443871
                                                      SHA-256:5E32791455C70422D255FDD19AFEED7D1F01B129E9AFFB1FB5F43663DCB3B556
                                                      SHA-512:C10E00523D165CD1FE9C5551B64D4D81E5B45CE444E74A07E68FB38D39D5BBF45FAA297BD55C5D24806BBD24B0EB5A0E3B8001205EF707A7F57789132FCA427B
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .................................................................................................................................................................................................x...........................................x....................................................x............................................x..........................................h..........wcRwcRwcRwcR...wcRwcRwcRwcR......h..........wcRwcRwcRwcR...wcRwcRwcRwcR..............................................................................................................x...........................................x.....................................................x............................................x.....................................................wcRwcRwcRwcR...wcRwcRwcRwcR.................wcRwcRwcRwcR...wcRwcRwcRwcR..............................................................................................................x...................

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\ViewMode\modeTile.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):3.823151500218946
                                                      Encrypted:false
                                                      SSDEEP:12:xfA+J3NHVfVE/uVs/uVyYmaYm/QwJQwNNvtCNtCVEMbJNXJ3N0E8EkwlO/swlO/7:xNqW+WcchQqQcnjA2stgD
                                                      MD5:52A028C48696F115675C5ECC5C38921A
                                                      SHA1:8B0537AB91800AA3CBEABA4346886543A3E5E9EB
                                                      SHA-256:5D1CF6DFBCA32454CB97B525F30567FEE829D6A4FBB15C534E082314C6727C31
                                                      SHA-512:75BE85FBC5DC2C0E9657F08117BAC2C8791754639249E3A8BBA9D4C1C01DB56E7050C70CCD3837974A4D9C4EF2FEFE805A29CEBBF8EACE3CA588C35B7F175EC8
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .......................................}..}..}..}..}..}..}...................................................}...........................................}.............................1..#.m..=T..'k......}.......................1..#.m..=T..'k......}..................................`..L.........}...yeTyeTyeTyeT.............`..L.........}...yeTyeTyeTyeT..................}....j..9B.....}...........................}....j..9B.....}.............................<...........~.....}...yeTyeTyeTyeTyeT.....<...........~.....}...yeTyeTyeTyeTyeTyeT............................}...........................................}..............................................................................................................}..}..}..}..}..}..}........................}..}..}..}..}..}..}...................................................}...........................................}.............................{=..g".v2..B..a.....}....

                                                      C:\Users\user\Desktop\Asr\Common\img\Win8\icon\NetWork.ico

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                                                      Category:dropped
                                                      Size (bytes):894
                                                      Entropy (8bit):5.038507445625182
                                                      Encrypted:false
                                                      SSDEEP:24:BtiotMOKlPmfQJRNpzKcOuDGDDDDDDDmAhL:biwMxlefKRzKcOhL
                                                      MD5:5D0A1BD8240100AFDA58BB18F7F073DB
                                                      SHA1:206BD3A88B7C772034AA22D40B3992C307312E54
                                                      SHA-256:1FC1A85655BDEA692B6667C9192491E2112D4C30961E4BBFF72721DE13DEB7AB
                                                      SHA-512:094CAD77D63A5848C2544D052EEEACAD25DADD478501EABBF78E23791D621522FC3AD03C8D06E92CE2BEB5D945B42E6F20092F0AA8799798A850FE2877C38DEA
                                                      Malicious:false
                                                      Preview:..............h.......(....... ..............................................................................................................vo.vo...........................................vo.vo................................................................................................$....................|C./0.................%..7!.,............9(*...........0'..........G/.YA.M2.(........1(:.....6..S.....5*.......+..jS.t\.hO.:(........it.9..\.8..8...%........O3..x..v..m.W:....[/.:..N..k..i..o..........!..}c..........|W....;..=..e..... ...............u\..s..n..w..`......@..m.%......3....................................L.e........o..9.:S.xD.I......................J5.,.......D..=.=..G.|d........................a..0..a.@.1.z0.._....................................Z.}....................................................................................?......

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\AddressBar\Back.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):2.510392955764527
                                                      Encrypted:false
                                                      SSDEEP:48:kjrnbTfD7H7T/j7nbTfD7HDTHbzfjbn7z/DbHbzfjbnHa3:T
                                                      MD5:67FF320E29DFD917313468631948F228
                                                      SHA1:17CFAFCC4FBCF9A087259E353525D1FFF4B51758
                                                      SHA-256:AD57B8CBCF9E6BE51E4410C5E28E8B188738011D013A9EED726166FABF544F88
                                                      SHA-512:24367A81D2BDA78212EF33BB222A74A0EC23EE4BEF24C2EE25C6F8FB602BEC1B0307B908D34814333675FB49B1C6BB9B9E05BC0B11E10BAAD0331C6DBE93154F
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0.................................................................................................................................................................................................................................................................@`...........................................................................................@`..............................................@`.@`.......................................................................................@`.@`...........................................@`.@`.@`...................................................................................@`.@`.@`........................................@`.@`.@`.@`...............................................................................@`.@`.@`.@`.....................................@`.@`.@`.@`.@`...........................................................................@`.@`.@`.@`.@`..................................@`.@`.@`.@`.@`.@`..

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\AddressBar\Forward.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 48 x 16 x 24, image size 2304, cbSize 2358, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):2358
                                                      Entropy (8bit):2.5041576044821383
                                                      Encrypted:false
                                                      SSDEEP:12:JgfZIA9l6ADxlX7NlPjhlXbdlPDRlX7tlPjBF5nnvnnnnnPnnHnnvnnnnnfo:JgnH3DPX7nPjvXbHPDPX7nPjfy
                                                      MD5:721D9DAA2B38671E6791796301D9CD63
                                                      SHA1:ACC79D022AED86E42085F1D13CC046DEBDFDB5F8
                                                      SHA-256:80103167904136B80F20CFD393CDB129547D95627C1B2B6808A1D505C2E6F6AA
                                                      SHA-512:63292B8BD19E163F6F17729703753139AB168DF6226F1AA82266C1E854EB9BAE3CB647800051DDE9FF0576B495649E2A536CA65BE43E96883735F39A9F33625C
                                                      Malicious:false
                                                      Preview:BM6.......6...(...0..................................................................................................................................................................................................................................................@`...........................................................................................@`.................................................@`.@`.......................................................................................@`.@`..............................................@`.@`.@`...................................................................................@`.@`.@`...........................................@`.@`.@`.@`...............................................................................@`.@`.@`.@`........................................@`.@`.@`.@`.@`...........................................................................@`.@`.@`.@`.@`.....................................@`.@`.@`.@`.@`.@`..

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\Check\CheckLock.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):4.490405728959861
                                                      Encrypted:false
                                                      SSDEEP:24:xsFwnFw63e2/yzDO8DRJuIFUV8WGw+XwkUHvZMQaVaVJVaVn:KwFw63e2/yPOKryrj+hQZMQ1yn
                                                      MD5:83CBEBB992A4CBC35719D1307194FCFD
                                                      SHA1:A5EBF8E12C8FE30EB7A563D30B0128F8B79590EB
                                                      SHA-256:A57D8514765DF89DE6D102781C8F783781D565AB1CA756F7E5EBEF1F41AF3404
                                                      SHA-512:456268E74DFC1E14A2FD3E12A9FD526D2CA6690135228BBFD045DEBD6A12926622B1C67D4E2C5D16CECE9ACB9CB17E0374B8EC85E05C1B1377507BD0915D2B7C
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ......................................................................................................................................................................................................................................................................................................................................xf.......................................xf......................................fL7.............................................fL7............................................jO;............................................jO;............................................nT?...........................................nT?...........................................tXC...........................................tXC...........................................y^H...........................................y^H...........................................~cM...........................................~cM.........................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\Readme.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):362
                                                      Entropy (8bit):4.903056964509799
                                                      Encrypted:false
                                                      SSDEEP:6:QHYAcvpLmxVmfPIh5tEymYdCeK8T5xo1YmzQVDAjcbQO1N96L/IVi5bV1:Q4AspBPuESAgvoFEz7Vi5bV1
                                                      MD5:086A74F244B30BEF35E0EBC334C81E28
                                                      SHA1:1A528EBE6D42CA7F6B3661F7825927E97BE17DF6
                                                      SHA-256:3977CCF53A36A7D5B4B8FB512F82B6CEE0596A7CBE2E561271BA6AC284BA756D
                                                      SHA-512:989CAB10A7C54E3D1583BA8A3C85A6F6C442347FD6F33E0E5D6A9E5D52401E8CCB2A0F404E0940FCA9C813C6416CB91776F95489957A908E8F7268C43733FEAA
                                                      Malicious:false
                                                      Preview:...e~0.0F.i.l.e.4...k0.0.0.0.0W0_0;u.Pg0Y0.0........S0n0.0.0.0.0.0.0.0\O.bW0_0BfK0.0.0_j..L0...RU0.0f0D0.0n0g0.0.0.0.0;u.Pk0 k=.L0B0.0~0Y0.0.....lk0eQ.0j0Q0.0p0.0T0..g0...RW0f0O0`0U0D0.0....~0_0.0.0.0n0.c;un0.0.0.0.0g0.0B0.0~0Y0.0.....0.0.0.0.0.0.0.0eQ.0_0.0.0b_.0.0.0.0.0.YH0_0.0.0.0.0....'`L0.O0j0.0.0F0k0W0_0.0.0J0}YM0j0.0F0k0.Y.fW0f0D0_0`0D0f0.iD0~0[0.0.0

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\TabImg\img.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 10 x 312 x 24, image size 9984, resolution 3780 x 3780 px/m, cbSize 10038, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):10038
                                                      Entropy (8bit):3.966976517210594
                                                      Encrypted:false
                                                      SSDEEP:192:2d1911J1911J1911J1911J1911J1911J1911J1911J1911J1911J1911J1911J1g:h
                                                      MD5:18B3FD59E370A915E535AF39C4708EA8
                                                      SHA1:C018B84702414BF7AF430A56F1D724C96C6AE6B0
                                                      SHA-256:BE9DE26CCB469F4223AB4F29D2F9609F94C8BF7684032C22EE0062E41298CEBA
                                                      SHA-512:68801916CC8AE1DD550EBBE1591F106B32833BFE48025D3EB1803B32E691196614F7E1851890B0E2A5BB99CC3D2935BBF9A26428C62B11BFA49BC0C8EDE6FC39
                                                      Malicious:false
                                                      Preview:BM6'......6...(.......8............'...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\TabImg\img.ini

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):70
                                                      Entropy (8bit):3.236661422561559
                                                      Encrypted:false
                                                      SSDEEP:3:Q+rl6lqlodWslXIlOdWylUY:Q+MAloRWOfOY
                                                      MD5:1F1090D67FAF11EA59BB34BFC07A53C4
                                                      SHA1:957BC7A383C6739039FC20C0EABF3C0BBAAF7445
                                                      SHA-256:AD8E2112B3F6024FD2E25DFCB089DC30C16B6E1931FA2A1C8874BB7A6ECA72C5
                                                      SHA-512:5CC5C62722F7D6CE8306976FFFC8149F3BC8AC37362FF325A3888C76F8E030EBE87C49470BCE239A19930970626D66FF9C9C1EBC6B997846BC0848EA5E739B7C
                                                      Malicious:false
                                                      Preview:..[.T.a.b.I.m.g.].....F.i.x.S.i.z.e.L.=.2.....F.i.x.S.i.z.e.R.=.1.....

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeContents.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.891884335758618
                                                      Encrypted:false
                                                      SSDEEP:24:xfRRRRRRRRRVhRRRRRRRRRVZRRRRRRRRRVhRRRRRRRRRVZRRRRRRRRRVhRRRRRRj:hR1hR1ZR1hR1ZR1hR1ZR1hR1P
                                                      MD5:CE0A3274CC323C3BF36800F7CDC2FE67
                                                      SHA1:7C364E907DF0D84E81324AF629EAA0A47439BA23
                                                      SHA-256:97D33622C0B0CA678F2F85673428DD505C5EBFBE160419FEFC28CBDE32725BAE
                                                      SHA-512:7A539EEC7E4D3FAFB59DA257EB4272DC4DB9CC190C6118239367035D3162AF03B063C673F49C3DAAB9799D82D37E78C2C35E37855EE32DF1EC1317E00914AFF2
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...............................................................................................................................................................................................................................................................................................343343343343343343343343343343...............343343343343343343343343343343.....................................................................................................................343343343343343343343343343343...............343343343343343343343343343343.....................................................................................................................343343343343343343343343343343...............343343343343343343343343343343...........................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeDetalList.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.5769962069076129
                                                      Encrypted:false
                                                      SSDEEP:12:xf+vFmn+nPmevfHFmn+nPmevfHFmn+nPmevfo:x3
                                                      MD5:9B55B1AEFAF4E0B2C242E87AD5858C21
                                                      SHA1:4C684310E6225AEFA98F2ED284054D1E69323E65
                                                      SHA-256:AD0F03E2243F9AAD2AC33ED1FD575AD464979D3BABD18BA518F7926F1340A466
                                                      SHA-512:579F344497894A4665297B285C5E5C3BFA5F8A47EC8FADA89B330D517761839ED34C929BC1D3F09E64CB939702E5747D9527555366A349990FAE65AB1A06C048
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeEasyReport.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.7070388649965378
                                                      Encrypted:false
                                                      SSDEEP:6:rlf+vAFVvHVvaAFVvHVvaAFVvHVvaAFVvHVvaAFVvHVvaAi5pB58KAoAtVvSgVv/:xf+vnnnnnNpPLHXXo
                                                      MD5:9A5ED83F40DCFF0A74FE10EF85BE1300
                                                      SHA1:2C633E228CFA4D2E5758E76C6D4282DD8E9E9C5C
                                                      SHA-256:6CA2B5732FB81A6D0EE087DD8439E966E3E72B1EEF011346E3D3E360B4F94265
                                                      SHA-512:21A76012C69230F5591A4724D5473F61708EF1640E650776666ED0AF1521C3AE0067E031543C083E10E90AE8EFFE3852351C70576909DE6382EBA924057404BF
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeIcon.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.6233752486346973
                                                      Encrypted:false
                                                      SSDEEP:12:xf+vH/PHV4YHhcaxtSfxtSH5kgV4YHhcQptSJtSH5kAHo:xUcreZkQcL+Zkt
                                                      MD5:C7644421F3172861DD1C7A58DDB51D75
                                                      SHA1:023858D42D4F9E5D34BAEEC25EAE45E38F20286A
                                                      SHA-256:428B93C43C3B0ADC6F857BC5CC43EA51974A248D6E2004DD6734947DC94E27F6
                                                      SHA-512:1252C6E96DF42CEF0BACBC86532DDC993940A58D0C030EE3ACA513DE87C2C6B8AA67476D5749D3831D88FFFDB5996CBA239BB9076E4FAB5E79BB4757A8CEAB6F
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................``...........................................``...........................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeIconOnly.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.00966255108401
                                                      Encrypted:false
                                                      SSDEEP:24:x0CC8CCr22+22ZKKEKKQCC8CCr22+22ZKKEKKN:uCC8CCUCC8CCh
                                                      MD5:50BB5D0E0D5AF961BE557B0C0F0770DE
                                                      SHA1:975E266B9A60DEE8D89632DD80CD4D10C72872D1
                                                      SHA-256:CC498F956F731E733D90171BE3C8007921A6CF539D898C4C53AA7D1F68AEEFC9
                                                      SHA-512:B25CD12D4EB6282D2C2E8CFCD55ACD459F7FD032222ED3647043E42D1A23DDF1536F342870911B9581717840F2FD6CF295FE8FE7612ACF492B7ED99384E14437
                                                      Malicious:false
                                                      Preview:BM6.......6...(... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................``..........``..........``...................``..........``..........``...........................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeList.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.7531879138400197
                                                      Encrypted:false
                                                      SSDEEP:12:xf+vPeHeHmHeHPeemePnHPeHeHmHeHPeemePnHPeHeHmHeHPeemePno:xZ
                                                      MD5:8E7345286396D967EC3DD6B20967164B
                                                      SHA1:1ED6C30CD582D70570A61361E9B96AB2A8CFF29D
                                                      SHA-256:BF2EA1DE194496250D72EC85312097D9408FFFC048E7CD2842D16F849D0CE22D
                                                      SHA-512:6B4A3DFCA8CECD3C79DB35A2AAD57FBFD280D5CCB114FF97385867AC208D85A68B9829DE7081565669F315DBC1082713E85584D533D8063C74AB30DB674FEF2D
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeReport.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):1.469304199527441
                                                      Encrypted:false
                                                      SSDEEP:6:rlf+vAFVvHVvaAFVvHVvaAFVvHVvaAFVvHVvaAFVvHVvaAHNKAoAtVvSgVvaAl:xf+vnnnnnnHXXo
                                                      MD5:8EE17263DBCF53E80E062F9AF32782B1
                                                      SHA1:CDEFFABCB5EA4E27EFA917F9BC158AE28EE44744
                                                      SHA-256:C82D5E8159AE49F9DB53D416F2D9768ACE7A3821A31886AE24590A16355F99B2
                                                      SHA-512:8E24646F715EDFF9F17181C645549C3E43FD205BCA595D0D77DBC90EFEEAE8A26DFF1D5B18FDBF5AE690CF6D1EEA6954B88DC194EE51386733265F576B552381
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\Common\img\mame4\ViewMode\modeTile.bmp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PC bitmap, Windows 3.x format, 32 x 16 x 24, image size 1536, cbSize 1590, bits offset 54
                                                      Category:dropped
                                                      Size (bytes):1590
                                                      Entropy (8bit):2.429160190594456
                                                      Encrypted:false
                                                      SSDEEP:24:x0L/4RU4RTWeW5iMiQL/4RU4RTWeW5iMil:C4RU4RU4RU4R1
                                                      MD5:B4BFED461CF1BC3270F76E381EFDA4AE
                                                      SHA1:FD314637FD55576AB16F5501D7FF81DB20021028
                                                      SHA-256:D07E84CA446148AF5E8874E9DFEDA87F576A07A351EBC5C7959A4586C6391C08
                                                      SHA-512:66318D6220EA84D290A6B8E38D4287A36DAE6475C362E842548E2E823F85E34179B0E4DB7169AA714A71D3A3AC6B14B6DB2DBFF77AC901CA15F797107AA04F6B
                                                      Malicious:false
                                                      Preview:BM6.......6...(... .........................................................................................................................................................................................................fD.fD.............fD.fD......................fD.fD.............fD.fD...........................................................................................................................r;%r;%............r;%r;%.....................r;%r;%............r;%r;%......................``................``.........................``................``.....................................................................................................................................................................................................................................................................................................................................fD.fD.............fD.fD......................fD.fD.............fD.fD........................................

                                                      C:\Users\user\Desktop\Asr\FirstSetting.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):2165248
                                                      Entropy (8bit):6.489175725962961
                                                      Encrypted:false
                                                      SSDEEP:49152:3gDRSnKruRE6tfkvMpHREme0pKFte7J76oaAtLcL1Wg:Iruy62vMdumesKFte7JVaAtLcpWg
                                                      MD5:38C450B7B2A6C6B44008C726D1869BA5
                                                      SHA1:EFF425E5AA5A6124792C0EB4E5ECDCDC02BAC15E
                                                      SHA-256:B9941F40F7EECEE8AA440ACEFAF904B2C74260B842D80A9E04E850BFB7D7AFBE
                                                      SHA-512:0587DFC8E116923B60795AD7CE42F08AE9C2938CD961BB252B77E35A4016F62F6DC54B501EF18F9D4D4B6D36D20F2AFAA1091484DCDCADE1DC15B59C7129A0CA
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                      • Antivirus: Virustotal, Detection: 1%, Browse
                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......./CIdk"'7k"'7k"'7..7}"'7..7."'7..7v"'7.{"6i"'7...7f"'7...7j"'7...7h"'7P|$6}"'7P|#6."'7P|"6.#'7...7L"'7k"&7,!'7.|.6{"'7.|.7j"'7k".7j"'7.|%6j"'7Richk"'7................PE..L....\.................x..........s.............@...........................!...........@....................................|....p...c..............................p...........................0...@............................................text....v.......x.................. ..`.rdata...0.......2...|..............@..@.data...T........\..................@....gfids..$...........................@..@.giats.......P......................@..@.tls.........`......................@....rsrc....c...p...d..................@..@.reloc..............................@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\How to uninstall.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):2130
                                                      Entropy (8bit):4.498956118445745
                                                      Encrypted:false
                                                      SSDEEP:48:hv2Y9mA5gmldZZ+uy6o7MtvNGHReMfI8K8EOC6DP98wskIQG:lh95gOouy6o78N4p5EOjQk+
                                                      MD5:6D58A70795F5EB158A00CB6972BCA264
                                                      SHA1:A2AF7840E8A624B8E376649DF67C51DAF0DA20CE
                                                      SHA-256:D45CD7BEA3B5D71F73ADB2AEB595AFA078D8ABC2F8D255BD3A3CB7CD3E54D899
                                                      SHA-512:B214B2852C08721089FC2264BADA6776D07A42C8B53084D637B5D44A80F4DF9A9DA4D2D0E76356C15EDE41E299337600B7691B47A02F0B27393AFEF1D2611DDC
                                                      Malicious:false
                                                      Preview:...0.0.0.0.0.0.0.0.0.e.l.0.........0.g.e.`1XJ0.0s0.0s.0}j0....o0S0a0.0.0.SgqO0`0U0D0.0....h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./.2...i.n.s.t.a.l.l./.0.4...h.t.m.l.........1...'W.~.0.0.0.0.0.0.0.0.0.0j0i0k0..#..NQ0W0f0D0.04X.To0.0..#..NQ0.0.0.0(.A.s.s.o.c.i.a.t.e...e.x.e.)..0.O(uW0f0.d.W0f0O0`0U0D0.0.....0...0..#..NQ0.0hQf0JRd..0.0.0.0.0.bW0f0O0`0U0D0..........2....0U.n.r.e.g...e.x.e..0.0.[L.W0~0Y0.0.....0..-Ng0.0.0.0.0.0.0.0.0.0.0.0h0.0.0.0.0.0.`1X.0JRd.Y0.0K0^.D0f0O0.0n0g0.0.VT{W0f0O0`0U0D0.0........3...M..^U0.0_0.0.0.0.0.0.0U\..W0f0.0M.n.W0_0.0.0.0.0.0.0hQf0JRd.W0~0Y0.0........4...V.i.s.u.a.l. .C.+.+. .2.0.1.5.n0.0.0.0.0.0n0.0.0.0.0.0.0.0.0L0._..g0B0.0p0.0.0.0.0.0.0.0.0.0.0K0.0JRd.W0f0O0`0U0D0.0.....0.Nk0.0.0.0.0.0.0.O(uW0f0D0.0.0.0.0L0B0.04X.To0.0.R\OW0j0O0j0.0S0h0.0B0.0n0g0T0.l.aO0`0U0D0.0....................[.H.o.w. .t.o. .u.n.i.n.s.t.a.l.l.].........1...I.f. .y.o.u.'.r.e. .a.s.s.o.c.i.a.t.e.d. .w.i.t.h. .a.n.d. .c.o.m.p.r.e.s.s.e.d. .f.i.l.e.,. .a.n.d. .

                                                      C:\Users\user\Desktop\Asr\How to update.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):6044
                                                      Entropy (8bit):4.507496737356454
                                                      Encrypted:false
                                                      SSDEEP:96:1gUumFP2fBXMjQZ/Xwf+rI16ZoMyTk+LbhctFak5HXy7pylI9gkV/VwOxQ:13WfB88BXg+81l5Lb65C7pylb
                                                      MD5:0156E60E77CB039FA4D3A93FC4D9FA67
                                                      SHA1:C36583D27C14D752CA0712954C6851B9898C7A75
                                                      SHA-256:6EDEC895EF5294792F684EBFB45C2A6AE9DE6D7BEFD265093D912E6B0E764CFA
                                                      SHA-512:40EDEF9D1F3BFB9B39BEE8941E4E7E60250AE5AFAF6DA0AFF9CC0E4D8DE36841C81660D12BF1BB832FD4B7140D0C359C5AA0A7B383AF6059A4CB691FE4CEBE88
                                                      Malicious:false
                                                      Preview:...0.0.0.0.0.0.0.0.0n0.f.en0.e.l.0.........0.g.e.`1XJ0.0s0.0s.0}j0....o0S0a0.0.0.SgqO0`0U0D0.0....h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.m.a.n.5./.2...i.n.s.t.a.l.l./.0.5...h.t.m.l..........0.R._...TQ0n0.0.0.0.0.0o0S0a0.0k0j0.0~0Y0.0....h.t.t.p.:././.w.w.w...a.l.l...u.n.d.o...j.p./.a.s.r./.1.s.t./.d.o.c.u.m.e.n.t./.0.2._.0.4...h.t.m.l......................%..8^n04X.T.....0i.S_j0.0.0.0.0.0.0k0U\..W0f0U.p.d.a.t.e.A.s.r...e.x.e..0.[L.W0~0Y0.0........1....0.0.0.0.0.0.0.0.0n0.0.0.0.0.0.0.0L.F0.0.0.0.0.0.bW0~0Y0.0.........0(.1.)...V.i.s.u.a.l. .s.t.u.d.i.o.n0.0.0.0.0.0L0.0.0.0.0.0.0U0.0f0D0.0K0.x..W0~0Y0.0.....0.0.0.0.0.0.0.0.0.0.0.0.0n0..k0._..j0.0.0.0.0.0L0.Y.0.0S0h0L0B0.0n0g0.0;ub..Qn0.0.0.0.0.0.0T0.x..O0`0U0D0.0.........0(.2.)....0.0.0.0.0.0.0.0.0.0.0.0.0.x..W0f0O0`0U0D0.0.....0S0S0g0.0.0.0.0.0.0.0.0.0.0.0.0.0.Y.fY0.0S0h0L0g0M0~0Y0L0.0.0.0.0.0.0.0.0.0.0.0L0.0.0.0.0.0.0.0.0.0.0.0.0k0+T~0.0f0D0.04X.To0.0B0.0K0X0.0.y.RW0f0J0O0._..L0B0.0~0Y0.0.........0(.3.)....}..S..j0.[...0

                                                      C:\Users\user\Desktop\Asr\InstallTest\Test32.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):14848
                                                      Entropy (8bit):5.266372479487364
                                                      Encrypted:false
                                                      SSDEEP:192:obbXGzsg9CASjpvD42oy5/kORz1B92rP+HfVK93xI3iSAJ5pzECAflc5:Ab2zIASBD4xyVkORDorPxSAjAtK
                                                      MD5:DD0F6AFE2D85F7544BF7B5925099DE26
                                                      SHA1:B2285CFA6ABD03AE97A78BF6FF7B43E6786D2F2D
                                                      SHA-256:26467CE1711EC73651102A5AD9999CF6334524B2A378F3D8B9C0143D951407F9
                                                      SHA-512:D3B8C6E4914A7F5AA5D4FDF81BB094FD3FDFCD6F913AFC2B3C35250323AF4982860A0C38D95B18ABCE4E2F4C90AD2095333A013449574DA958071A8C18DAD65A
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^q?.?.l.?.l.?.l.G.l.?.l!f.m.?.l...l.?.l.a.m.?.l.a.m.?.l.a.m.?.l.?.lW?.l.a.m.?.lSa.m.?.lVa.l.?.l.?.l.?.lSa.m.?.lRich.?.l........................PE..L......Y.....................(......0........0....@.......................................@.................................$;..................................0....4..p...................l5.......5..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......*..............@....gfids..0....`.......,..............@..@.tls.........p......................@....rsrc................0..............@..@.reloc..0............6..............@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\InstallTest\Test64.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):17408
                                                      Entropy (8bit):4.735853525442749
                                                      Encrypted:false
                                                      SSDEEP:384:vPo4g0apT8e/wYaSC0krfVcPVUZkriOpgPnM0:Xo4g0ad8TUkRjkHpgPnM0
                                                      MD5:CF042F90A9A7903A260712E2FBC0F549
                                                      SHA1:8F83B4FC9277FD7DDBCCF90911A5A885F1F0EA6F
                                                      SHA-256:01E3678ED29E678C4E38A95211D608B6D7A203B50ADCD6D9106F04B86194D7A6
                                                      SHA-512:0DE2364D49022F481E66C8372BFD626BEDECB6D1667E28AF69E1A39D3C3C18CDB9AD431AEFEB489D7C4A3B28D1124E6A90768B3A5E32C04AB108E5E1FC453A8D
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........ZS..4...4...4......4.4.1...4..9....4..7...4..0...4..1...4...5.K.4..5...4.F.=...4.C.....4......4.F.6...4.Rich..4.........................PE..d......Y.........."..........4......t..........@..........................................`..................................................@...............`......................@8..p...................H9..(....8...............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.gfids..,....p.......8..............@..@.tls.................:..............@....rsrc................<..............@..@.reloc...............B..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\KeyLayout\Explorer\CommandMode.key

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):608
                                                      Entropy (8bit):2.620595220403779
                                                      Encrypted:false
                                                      SSDEEP:6:8SQyRBOSXlBrjf1rwisSYMe9qlj/HyE8HvlllJSXk/1E/OklliKfek//Ed/z:x5RBOklhr1rwi4MeiuHdC/OkqaJcRz
                                                      MD5:42B9CE56A8BA74CE667F431C4DCB1206
                                                      SHA1:4754979C792585B2826D3176BA044F7DB783C523
                                                      SHA-256:B118D57A3F747437A7A75ADC4BB16B1445F32FB6E8A71515A23044EC7928A8B1
                                                      SHA-512:3CC591F8EED160AFB829DBA1DE87EB267FEB9E42F4DAD1258F06C9F706D395E19DB7627CAE0DB52D9555396521165044C94BB1A751A5856937E8C8AFFE474030
                                                      Malicious:false
                                                      Preview:..B.....A........!.'..................C...&...w...............................................u.....*.............h.-.).y.........%.i.&...........@.....................................................................................................................%................................7.*...".v..........._.^.r............z.....%.(.#...+...............................................(...............#.".../.+..........................5.....*...................+.....(.........)............................................................................................................@.

                                                      C:\Users\user\Desktop\Asr\KeyLayout\Explorer\SerchMode.key

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):608
                                                      Entropy (8bit):1.4197275694668652
                                                      Encrypted:false
                                                      SSDEEP:3:0UapKY/nHdlOQ10t/JzloaqlUvllloXw/la/1E/OkllilQldlp1az:01r9lSpvllly/1E/OklliidU
                                                      MD5:F65626A6DB45A9FC163DA00EFC090A17
                                                      SHA1:6E9E6A33E40FB17EB4FDDE3D7B4A89A9ECA376FB
                                                      SHA-256:7FFB7A2BB801E489A63225DABF8CFCCDC4A451F512755796919ED9471E43E940
                                                      SHA-512:E65731514356401C066984239937FFE15F11DE7551117820CB54B4203FB56043FBC51AC277F12F5A418740C739BE0D5895ACF45C1261A1F8B78FDC7D8DED3816
                                                      Malicious:false
                                                      Preview:..................................................................................................u.....*.............h.................i.............@.....................................................................................................................%................................@.*...".v..........._.^..............z.....%.(.#...+...............................................(...............#."................................@......................................................................................................................................................@.

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\??.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):42
                                                      Entropy (8bit):3.2970793275406662
                                                      Encrypted:false
                                                      SSDEEP:3:QIl1rFlTqD9n:QODTw9n
                                                      MD5:02C499B14618893E0EACB131D216071F
                                                      SHA1:62FF0CFB128CEB700FD007B1C5860429AF62B717
                                                      SHA-256:433B38737A8F45E6A51281300F1F37CA325BB04384848924DA80DBF0B2A389AF
                                                      SHA-512:E2B9D7F6DB4C733AC44CE9FBC54FA12C6ADD4B75AC54824B6B4CCD1A20D74A308115BDB8056B1ECD0FA5BC4DC0D6F91930597820BC348BA6A0923178D8DEE596
                                                      Malicious:false
                                                      Preview:..1. .%f....2. ..Y....3. ..y....4. ..Q....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\???(????).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):418
                                                      Entropy (8bit):3.8693682725226775
                                                      Encrypted:false
                                                      SSDEEP:12:QWVBQhSNuoEDz0+iN/mZU2iC6OI6Uobs8:QPh8fEM+iQfixc
                                                      MD5:CD9352F0683713F318815ABE5E1A8020
                                                      SHA1:12E10003B1FCA099DE04105A2EB50C743ADCA838
                                                      SHA-256:EEE912D850318CFF6A3DC6DB43D29F4CDAFF05E692ED5B554E63D63CD65173D6
                                                      SHA-512:4DA8BFF10D8C004F24293C8B0B7FF78C6C106B762FDD4823669468D8B21B675841529D7D9E5B081FFE1B033E3A583EC562C5ED10A9A090C95CFD946BD76EDFDE
                                                      Malicious:false
                                                      Preview:..0.1. ..0.0.0.0....0.2. ..0.0.0.0.0....0.3. ..0.0.0.0.0.0.0....0.4. ..0.0....0.5. ..0.0.0.0.0.0.0.0.0....0.6. ..0.0.0....0.7. ..0.0.0....0.8. ..0.0.0.0.0....0.9. ..0.0.0.0.0.0....1.0. ..0.0.0.0.0....1.1. ..0.0.0....1.2. ..0.0.0.0.0....1.3. ..0.0.0.0.0.0....1.4. ..0.0.0.0.0.0....1.5. ..0.0.0.0.0....1.6. ..0.0.0....1.7. ..0.0.0.0.0....1.8. ..0.0.0.0.0.0.0.0....1.9. ..0.0.0....2.0. ..0.0.0.0.0.0....2.1. ..0.0.0.0....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\???.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):34
                                                      Entropy (8bit):3.9109922530150443
                                                      Encrypted:false
                                                      SSDEEP:3:Q3zGAj4DEPn:QDhjFPn
                                                      MD5:CCC93D8D76F5EC74FC005352A807A205
                                                      SHA1:4640C81DD801AC13522364BCA80277E98AA304C4
                                                      SHA-256:3146B2AC785313FCFA48C5A25CA760E896CD0F8C7FF8130C2D02241FDC6D132C
                                                      SHA-512:01C3DFE35E0A555C71078635D75DF6BE35D42FD683A85892E8847674AD2F3FADCD02579C8BE970E96F30D7D27B7D1C900A0641E0CBF09F99CF42701F8468163B
                                                      Malicious:false
                                                      Preview:..R.......1g......}vN......sfk....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\????(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):146
                                                      Entropy (8bit):3.262971427411271
                                                      Encrypted:false
                                                      SSDEEP:3:QENvlOiCMlAD4vTl65vPKlOmlH6ql64llO4rlaD4vOo00lvlMKiGn:Q+Ialu56lvZl642elep0ltMKr
                                                      MD5:82F5C7F9911F70B6C636985C458C731D
                                                      SHA1:2C1BEAAB90CC31814C168B521C803E893B87C951
                                                      SHA-256:7D1C1583DAB478419413B7E7AA945B29A1723BEBF3F5DD9B8E7B96719B997B78
                                                      SHA-512:468FC2C94A93D79885FD6E4B1690FEE276F82CE99305B2947606440ED59788A84160DC5509DA943F3EAD4AE4C7B8E3CF01918DE8C282504C92B35C3568BF9EA4
                                                      Malicious:false
                                                      Preview:..0.1._.H&....0.2._.I&....0.3._.J&....0.4._.K&....0.5._.L&....0.6._.M&....0.7._.N&....0.8._.O&....0.9._.P&....1.0._.Q&....1.1._.R&....1.2._.S&....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):186
                                                      Entropy (8bit):3.9699450741470845
                                                      Encrypted:false
                                                      SSDEEP:3:Q1yzwVuBoNOl6R9l9lOIUlFLl9pl6NSlOArlhCPQl6yvllO/2lF9lhv0RvHoOT0:Q1yzwVcokl6puLlFLlsYlpCPQl6NelFl
                                                      MD5:EB4BA873C59BAD41D2890714EDBB07E2
                                                      SHA1:EA3572BDA6A8CB856F9383E5DC16D9BE8B782AD7
                                                      SHA-256:73EFB688CE1EF07292884222E530B093BC847A346D9DA2F70449641C12B46600
                                                      SHA-512:BA91857E3A4EED8432CE25506C2B47A755565C99BD31F9A8D219EC778131B55440F0C500DBDA8DA184B3752B641A7A0971A46BBD4D1EE08F5BCA48F0D39A36B1
                                                      Malicious:false
                                                      Preview:.././.o.D0h0U0.0.0......0.1._.'Y.T....0.2._.-N.T....0.3._..\.T....0.4._..T....0.5._.JS.T....0.6._.+g.T....0.7._.+g.\.T....0.8._..Q....0.9._..\.Q....1.0._.JS.Q....1.1._.+g.Q....1.1._.'Y.Q

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\?????(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):280
                                                      Entropy (8bit):3.3382818681024884
                                                      Encrypted:false
                                                      SSDEEP:6:QWak41/lKCqy7lfcKxt24lAF1EnOsleLEiyyMFmlE0lGQGlAPyMPcuiol9:QttKCq+iW2oAF1EOskLEiEF30SlABTiG
                                                      MD5:19278B7867CD53B9A01C6DA6CC88C3DC
                                                      SHA1:3953D9A2BDDBD82DA6F7D81E3FAD201E68385658
                                                      SHA-256:31BD10038DB5AA29452ABC2D0D9FF2B2AF21E150D9DDCB76EEEA964EFD71643D
                                                      SHA-512:FE55698971C0DBD27D09DAB39E4E222CC9548CC1972647A4F5A3DC5417AD4945C0532EB7E8F2A324E302B9EE2593D0B71D73C8F4BEF963CA58A6C45A90600B32
                                                      Malicious:false
                                                      Preview:..0.1. .A.r.i.e.s.....0.2. .T.a.u.r.u.s.....0.3. .G.e.m.i.n.i.....0.4. .C.a.n.c.e.r.....0.5. .L.e.o.....0.6. .V.i.r.g.o.....0.7. .L.i.b.r.a.....0.8. .S.c.o.r.p.i.o.....0.9. .S.a.g.i.t.t.a.r.i.u.s.....1.0. .C.a.p.r.i.c.o.r.n.u.s.....1.1. .A.q.u.a.r.i.u.s.....1.2. .P.i.s.c.e.s.....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?? ??\??????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):762
                                                      Entropy (8bit):5.154254222183282
                                                      Encrypted:false
                                                      SSDEEP:12:Q1zLkjuImKUzPjyUR5UaKX3bf7VIRzPMqk3tIaVnUu6UiTwWSlhAiDDlr5vOFop:QELUHUai7V1qkx62/Hrvnp
                                                      MD5:35255EDCBF1E52AB57E87D217A66F895
                                                      SHA1:2AE166FCB3F3FBB50812A8EE57341E7F8F477E16
                                                      SHA-256:161888C7FEE337642F768A53D8C2F2345E8045D6640788AC13F91463F3A821E3
                                                      SHA-512:2E2488CDD69C01618B28A165879820A2C98DEE57E3DD88577CDD8BC8E6161F8CF93A228FC0BA8FF38D30C320734F54D41FA3D1E179504B9A34B4AC60C94A4730
                                                      Malicious:false
                                                      Preview:.././..W,g.vj0.S.bn0Kb..g0Y0....0.1._..E\\.1._.O0P0.0MRk0..O0.N<yY0.0....0.1._..E\\.2._.-N.Yo0^yn0...0S.g0Y0n0g0.0-N.Y.0..Q0f0O0P0.0....0.2._.Kb4l\.1._...O0J0...Q.0W0f0.0.SKbk0.gSg.0.ca0.0~0Z0.]Kb.0.mF0....0.2._.Kb4l\.2._..gSg.0.ca0.fH0f0.0.SKb.0.mF0....0.2._.Kb4l\.3._..Qs0.gSg.0.SKbk0.ca0.0.]Kbk04l.0F0Q0f0.S.0Y0Y0P0....0.2._.Kb4l\.4._..0F0.N.^.]Kb.0.mF0....0.2._.Kb4l\.5._..g._k0.gSg.0.zf0f0.gn0..Rk04l.0AmW0f0.mF0....0.3._..SS.\.1._..E\h0.TX0O0.SS.n0-N.Yo0^yn0...0S.j0n0g0.0-N.Y.0..Q0f0ikO0....0.4._..S.b\.1._.^y.0|Ts0.0.....0..Q0.0_0.04..03..V...0Y0....0.4._..S.b\.2._......0D0.0.0....0.4._..S.b\.3._.2..V.0.mO0<yY0.0....0.4._..S.b\.4._..0c0O0.0'YM0j0.RM0g02..VKb.0Sbd0....0.4._..S.b\.5._.Hy.0....0.4._..S.b\.6._..g._k0.mO0.N<yW0f0.0.S.V.0g0^yMR.0.NL0.0

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\????\???????(? ???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):240
                                                      Entropy (8bit):4.90044019299535
                                                      Encrypted:false
                                                      SSDEEP:6:Q1lPUBgmVYO1Ky0ol9CGr1W0HLWJ8VxltUVzIc:Q1lPUBgiYtFo3r1W0dK5
                                                      MD5:D42ADCE3939F844532D3D1450E21B63C
                                                      SHA1:2DE379625496B6ABEB38D10DCC02F0A4E707C390
                                                      SHA-256:0DEC683E1B79D4973D24758A43D2A415766FA724360CFEC6E5036C11EE470EA5
                                                      SHA-512:820A321373F62ECBECA3559BC548D496D5705FA806150B7D56D7C91BEA4A3BAF8E5AA25BDC10CCF860376317B34DC8E290879624937CE6DC8B7228AB3446BA10
                                                      Malicious:false
                                                      Preview:.././.&Ns0..o02.0.1.6.t^.^n0.0.0.0.0.0.0.0n0..MOg0Y0....1._..SwmS..e,g.0.0.0.0.0.0.0.0....2._..y.\.0.0.0.0.0.0.0.0.0.0....3._.CSI..0.0.0.0.0.0.0.0....4._..W.s..fk.0.0.0.0.0....5._.qg.S}i)Y.0.0.0.0.0.0.0.0.0.0....6._..0.0.0.0.0.0.0.0.0.0.0.0

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\????\?????????(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):82
                                                      Entropy (8bit):3.470177672364832
                                                      Encrypted:false
                                                      SSDEEP:3:QB2lhyoWCvOBnHhmqrzGYlcVrzM3V8v:QB2+LCen8FhC3V8v
                                                      MD5:4A1B15E94DCF2E32CC6CB8A0433F8119
                                                      SHA1:FEE41A733AFC0D65E46B98BA7B60EDD640A76FEA
                                                      SHA-256:DB7521E14DB4362C8ECA0BDDCFAEFA9E6830B533F3263E04D80AF6A5DDFA537D
                                                      SHA-512:0F0BEA28CDCEDB0320DAA8B8291A452DA40198448C3F9BB27EFAC2ED1C5902B1038A9C39EB90927C4E798A50E0F991B197573B8F2C23A790C064BD558E9EB133
                                                      Malicious:false
                                                      Preview:...0.0.0.....0.0.0.0.0.0.....0.0.0.0.0.0.0.0.....0.0.0.0.0.0.....0.0.0.0.0.0.0....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\?(1??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):74
                                                      Entropy (8bit):2.9784026893685516
                                                      Encrypted:false
                                                      SSDEEP:3:QhGnylgi7oUol+8GIlsXieMXol9:QNkxk6spM4v
                                                      MD5:99075E1772667916FC45553092D77C9F
                                                      SHA1:5D36269E53DD938651469279E5AF1A593627CF6E
                                                      SHA-256:EAF2BF46DC776F9FF5A249414EC04187F3A1B65CF21DE5E61D01D2644AD51DF3
                                                      SHA-512:E074E566AF3ACBD06BADC02C0440C5397A72A43FCF2B437D8DA3A1465853E1AE69BA79755B8053F71D5EDBC398BDC822AFBD681B75FAEA1126BDF48FA1E30637
                                                      Malicious:false
                                                      Preview:...2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\?(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):174
                                                      Entropy (8bit):3.600434198636702
                                                      Encrypted:false
                                                      SSDEEP:3:QE3XlfjWlErVRlF6tzQlfqo1dTlg0wol9PSlF6tCo1ddlfL9PclQrtgHk2w498SU:QI9WlEJ4VQlfqidOMvPSlWdZPclQGkkq
                                                      MD5:8798EFAE8EB14E6C0051D73F4170D6AB
                                                      SHA1:BA841352B5B3CD37333CCA58D3AFB8EFA1E61B90
                                                      SHA-256:3E909C81A385E8806FF3FA724B66AF4054D8A90834EA2E1A86292FA7CCC559E5
                                                      SHA-512:DAEDB6D2A3CE8E0F5511352C5E8BDE655B9F3792200CA42893F023A47545561A1F338405A01D40D0C014D7A3FB3950783AB4692B232A0F852AE05AC65D186323
                                                      Malicious:false
                                                      Preview:..0.1. ..N.g....0.2. ..N.g....0.3. ..N.g....0.4. ..V.g....0.5. ..N.g....0.6. .mQ.g....0.7. ..N.g....0.8. .kQ.g....0.9. .]N.g....1.0. .AS.g....1.1. .AS.N.g....1.2. .AS.N.g....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\??(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):72
                                                      Entropy (8bit):3.426030679486441
                                                      Encrypted:false
                                                      SSDEEP:3:QkmFlvolzfplwSjlONvn:Qk2volNloN
                                                      MD5:E8EBDA8FDD1F6D55B250691E23BD7544
                                                      SHA1:52EC07585213B2E0121D654906400B8E3273F728
                                                      SHA-256:AB1490DCF409236EBD673F35B7D6E69EE066C65D9D15C4EA169D83EDFBFDBB46
                                                      SHA-512:04BF379C059D809D1B5D149A171CB145B0CF98D8CD4D3BCFF3BA933BB6194183BAC4DAB4BAD34F18BB7C055E700963873EEFEB3BF6CBDDD087D725BA364044F1
                                                      Malicious:false
                                                      Preview:..1. ..g....2. .kp....3. .4l....4. .(g....5. ......6. ..W....7. ..e....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\??(???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):72
                                                      Entropy (8bit):3.1482529017086636
                                                      Encrypted:false
                                                      SSDEEP:3:QgGml54vlR6ovbfl02:Qgr549M2
                                                      MD5:BD2830ACA1E0FC2C4E6B682E67A3F3FD
                                                      SHA1:955493521DDEFE8E4DF77CDE8AED117197476699
                                                      SHA-256:E7FBBA84F471695C63DC42FBDEFF32090FBF897A3187DE7B8FFA46BAE2124749
                                                      SHA-512:E92BA822195F2AA0D5D4188435D495126C8A14B596FEC6830B0A673A6A78D5BF8D17347F55FD101D1CAB46875AEDBDB60E94963B9D5E593102A3CCBAE21E8225
                                                      Malicious:false
                                                      Preview:..1. ..2....2. ..2....3. ..2....4. ..2....5. ..2....6. ..2....7. ..2....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\??(????).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):72
                                                      Entropy (8bit):3.1482529017086636
                                                      Encrypted:false
                                                      SSDEEP:3:Q1WJlZ4vLaov7flBi2n:Q1WrZ4uWn
                                                      MD5:8C5748093B0274581C9F744AC635D442
                                                      SHA1:DBF1EBA3DC81C46A7EDB4597A0263AF7C65AD054
                                                      SHA-256:E70D2763FC696B339E3F8C6A79F6C8846483FC6A04621D16DBBB1DD8FA382EDC
                                                      SHA-512:40E7B94EB97B9E85AD50C95C850503F31DCE358D83E5CFE1113E6F230534BF0F8DC460A5A21F423151A53838C8A45161E0407096D7E08EC4DF635DD3FA1966FB
                                                      Malicious:false
                                                      Preview:..1. .*2....2. .+2....3. .,2....4. .-2....5. ..2....6. ./2....7. .02....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\??.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):122
                                                      Entropy (8bit):3.4171366191814903
                                                      Encrypted:false
                                                      SSDEEP:3:QEYo1PNlfjVlWlUrolVRlFjVQlfAvlrl8449qlFhGVHlfmvlklh95HdT49:Q6PTWlU83XQlfA9KQlrGoelrZK9
                                                      MD5:BA3F6FF7EA2E4E05141A9257E85F2533
                                                      SHA1:A41F9BE07422935704B19E02BF4A5F9A5AC95EA9
                                                      SHA-256:F46D0EF8A7748631AAFDBAEC911F1676D9060999275F82299EDDE67CE0E3BC25
                                                      SHA-512:0A3E472067902917DE8F674C26AC5E3620073880BBC773DD2A3A8C71CF9EAE38AD6BBBAB0ACB5DF45CD7D881D5D380A42E98B16819D8C505D2D2FFBF467E650C
                                                      Malicious:false
                                                      Preview:..0.1. .2u....0.2. .YN....0.3. ..N....0.4. ..N....0.5. ..b....0.6. ..]....0.7. ..^....0.8. .......0.9. ..X....1.0. .xv....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample\?\???.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):146
                                                      Entropy (8bit):3.5028313589773936
                                                      Encrypted:false
                                                      SSDEEP:3:QEpXlfbVlWlI+mRlFjoglfNlvlrl+ll3IlFnllfxdcl+Qo16s0o1lkW/l:QuZWlI+mplf3vlIPIlBhdcl+Qi6szC2
                                                      MD5:45D71A29E882AB39AFDAA2BE8C62A61F
                                                      SHA1:A442D84C9A9DC86E7E4179FC11168E7012B4DDE6
                                                      SHA-256:0EC0FBB440ABE0FD8ED1B07A3496D791EE30E2DFF94F27A28F6BF67D348877FF
                                                      SHA-512:235C2456C4AF8DFA30CD5DDCA1DF2AF8525C5FB94912C4BE5EFC39B7C3F0A86DFAF8630F8DC9073EE026D8714D60F9A0FE3CC302FA2DD27703925CD668B4773C
                                                      Malicious:false
                                                      Preview:..0.1. .P[....0.2. ..N....0.3. ..[....0.4. .oS....0.5. .......0.6. ..]....0.7. .HS....0.8. .*g....0.9. .3u....1.0. .I.....1.1. ..b....1.2. ..N....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\Option\MacroHelper\OS_path.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (460), with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):926
                                                      Entropy (8bit):3.4270346445018722
                                                      Encrypted:false
                                                      SSDEEP:24:QsHH4rdpNyLNuFTF4FPvWFXVS8bt5pDGIHnEqHg7Hg+pY9:hHH4rdpNyZuR6NUJ5GIHEqHg7Hg+pY9
                                                      MD5:A3F585A4A3A246E40A931EE329840F05
                                                      SHA1:42C7AB092599C894D88324ADE25D9ADE8C06EDB6
                                                      SHA-256:EFC2C67DCAF1545B916F541F05D4318C2BC515538DFF6C0DA133DF1A5B3080E2
                                                      SHA-512:C5F79FACDDCD5C31EBB81FF868F0296740787B1A9CF085210AB3919DC848889876E8E1BCB6A9D5A102CABF354C040E50D8FCF239900191B49E093DD849AAA922
                                                      Malicious:false
                                                      Preview:..%.C.O.M.P.U.T.E.R.N.A.M.E.%./.%.C.o.m.S.p.e.c.%./.%.H.O.M.E.D.R.I.V.E.%./.%.H.O.M.E.P.A.T.H.%./.%.U.S.E.R.P.R.O.F.I.L.E.%./.%.O.S.%./.%.P.A.T.H.%./.%.P.A.T.H.E.X.T.%./.%.R.A.N.D.O.M.%./.%.S.y.s.t.e.m.D.r.i.v.e.%./.%.S.y.s.t.e.m.R.o.o.t.%./.%.T.M.P.%./.%.T.E.M.P.%./.%.w.i.n.d.i.r.%./.%.A.L.L.U.S.E.R.S.P.R.O.F.I.L.E.%./.%.A.P.P.D.A.T.A.%./.%.L.O.G.O.N.S.E.R.V.E.R.%./.%.N.U.M.B.E.R._.O.F._.P.R.O.C.E.S.S.O.R.S.%./.%.P.R.O.C.E.S.S.O.R._.A.R.C.H.I.T.E.C.T.U.R.E.%./.%.P.R.O.C.E.S.S.O.R._.I.D.E.N.T.I.F.I.E.R.%./.%.P.R.O.C.E.S.S.O.R._.L.E.V.E.L.%./.%.P.R.O.C.E.S.S.O.R._.R.E.V.I.S.I.O.N.%./.%.P.R.O.M.P.T.%./.%.P.S.M.o.d.u.l.e.P.a.t.h.%./.%.P.U.B.L.I.C.%./.%.S.E.S.S.I.O.N.N.A.M.E.%./.%.U.S.E.R.D.O.M.A.I.N.%./.%.u.s.e.r.n.a.m.e.%./.%.U.S.E.R.P.R.O.F.I.L.E.%./.%.C.o.m.m.o.n.P.r.o.g.r.a.m.F.i.l.e.s.%./.%.C.o.m.m.o.n.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%./.%.P.r.o.g.r.a.m.F.i.l.e.s.%./.%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\Option\MacroHelper\asr_path.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):520
                                                      Entropy (8bit):4.653951316307903
                                                      Encrypted:false
                                                      SSDEEP:12:QVRVNCetwEl/xuVNQWnucn8pDVWV3bfguVxJBwVV5:QVpHpl/iTUegYo
                                                      MD5:BD3480C8E3FE1DADE188A9EE86154E8A
                                                      SHA1:09105B290A626F420DB44CBD368F634A58E38B89
                                                      SHA-256:D774CFAA6E168131A7DCC2CB641D4CAF73E5C690C02475D31B9123B49ABB57B9
                                                      SHA-512:96C3474E36EAB3F5E5438AAE4DB5AB146D147349809CF1FB058EB548A2A12D178A0EC7537F799699FF5A767433D75D7A81C8614C1236213EF2CCB5E7EFE8127A
                                                      Malicious:false
                                                      Preview:..%.S.c.r.i.p.t._.d.i.r.%....0.0.0.0.0n0<h.}.0.0.0.0.0.0(..chY)./.%.U.s.e.r._.d.i.r.%....0.0.0.0.`1Xn0.{.t.0.0.0.0.0.0/.%.M.e.n.u._.d.i.r.%....0.0.0.0.0.0.0.0n0<h.}.0.0.0.0.0.0(..chY)./.%.A.p.p._.D.i.r.%...A.s.r...e.x.e.n0.0.0.0.0.0.0.0.0.0.0.0.0/.%.C.M.D._.D.i.r.%....T.h.Y.0.0.0.0n0<h.}.0.0.0.0.0.0(..chY)./.%.C.m.d.P.l.u.g.i.n._.D.i.r.%...D.l.l..Wn0.0.0.0.0.0<h.}.0.0.0.0.0.0(..chY)./.%.V.i.e.w.e.r._.D.i.r.%....0.0.0.0.0n0<h.}.0.0.0.0.0.0/.%.U.s.e.r.C.m.d._.D.i.r.%....0.0.0.0.0.0.0.0n0<h.}.0.0.0.0.0.0(..chY).....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\Option\MacroHelper\macro_input.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (699), with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1404
                                                      Entropy (8bit):5.149998542400562
                                                      Encrypted:false
                                                      SSDEEP:24:QOaEYvUF6PhbfjHEOV8LGufdojHv+5GWrKfNnBhwYmp1B+V2aofZusB5VTQsGE5f:gEYvUgBjHEOKGu1ojHv+5GWefpBhwYmx
                                                      MD5:416CD0E204C6CE130EF7DF7EC22CE076
                                                      SHA1:BA358CBCDAF1749A34355337894AA11442B734F0
                                                      SHA-256:AF604C488944BA0876EC02F7E66A36B4C4BDD88852F5E5D9D763578D2DC1D341
                                                      SHA-512:783896962555DCAB45CEA94B4FC940437056B3FFFC043D1040385B56E1BAA0511EE5390EEE7B2B26265FB2CC20C39C603F048E506CCA5E18B3E4E68877CA6352
                                                      Malicious:false
                                                      Preview:..?.N.o.w.D.i.r.?....s(Wn0.0.0.0.0.0(..g._k0\....Sj0W0)..0.0.0.0.0.0.0.0.0.0.0.0g0.b.0/.?.n.o.w.d.i.r.?....s(Wn0.0.0.0.0.0(..g._k0\....Sj0W0)./.?.D.r.i.v.e.?....s(Wn0.0.0.0.0(..0.0.0.0.T.....0.O.0A.:..0.0C.:..0)./.?.D.i.r.?....s(Wn0.0.0.0.0.T.0.N.NW0j0D0.0.0.0.0.0.0.T..W.i.n.d.o.w.\.S.y.s.t.e.m.3.2.)./.?.T.a.r.g.e.t.D.i.r.?...2.;ub..0.0.0j0.0.0.0.0.0.0.0.0.0.0n0.S.[tPn0.0.0.0n0.0.0.01.;ub..0.0.0j0.0.0.0.0.0.0j0.0.0.0n0.0.0/.?.T.a.r.g.e.t.D.r.i.v.e.?...2.;ub..0.0.0j0.0.0.0.0.0.0.0.0.0.0n0.S.[tPn0.0.0.0n0.0.0.0.0.01.;ub..0.0.0j0.0.0.0.0.0.0j0.0.0.0n0.0.0.0.0/.?.S.e.l.F.i.l.e.?....s(Wx..b-Nn0.0.0.0.0.0.0.0.0.T.0.0.0.0.0.0.0.0.0.0.0.0g0.b.0/.?.s.e.l.f.i.l.e.?....s(Wx..b-Nn0.0.0.0.0.0.0.0.0.T/.?.S.e.l.P.a.t.h.?....s(Wx..b-Nn0.0.0.0.0n0.0.0.T(.+g>\k0._Z0\.L0.NM0~0Y0)./.?.S.e.l.P.a.r.e.n.t.?....s(Wx..b-Nn0.0.0.0.0n0.0.0.T(..0.0.0.0.0.0.0.0d.D0f0+g>\k0\.L0.NM0~0[0.0)./.?.F.i.l.e.N.a.m.e.?....s(Wx..b-Nn0.0.0.0.0.T/.?.N.a.m.e.?....s(Wx..b-Nn0.0.0.0.0.T...b5_P[j0W0../.?.E.x.t.?....s(Wx..b-Nn0.0.0

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\Option\MacroHelper\mouse_pos.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):142
                                                      Entropy (8bit):4.363445535484494
                                                      Encrypted:false
                                                      SSDEEP:3:QhZcxNWmYhVIUKl1x3m2CfpDM8Klo/26V8TuKliE8jSJVGpDM8il:Q/cbhYUbnCftl26V8TFvVGtQl
                                                      MD5:A4CE86F49D7957F43AD01EBA0B7E6FC0
                                                      SHA1:70A169000336550E90A08512A5F7F5AAA497A527
                                                      SHA-256:8951C5BBDF50E65DD76C9365B832F652321A509398C98195294D3D86A3EE47B5
                                                      SHA-512:B91F99B93F3DEDCD0BED04560358D4297D9DE5BBF45180C4C394A5AE3789710554A049BC18773B1BB019BDDDEC72144AF90C4AFE9188C555BD1D0EE388327F95
                                                      Malicious:false
                                                      Preview:..D.E.S.K.T.O.P....0.0.0.0.0.0n0-N.Y/.P.A.E.R.N.T......0.0.0.0.0n0-N.Y/.M.O.U.S.E....0.0.0.0.0.0.0n0MOn./.M.A.I.N....0.0.0.0.0.0.0.0n0-N.Y....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\Option\MacroHelper\on_off.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):42
                                                      Entropy (8bit):3.7855568643177118
                                                      Encrypted:false
                                                      SSDEEP:3:QqxlFCGXcljlSq68x:QqZCGMlsq6o
                                                      MD5:05ED20310C3CA3201A33D865F111282D
                                                      SHA1:924B413C21FC98B52EE86A5D3DFFADB1B0B3A083
                                                      SHA-256:37A54D80C709595C4CB743E012C34ED8D8E2E4640EBB53322016A789F996593F
                                                      SHA-512:C96B7EF36F8AC9484E016936342C8DF3AD53F4FC09848261BFD78EA9F448C5EC564BF656E5EB279DD5B32267988B434F5DCEA486D3DAD320C9FCFD627F99CDD9
                                                      Malicious:false
                                                      Preview:..O.N....g.Rk0Y0.0/.O.F.F...!q.Rk0Y0.0....

                                                      C:\Users\user\Desktop\Asr\Lang\.ja-JP\Option\MacroHelper\status_area.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):468
                                                      Entropy (8bit):4.892743149436992
                                                      Encrypted:false
                                                      SSDEEP:12:QDlzZUlz0pj9g36sVkrDZXpVlpclfMtl0VbYKlC0VYv:Q518y5gqDDZXrlCl2larst
                                                      MD5:3BB79C06A89342356467D458ED6D9CE1
                                                      SHA1:FCB29560FFF7F30275910679B0532C6811CCBC55
                                                      SHA-256:B081AED888A543D95C4BACD9EE622813F3DA5DE27CC68BEE6DDEDE4FA8CE04D7
                                                      SHA-512:82132807D08BCF9AE49ED3E28E5489B9D16989CE83CEF1D609C4BE9900E838986FB9E189A87099C0583B9BFFE78111133187C52EBFA5F4BE5C57A0907E4A74F2
                                                      Malicious:false
                                                      Preview:..%.S.e.l.C.o.u.n.t.%....s(Wx..bW0f0D0.0pe/.%.A.l.l.C.o.u.n.t.%....s(Wn0.0.0.0.0.0k0X[(WY0.0.0.0.0.0n0pe/.%.T.y.p.e.%....s(Wn0.0.0.0.0.0n0.0.0.0n0.eW[.R/.%.D.i.s.k.I.n.f.o.%....0.0.0.0.`1XL0.S._g0M0j0D04X.Tk0o0.Q.RW0j0D0.0~0h0.0.0.0.0/.%.S.e.l.S.i.z.e.%...x..bW0f0D0.0.0.0.0.0n0.0.0.0.T../.%.A.l.l.S.i.z.e.%....s(Wn0.0.0.0.0.0k0X[(WY0.0.0.0.0.0n0.0.0.0.T../.%.D.i.s.k.S.i.z.e.%....s(Wn0.0.0.0.0n0.}.[..0.0.0/.%.D.i.s.k.F.r.e.e.%....s(Wn0.0.0.0.0x0.fM0...0.0.0.0.0....

                                                      C:\Users\user\Desktop\Asr\UpdateAsr.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):2181632
                                                      Entropy (8bit):6.485050891939396
                                                      Encrypted:false
                                                      SSDEEP:49152:M9HK0h9e9ZFcU6/aApTjRik9AZCrUh82G9tLcmGk:M9q0h9e9G/Pik9AZIUh82G9tLcb
                                                      MD5:8EE33EA07F74B4EACF431CB27102BA71
                                                      SHA1:F9AF66EA54775FE6533F470878912390F08D1E8E
                                                      SHA-256:8BE342B395B14D5CDD21C1BEBEBDA21F8D4A0AACD757E3BA3BAB498E1B9D56E1
                                                      SHA-512:1D76AA5CC4314E39E6A9C0D41460EC840C88B4FE5BDFA667AA4177CA9DEE21B5B5BA05328C5F995EE0A77950E38AFE823E8B5D7D4D91996F9FA0421A8F6EB89A
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........U...U...U....b..C....b.......b..H.....W....:.X....;.T....$.V...n...C...n...A...n...=....?.r...U..........D......T...U.c.T......T...RichU...................PE..L......\..........................................@..........................."...........@.................................,...|........Y.................... .....01..p....................1.......1..@............................................text...M........................... ..`.rdata..(7.......8..................@..@.data...<........^..................@....gfids...............P..............@..@.giats..............................@..@.tls................................@....rsrc....Y.......Z..................@..@.reloc........ ......X..............@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\history.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):286052
                                                      Entropy (8bit):5.754859957546486
                                                      Encrypted:false
                                                      SSDEEP:6144:lhdaSGApC3Jr/Oz5H1argTh/JCKSH0XySviQHcHgl:fdaSGApC39Gz5HIrgTFJCKSH0XySXHcC
                                                      MD5:5897D85C1C3DA4F9A0C5CE1EC42FDAAA
                                                      SHA1:50CC98265A4721AE420DEAA61FFFD41C20C7FE02
                                                      SHA-256:EF367665C6F52BDEAB233DFEC1F80C22FA09E4F36CA8901D582A2DE39B7D9290
                                                      SHA-512:EE80010553F2C3CCF4356595A9B8EA1A8832316AB8F1F8B3C14B18E7B12B1E893EA802727A46E4D4FBD3E1BFE981367767B6F629C825237DA60156DF310B99D7
                                                      Malicious:false
                                                      Preview:../././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././. .V.e.r...1.1...x..|..../././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.........V.e.r...1.1...0...0...0..........%.0.0.0.0/..0.0.09e.U.....0.x...0.0.0.0.0.0h.:yW0f0D0.04X.T.0.0.0.0.0.0.Qk0i0n0.0F0j0.d\O.0L.F0K0..R.0.0.0.0.0...R.........%.0.0.0.0.0.0.0.0_j..n0...R.....0.0.0.0.0.0;u.Pn0.0.0.0.0...0.NQ0_04X.T.0]0n0.0.0.0.0n0.0.0.0.0.0P.N.G..0.0.0.0.0.u.bY0.0_j...0...R.....0.0.0.0.0.0k0.0.0.0.0.0.0.0.0_j...0!q.Rk0Y0.0-..[.0...R.....0-..[.S..j0.x...0.0.0.0.0.0...R.........%.0.0.0.0.0.0.0.0.0.0.0.0n0qbD0n0.Y.f.....0.0.0.0.0.0.0.0.0.0.0n04X.T.0.0.0.0.0.0.0W0f0.N,.n0.0.0.0.0.0.0h0W0f0qbF0.0F0k0.Y.f....; .0.0.0.0.0.0K0.0.0.0.0.0.0.0.0.0.0k0\oc0_04X.T.0.0.NMO..d\x0n0.y.RHQo0.0.0.0.0.0.0g0o0j0O0C.:.\.U.s.e.

                                                      C:\Users\user\Desktop\Asr\x64\Asr.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):1475584
                                                      Entropy (8bit):5.99662623184076
                                                      Encrypted:false
                                                      SSDEEP:24576:+ONjEsSMcSrR81YEsjE/m1b1v5P6zorILW3VrT5y/IHX+7LrhJxBxg0dEocpH:+0bSMcLsjt1bFszorDVrYQ3
                                                      MD5:227BA2E9E9D7EC2F7877825ACA97FE89
                                                      SHA1:089CC99D86408AC3A3F348E7C56A1902470EFC8D
                                                      SHA-256:1054F7E7178D03085E6AB8FAF4282904D7AF68C9361A852F8D2103216C282BBE
                                                      SHA-512:104EFF397E8ECA5601CDAD4A73C5F8EECAFFF1B722918E46E337C70387356FAF976ABAFB6CCAB362981FAB192FDAC1065C36B3D97D4B9C00F1D3A4010C04BCF0
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........x...........aD....~@....F......F.......G.....G.....G.....G....F.........;...G.....G(......@.....G....Rich...........................PE..d......\.........."......r...:.................@.......................................... .................................................8...X....`...W......................`D..0...p.......................(...0...................@3..x........................text...[q.......r.................. ..`.rdata...............v..............@..@.data....^...0...4..................@....pdata...............@..............@..@.gfids..X....@......................@..@.tls.........P......................@....rsrc....W...`...X..................@..@.reloc..`D.......F...>..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\AsrLoad.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):43520
                                                      Entropy (8bit):4.859547410380641
                                                      Encrypted:false
                                                      SSDEEP:768:+z3Co4g0aGZ7lJ2K6ROmHF7pCyvolpKglVclAkHf:+7yRJ2K6kyppCyglAgjclAkHf
                                                      MD5:8086F891C4E3D5D87A2ACCB9C175C9FB
                                                      SHA1:CEA312BE1B21685178440F2EB4BFE53B9DAA2FCB
                                                      SHA-256:B2EE8BF4A4D36D51391980592D1839E28EE86F8EE37FD2B064EE1965938CF4E2
                                                      SHA-512:E6B90AE037436A810ADEFBA2AA5C9EEA8DD4EBA017B236459A74063B34364CA6E62D02B0A6A6E4656B204BB68EEB7B917096080E4DCC372DBBAFF4EF98786AC3
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"...L...L...L.......L.K.I...L.s.....L...O...L...H...L...I...L...M.l.L...M...L.9.E...L.<.....L.......L.9.N...L.Rich..L.................PE..d...=.\.........."......"..........4 .........@............................. ............`.................................................@X...........P.......................... M..p...................(N..(....M...............@..0............................text....!.......".................. ..`.rdata..R%...@...&...&..............@..@.data........p.......L..............@....pdata...............N..............@..@.gfids..,............R..............@..@.tls.................T..............@....rsrc....P.......R...V..............@..@.reloc..............................@..B........................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\Associate.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):62976
                                                      Entropy (8bit):5.325227335409025
                                                      Encrypted:false
                                                      SSDEEP:768:KqmU7KDb63Ojz3so4g0aVPhm7Hz2x2oap6LjZVEc4q3wmNrxOIYcp:37Um3OrPhEHz2PBjZVVfRxN
                                                      MD5:D8E4CC019F467DFA933B7E268B68B045
                                                      SHA1:CDD2AD8D1E348476BAA0C5DE7D9F113BAC1E8192
                                                      SHA-256:70206CD7A1CEB2EC79251865D2CF8356D837F63CCE0987BE6A8F94C8110269FF
                                                      SHA-512:FE9E0C028616594ABF867EC76A9702D40D40AA1DFEF4F153A316B30ED83F4ED43EEDFE694215B72FC5DEBDAC6F5A448BCA2C36317896C0EE8C32A2F8EA5BED48
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...wtqPwtqPwtqP~..PgtqP.-tQutqP...PrtqP...PutqPL*rQttqPL*uQytqPL*tQltqPL*pQqtqP...PltqPwtpP.uqP.*xQ.tqP.*.PvtqPwt.PvtqP.*sQvtqPRichwtqP........PE..d.....\.........."......r..........dg.........@.............................`............`.....................................................h....0..@....................P..p.......p.......................(....................................................text...,p.......r.................. ..`.rdata...U.......V...v..............@..@.data...8...........................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc...@....0......................@..@.reloc..p....P......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\Lang\Asr.ja-JP.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):67584
                                                      Entropy (8bit):5.206046662652413
                                                      Encrypted:false
                                                      SSDEEP:768:2OonNKUuVM0HD/QtTQXRuPiK9+PJT/a+OAWTtAI+5n:2DNnEM2D/ITQXMPDoJT/abAQt0
                                                      MD5:A3F88EFD398FC9EBD72602F936B9925C
                                                      SHA1:B68CA7F6FC8CFD5F47FE8614C0278256CCB57DEF
                                                      SHA-256:EFDCFCFE78456BA52D87FBCE812DAEA838EB15F1B40A5BC51EFAC4AF6EC59B7F
                                                      SHA-512:297A74EF6BD98F0A91D953AB463B2CF529B1C771B84B1824C6C7CDEE52ADBAC48064A2BCBFD83A1A0A08DD8673058EB64DAFB735E21B4EBF546E8BB532E31524
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../../../..&.&.-......,......-......&......&... ~.-../..0......-....J..../."...........Rich/..........PE..d.....\.........." .........................................................P............`.................................................l&..P....`.......@...............@......`!..p............................!............... ...............................text............................... ..`.rdata..N.... ......................@..@.data...@....0....... ..............@....pdata.......@......."..............@..@.gfids.......P.......$..............@..@.rsrc........`.......&..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\Unreg.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.192893046394066
                                                      Encrypted:false
                                                      SSDEEP:768:r/zUcaO/o4g0aJn/nzIBfLW7Pjqct6L5BwVVufLe:z4cErIBfLW7Prt6L5BMufLe
                                                      MD5:61456FB37B421B93B3D5E5300BDA0BD5
                                                      SHA1:F485AD56C9696B161ED5D751771718FD564D2797
                                                      SHA-256:07260FA3039477EEFD8E44C58F67C1886BE4A4FDD8D3D2E119AE9FB8D2A52709
                                                      SHA-512:9E20E9E5DD8D4DF3B0DEE397BE3444F129BF09463C6132AC692D1775DD9D702276DBBC23B588E7407F96F1058F9C3E375C00F64614DDABE6856078D2F68910C6
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j^qi.?.:.?.:.?.:'G.::?.:.f.;,?.:...:+?.:...:,?.:.a.;-?.:.a.; ?.:.a.;2?.:.a.;(?.:...:5?.:.?.:.>.:.a.;'?.:.a.:/?.:.?.:/?.:.a.;/?.:Rich.?.:........................PE..d.....\.........."......8...N.......3.........@..........................................`.................................................pq..........x.......t...................`b..p...................hc..(....b...............P...............................text....7.......8.................. ..`.rdata.../...P...0...<..............@..@.data...x............l..............@....pdata..t............n..............@..@.gfids..,............t..............@..@.tls.................v..............@....rsrc...x............x..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):18432
                                                      Entropy (8bit):4.707571905212228
                                                      Encrypted:false
                                                      SSDEEP:384:dsT7mUFeo7rurTP6P8Hp+NHk3hRDAKFw:GOonGO+JAF
                                                      MD5:3BE30AC7E9697F06AAAD72C0C5C03BE2
                                                      SHA1:6E824C5ABE7A03E6B1A8A2502E9A19711FCB72DA
                                                      SHA-256:F6B26DF65CE00AC8C5EC0306FDA8D6BCCE80543C7B1CED53EE66D8D42DA250D0
                                                      SHA-512:44C0F93C914E47DD0D59A930D1F6C2A4AB2CBF8CC5659E26353B6A46998E7CF1C2248A9C46AC92D06A005642FEE09DD41895643652263E55F2FADD816C0BC424
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../../../..&.&.-......,......-......&......&... ~.-../..0......-....J..../."...........Rich/..........PE..d.....\.........." .........:............................................................`.................................................|&..P....`.......@......................`!..p............................!............... ...............................text............................... ..`.rdata..^.... ......................@..@.data...@....0....... ..............@....pdata.......@......."..............@..@.gfids.......P.......$..............@..@.rsrc........`... ...&..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ArcDllInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):71168
                                                      Entropy (8bit):6.094347574084356
                                                      Encrypted:false
                                                      SSDEEP:1536:S5WERhVBiXmSPwBXyd5KAkx8VQPAtkOTcwIArDM6u4bwnp4U:GZRhg+yNVQPcZTKArDM6bMp4U
                                                      MD5:0DD7717FDD22BB571CEA115A8AE4BED8
                                                      SHA1:316FFE1CD4CBB4826CBFE23B69F46217A0978B44
                                                      SHA-256:FBFC227590D522F13D32A92222811DA0AF6FF62960135317D19D78CCD608F5E2
                                                      SHA-512:BE2666433FCC59C1068F0402CA5C98065E1004DC2F214FF3C21EE883B86251ED19A084D2C134862AA852183309647D5384D968E7D9335A4E5C31DE8FE001D37F
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........7..DVpNDVpNDVpNM..NTVpN..uOFVpN...NAVpN...NFVpN..sO@VpN..tOJVpN..uOXVpN..qOBVpN...N_VpNDVqNMTpN..yONVpN...NEVpNDV.NEVpN..rOEVpNRichDVpN........................PE..L......\.....................r....................@..........................p............@.................................x...|....@.......................P..........p...........................0...@............................................text...%........................... ..`.rdata...F.......H..................@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ArcPack.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):257024
                                                      Entropy (8bit):6.197999100849133
                                                      Encrypted:false
                                                      SSDEEP:6144:DNKBCR7CZSEambWd+z5gVg5kJL+Na7g4q1:5KBC7CZ1CVg5k1e
                                                      MD5:0E23E6DB6988B6DD9F09DC2852995176
                                                      SHA1:E1885A0254DC527479CBCF4502C7A11A5D8251DF
                                                      SHA-256:AFBF18348781EB9ACD438201D4B8534C99F4763138A30E639AE7F98D182F1E95
                                                      SHA-512:3639BE7FC9BCD6E33C1D90120F1B8806B7FF2003B3ADCE6B627BB9089FCC5A9FFC8587256C744AE7CC9FB2A2D410F0A6151E93E7BA55DF7D5A90EDD10FF41110
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........udR..7R..7R..7[..7F..7...6P..7.*.7W..7.*.7P..7i..6U..7i..6\..7i..6O..7i..6T..7.*.7O..7R..7...7..6K..7...7S..7R.7S..7..6S..7RichR..7................PE..L.../..\.....................Z......PO............@..........................@............@................................. W...........(.......................\......p...........................p...@............................................text...%........................... ..`.rdata..............................@..@.data................Z..............@....gfids..0............`..............@..@.tls.................b..............@....rsrc....(.......*...d..............@..@.reloc...\.......^..................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ArcUnPack.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):203264
                                                      Entropy (8bit):6.194656333411924
                                                      Encrypted:false
                                                      SSDEEP:3072:KnfiMuUDJQulA3UOSZWoJWHZoKxFcjPmg9J1pdPXZ3gcWwve2rUAANw4:KqwAE/WyKIjZ77t5gae7/Np
                                                      MD5:3E0466006DE123E31789D644ADCBA2AA
                                                      SHA1:DF5E1C0E2AB604D65CCCFA52FBFE39F1A3E97EB2
                                                      SHA-256:57494FC9C9F9284E54CF5B3D701CBA55E0093A44F905B4160924CC09980D9CCA
                                                      SHA-512:DFFC75C8D0EC9AD8D30C03FB79C7635534E5EF249840225F476104A0CFB5DFA98B086877450C94696782547B82D2DF68FF146ABA032491ABE05B0485A6BD9B93
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............................D......|lS.....|lM.................................|lV.........)...6......3.b.............6......Rich............................PE..L...A..\................. ...................0....@..........................`............@.....................................................................C...q..p...................\r.......r..@............0..D............................text............ .................. ..`.rdata.......0.......$..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\BindFile._xe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):13824
                                                      Entropy (8bit):5.126325180665128
                                                      Encrypted:false
                                                      SSDEEP:192:pt0IQU5fTG0hsW3kOf36dOu3PxmACsAJ5/z6U3YHdzmG/79w:pt3QB0KW3kOP6dOu/xmuAaHdTD
                                                      MD5:FCB4A30CE5AD90B72AEB058D439394A3
                                                      SHA1:10E2AB9B2C6F1E6A1F8E2B0EA1AF1F24498144BF
                                                      SHA-256:581C79926C30B226CC2889BB7A6F3DDA05804DC006D3E1DBE1DCDAD6347CDEC0
                                                      SHA-512:1108F115BBCFDFB19E0E321F619FC6BA5EE114F1D58864D4492EB1B46857A6BA401D738BB250C78A62A7118D06A3CDBF2E8133A892953D2F9B6A900BF210F7B1
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D...D...D...<m..D.......D.......D.......D.......D....5..D...D...D..F....D..C....D...Di..D..F....D..Rich.D..........................PE..L.....\.....................$...............0....@.......................................@..................................8.......`.......................p..P....3..p...........................p3..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......(..............@....gfids..P....P.......*..............@..@.rsrc........`.......,..............@..@.reloc..P....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ChgImgFmt.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):73216
                                                      Entropy (8bit):5.512947632765347
                                                      Encrypted:false
                                                      SSDEEP:1536:LnALEok195ipHjR44J6hurj/AR9HoKqHb9p+RPmfzcw/:LnALxkTYjR4Vhurj/ARxoKab2mIg
                                                      MD5:7966C01876BDEA081DC3464F40E806D4
                                                      SHA1:DAA4E01F4078C529F76F069ADA00EE0E2C7CC2DF
                                                      SHA-256:2719A5BB5A5F2900C44FA1083696C042D9295803B0ECBF26EC3152C31736DBA1
                                                      SHA-512:D3E110B90CC70FE6F4F428CDC0ED5D682136ACFC8C51BA1405AC74CD5470E0714BA0F998B0989FCFFB55CFDF0611756B8DC88682B72042435CF0127AE74F6F4C
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$............k..k..k......k..o...k.=.n..k..o...k..o...k...h..k...o..k...n..k...j..k..o...k..j...k.O.b..k.J...k.....k.O.i..k.Rich.k.........................PE..d...2..\.........."............................@..........................................`..........................................................`.......0...............p..........p.......................(....................................................text............................... ..`.rdata...d.......f..................@..@.data...0.... ......................@....pdata.......0......................@..@.gfids..,....@......................@..@.tls.........P......................@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ChgTxtFmt.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):86528
                                                      Entropy (8bit):5.533113724662501
                                                      Encrypted:false
                                                      SSDEEP:1536:Y7Ub42YarFJChtbhruBnwOu1XbYzEnL5XSRRHrOmjC+6:Y7Y3Fmhr481XbdnLyHrOoCD
                                                      MD5:03FF258C9DA6218B33094B8C8C7A5164
                                                      SHA1:9ECE0598B73A5CB5E4C4D100119FEB7F4AD619CD
                                                      SHA-256:77817789D529115C9400D1F518B51A559131FBF7F7DE7344145D8F6A612F496A
                                                      SHA-512:83266C357926E4CD5C9D0C00A622658354FE43C3140F2B7F3F1C6456D902BB6C66812F1B10C59B991656EF895E99C4D0DBB6A84A2426E1838255FB71272C7D56
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........,..M..M..M..5/.M..s...M..K.r.M..K.l.M.....M.....M.....M.....M..K.w.M..M..O......M....C.M..M+.M......M..Rich.M..........................PE..d...A..\..........".................H..........@..........................................`.....................................................|.......@....P..................p...p...p...................x...(....................... ............................text...,........................... ..`.rdata..Tt.......v..................@..@.data...p....@.......*..............@....pdata.......P......................@..@.gfids..,....`.......:..............@..@.tls.........p.......<..............@....rsrc...@............>..............@..@.reloc..p............L..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):52224
                                                      Entropy (8bit):5.368927918329572
                                                      Encrypted:false
                                                      SSDEEP:768:yZpH8o4g0a4Lnix7Cln00UPtf4q7SMmBJAT1zg/aLi/BAreZYh/8SUN:yZiixFfpmBJAT5Qa2pArQH
                                                      MD5:E254F19E503DEC3E76FD42569B449757
                                                      SHA1:7D1EE3126B83B48AA539299DD07B7FA6D62C158C
                                                      SHA-256:2C1D8790C83F7947B2D8D58F7AFDF965B55A861807FF81B09A8FAF2BAE125589
                                                      SHA-512:61203AE9CEA392FA074C9B7A0D44CCC1219BE5211AC1EFC249FE16149F2464367C51A739700974990E572561D7740CD4D9D295B2482E55F086C8A73C141FD344
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......E.....|...|...|.......|...y...|..P....|..P....|..P....|.:.....|.:.x...|.:.y...|...}..|.:.}...|...u...|......|.......|...~...|.Rich..|.........................PE..d......\.........."......`...p......lU.........@............................. ............`....................................................h...............X...................@...p...................H...(....................p..8............................text...L^.......`.................. ..`.rdata...I...p...J...d..............@..@.data...............................@....pdata..X...........................@..@.gfids..,...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport\report.bat

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):242
                                                      Entropy (8bit):5.159852923210077
                                                      Encrypted:false
                                                      SSDEEP:6:hefBbwAEGZfPnJDJqQ9vcAVOc+hBi/Al9IAeK51Vy:8BREGZXJDJHciOc6Bi/AIAeK51Vy
                                                      MD5:095891BC2F1A7CB1BE78F46447A40E6F
                                                      SHA1:23ADAC4A688370C4E3D152450F93203C6CD155F3
                                                      SHA-256:7D751DB9678BEF019B414D870BD5723CC3B741FCE1286B46F2CD113293F525E0
                                                      SHA-512:024A5A21714F673CA772A92EE033B45C3BB76598DFAFEFA2925C6CD7131594B83CF68F57DA0B4221660ABDCABF635820F1A6815D1A4859F650E26D3A490472C1
                                                      Malicious:false
                                                      Preview:@echo off..cd /d %~dp0..cmd.exe /c wevtutil qe application /f:text /c:3 /rd:true "/q:*[System[Provider[@Name='Application Error' or @Name='Application Hang'] and (Level=2) and TimeCreated[timediff(@SystemTime) <= 1800000]]]">report.eventlog..

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\CreateErrorReport\report.ja-JP

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:HTML document, Non-ISO extended-ASCII text, with LF, NEL line terminators
                                                      Category:dropped
                                                      Size (bytes):4120
                                                      Entropy (8bit):6.257425141401826
                                                      Encrypted:false
                                                      SSDEEP:96:2v/JtnxtLjFf5D/4P2CA8KdJ1uappfKYl5FA0qYAPJORg0saiQL8YgvkNKU8:2v//z9CXkL0arNUPtIgh3
                                                      MD5:5A98DB72AC8FE9312AE5EC192A95AABF
                                                      SHA1:6D1C8BD72BA48DF7A1810DEF346783870ECAE187
                                                      SHA-256:8C5F0585CB8BD8DE607776D6313223E6F0881DB7BBCB09F0F4856137D85E6D48
                                                      SHA-512:8E40FD1E3C90905A14E345A32717C9D70C80FB33EF33E69808A8046984BE92836837B61E98B58B53A57803081A5FE0487832153A076CF7CA60749B56FC3DFB03
                                                      Malicious:false
                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html lang="ja">..<head>...<meta http-equiv="Content-type" content="text/html; charset=Shift_JIS">...<title>.....s.....|.[.g...</title>...<style type="text/css">span.c1 {color: #FF0000; font-size: 80%}.</style>..</head>..<body>...<h3>.....s.....|.[.g...</h3>As/R.....[.U.[............l..........A.........W.....L.^...s...........B<br>........c..........@.\..............i....u.t.@.C....R.s.[.@.\.v......30..........j.A..P...Q..........L.....p.......................B<br>...................................A.....p........v........t.......................B<br>....<br>......M.............[.J..........t.@.C.......i.A.h...X.o.[.Q..j.A...M......................W...............\........A..W........A...e...X.....|...L............B<br>....<br>........[.U.[.......M.......................B<br>..

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\CreateLink.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):98816
                                                      Entropy (8bit):5.625081657260572
                                                      Encrypted:false
                                                      SSDEEP:1536:T7X7lnbpw30ywxgRcKbbEimojePMb1q0bjjOW93qBCYONeRpVrd1VZ:T7LVbpW05ijjjeP41q07Om3QpbVrdHZ
                                                      MD5:4E5D3AF70312F886FCBF427D98B85EE7
                                                      SHA1:F76B3305F55CD5448D7F1FCAE69DE2C90E78283F
                                                      SHA-256:12B6D89DB7A66E9C746621C3C18F726A82274BDE27EF4CBF99DDAE3C7E102405
                                                      SHA-512:8DF1751377044529E9F19F7A254EF8079832DD2F62BF7A485A5C7F08E961B9A5FC2846B468106FBC9759DCB57738B613866EE4C4BB5FC4309812A62BD7608FE2
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,..M..M..M..5-.M..c...M..[.p.M..[.n.M.....M.....M.....M.....M..[.u.M..M..O......M....A.M..M).M......M..Rich.M..........PE..d...e..\.........."............................@..........................................`.................................................hV..|.......x.......x....................%..p....................&..(....&..................P............................text............................... ..`.rdata..............................@..@.data........p.......Z..............@....pdata..x............^..............@..@.gfids..,............l..............@..@.tls.................n..............@....rsrc...x............p..............@..@.reloc...............|..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\CreateLocalTumb.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):77312
                                                      Entropy (8bit):5.478006866290145
                                                      Encrypted:false
                                                      SSDEEP:1536:wYLBRnrVdQIm4L89+FF2hyGG1AYtGaunoRo0xr9ail:wYL3kDU89hhyv1AzvD0xr9d
                                                      MD5:291FCB62D75A769ED98F63EC3204F284
                                                      SHA1:5C8B4F6590DCBE7B1F1091E7DB80693D6AB64053
                                                      SHA-256:F16A504EF3E91A92FCB4CECB6C4D9F5E6BADF63C5B761B234CF5846FDE17E7DD
                                                      SHA-512:D257A96009CEF4B81629FB27B6F075004AD8838886FB5CA661ED1B7BDC202637BB08D093C46B957AA78C34CAAD8916DA9F45C61FDBE3AFD7A12B654FF7BA7F51
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........X#?.9Ml.9Ml.9Ml.A.l.9Mlg`Hm.9Ml_.l.9Ml_.l.9Ml.gNm.9Ml.gIm.9Ml.gHm.9Ml.gLm.9Ml_.l.9Ml.9Ll.;Ml.gDm.9Ml.g.l.9Ml.9.l.9Ml.gOm.9MlRich.9Ml........................PE..d......\.........."...........................@..........................................`..........................................................`..(....0.. ............p..(.......p.......................(...0...................0............................text...$........................... ..`.rdata...h.......j..................@..@.data........ ......................@....pdata.. ....0......................@..@.gfids..,....@......................@..@.tls.........P......................@....rsrc...(....`......................@..@.reloc..(....p.......*..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\CreateTumbImg.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):66560
                                                      Entropy (8bit):5.373135279370112
                                                      Encrypted:false
                                                      SSDEEP:1536:NLkuPzvD5bvmVB3aXSnlw18WuE1790xutbROreUp6:NLbPzhI3aClha1JoreK6
                                                      MD5:4A01E64800A042E9DE9F6083DA9F2158
                                                      SHA1:2EBD75CB77C15FCA8BDB872227045549D050E311
                                                      SHA-256:CFF384DA0678608A21812F68CF91AD25469AC1BB5BF45CA4A235374312C93178
                                                      SHA-512:0DADD3069AD3DA9C34F53DCBDA80C91D09EAB438ECAD27307C6F96C23C6B97AAA43A031E1531D5D3265DA33C97224B2E1239F505366AA9DA2160CD1DC771AC47
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........X#?.9Ml.9Ml.9Ml.A.l.9Mlo`Hm.9MlW.l.9MlW.l.9Ml.gNm.9Ml.gIm.9Ml.gHm.9Ml.gLm.9MlW.l.9Ml.9Ll.;Ml.gDm.9Ml.g.l.9Ml.9.l.9Ml.gOm.9MlRich.9Ml........................PE..d...t..\.........."..................v.........@.............................P............`..........................................................0.......................@..........p.......................(...p................................................text....~.......................... ..`.rdata...^.......`..................@..@.data...0...........................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\DivFile.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):85504
                                                      Entropy (8bit):5.526122109732525
                                                      Encrypted:false
                                                      SSDEEP:1536:NCL9Tgwrf/7crWefiGc3Xdb3WFKezXIXd3R76rDID:oLZgwinfiGc9b3WgezQ6rDg
                                                      MD5:3D9ADF99FE02055B7F49E61BA427A526
                                                      SHA1:3DB8D0831BAA2A828EC713E4C4206EB8134589DB
                                                      SHA-256:43B34DC326802A61A4F6DFAD398C394C4B67E3B97A2269606755FCCA1A6F3E8D
                                                      SHA-512:5B6D4C98AD4C323074D950B09C034EC315B1857F72407DF0B7A9DF5D5F1B9DD10234EBAF0B568C39427141E75C7EDB0B2ACCECD60E595726C21A895EF8C6E85E
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..lK..lK..lK.....lK.!5N..lK......lK......lK..2H..lK..2O..lK..2N..lK..2J..lK......lK..lJ..nK.S2B..lK.V2...lK..l..lK.S2I..lK.Rich.lK.................PE..d...R..\..........".................l..........@..........................................`.................................................H%..|.......0....P..0.......................p.......................(... ................................................text............................... ..`.rdata...n.......p..................@..@.data........@.......&..............@....pdata..0....P.......*..............@..@.gfids..<....`.......8..............@..@.tls.........p.......:..............@....rsrc...0............<..............@..@.reloc...............J..............@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\DriveInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):59904
                                                      Entropy (8bit):5.41180696861616
                                                      Encrypted:false
                                                      SSDEEP:1536:2LpVXT6Nyr7uYHHu3f6p2lZ1b/CtDJRyqZj:2LCNyr7uYHU6p2r1DvqZj
                                                      MD5:BAD55D7B2E1912B48C8E8E11A3755DFC
                                                      SHA1:0A951CE453E7FEE55F81A423999950743900B389
                                                      SHA-256:C4C75AABECF9439F027E6711B2E29831C5E1098AA799306E1925084942828C7D
                                                      SHA-512:F58B2422EB4242ED82A5D9EAE036863346998BC41C7B00DC9CCFC6627D6D1E56651ECFDE279EC7CB690BFEC16EA196E27505D3FB4DA2AB169D8019975DD3CE5F
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.bj6.1j6.1j6.1cN31z6.1.o.0h6.1..n1o6.1..p1h6.1Qh.0i6.1Qh.0d6.1Qh.0v6.1Qh.0l6.1..k1q6.1j6.1i4.1.h.0c6.1.h_1k6.1j671k6.1.h.0k6.1Richj6.1................PE..d......\.........."......p...~.......e.........@.............................@............`................................................. ...T.... .. ....................0..........p......................(...0................................................text...\o.......p.................. ..`.rdata.. U.......V...t..............@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls................................@....rsrc... .... ......................@..@.reloc.......0......................@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\Export.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):57856
                                                      Entropy (8bit):5.297974332657519
                                                      Encrypted:false
                                                      SSDEEP:768:QL6o/90OPTzR50KUeo4g0ayuZywYg7Na1V/O1K6uKs9Y8RMDs21:QL6sfR5h5upYg7Na1V/qK6upy8RM421
                                                      MD5:0802AF33C9A576C2002D6FB90557C45B
                                                      SHA1:9776D43B55E8EBF2E5A33F2F3A096EC6993CB8C1
                                                      SHA-256:19D51726B9F2CF9F4D3552FCE838EF3829EAA99C137E782ED166BA8467351C01
                                                      SHA-512:E044390C68B2F2ADB38E1B80766802F8EB2E1455CD5DC0EEC7F4C96289C3ABFF266DF8AD28B1666B6AB3376942FDFB38A38BF5EC86CBA3A06E8B3AA8843ABDCA
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1J.Ju+..u+..u+..|S0.e+...r..w+....m.p+....s.w+..Nu..v+..Nu..{+..Nu..n+..Nu..s+....h.h+..u+...*...u..|+...u\.t+..u+4.t+...u..t+..Richu+..........PE..d...%..\.........."......j...|.......`.........@.............................@............`....................................................|.... ..........8............0...... ...p...................(...(....................................................text...,i.......j.................. ..`.rdata..RT.......V...n..............@..@.data...............................@....pdata..8...........................@..@.gfids..,...........................@..@.tls................................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileAttribute.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):94720
                                                      Entropy (8bit):5.484653084938875
                                                      Encrypted:false
                                                      SSDEEP:1536:G7g3UosVQKVYvdmrKvUzTnfv2AHaGtmR19IgBiORGvOsVtfkQRjurkKEYT6:G76fKVidmrKszT32MaGtQ1mjOA6Qurkt
                                                      MD5:BAF8211DAC11FF836C14779F48969ABA
                                                      SHA1:D92C61C04D86B2CF166F554B560F74280690F1F8
                                                      SHA-256:4807A5181EF1AE710A7FBCA1D1F590A5E09636FA57E631039BFAE4CED4C2BD36
                                                      SHA-512:92FBAEAFF719F5CB0706383646A21A4B840524664C86F0B6941B73F846AE84E63007A00208AD787B7C85EA4B8CDBAFC062AC61A003B1ABF411A16BA32941C69C
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..x..x..x..q.W.h......z...w..}...w..z..C..{..C...v..C...d..C..~...w..c..x..D.....t....;.y..x.S.y.....y..Richx..................PE..d......\..........".................T..........@..........................................`..................................................1..|............`..........................p.......................(...p...................H............................text...\........................... ..`.rdata...|.......~..................@..@.data........P.......:..............@....pdata.......`.......>..............@..@.gfids..,....p.......J..............@..@.tls.................L..............@....rsrc................N..............@..@.reloc...............j..............@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileCpMv.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):265216
                                                      Entropy (8bit):5.7248769060923115
                                                      Encrypted:false
                                                      SSDEEP:6144:kemXInOR+NRQz4rJ3il2tSi/p7y6ZwmMOUw5PypfQW:kemXInO+Q2LtNy6SCUMPy2
                                                      MD5:7557D26AA66914BBE599BF44D3B22824
                                                      SHA1:934975C65611833CFD713F2FF11C2203AB668A24
                                                      SHA-256:4F30DEF740D8BFCA6C67C9FCAA7B1AFF83087E6438A683FB4277075EBBE9EB1D
                                                      SHA-512:3FE8BBB6BE471CC90226FC86D993F4CDC25056228DCCC4CE2CFEF64B3EA75CEBBFDCAC38984CF48C4CC5164E11764A0134047596EDE06CDFF32EE0B27B502CF5
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5t..q...q...q...xm-.e....L..s.....p.t.....n.s...JK..r...JK......JK..m...JK..w.....u.j...q........K..c....KA.p...q.).p....K..p...Richq...........PE..d.../..\.........."..................@.........@.............................P............`.......................................................... .......... ............@..$...`...p...................h...(....................................................text...l........................... ..`.rdata...<.......>..................@..@.data...............................@....pdata.. ...........................@..@.gfids..,...........................@..@.tls................................@....rsrc........ ......................@..@.reloc..$....@......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileDelete.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):82944
                                                      Entropy (8bit):5.512187857273035
                                                      Encrypted:false
                                                      SSDEEP:1536:S7H/72a06KiYIUCbfgzm+5JG1i7tadzbDwZJynLRUgrrreve+:S7fSaEutkaK41sADouSgrrwe+
                                                      MD5:F09D9086EB3F530D8AEE3674E45EDF9D
                                                      SHA1:857ECE6F4882EEB7DE4132E8FE37917497D4D99A
                                                      SHA-256:6A48759F33F27329352028A9C59EEAE5B665AC377A69A99A38BD3CFC45CC495D
                                                      SHA-512:DBC62AFC3AD1C866D0CE599541C510FF2481C20A8548D667A0089220813FDC9F1AE399A571D935C9FE5706824F54DDBE8CE363B3AAB3D27FFA2B0DAC30EFD37E
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......n6-.*WC.*WC.*WC.#/..>WC...F.(WC...../WC.....(WC...@.)WC...G.$WC...F.1WC...B.,WC.....1WC.*WB..UC..J.&WC....+WC.*W..+WC..A.+WC.Rich*WC.........................PE..d...=..\.........."............................@..........................................`.................................................@................P..................p.......p.......................(...0................................................text...\........................... ..`.rdata...q.......r..................@..@.data...p....@......................@....pdata.......P....... ..............@..@.gfids..,....`.......,..............@..@.tls.........p......................@....rsrc................0..............@..@.reloc..p............>..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileExecute.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):62976
                                                      Entropy (8bit):5.35986300307242
                                                      Encrypted:false
                                                      SSDEEP:768:3LB1fc2VhNwnhuGLo4g0aNhrzT4BbK6wN1kdkol9Mg6wJYUR3P9dhFOo:3LBFc8bC8GShnKb2N1kdkol9ZWUR/v5
                                                      MD5:5FB2FB75EC48BA68D7DFA87D9A82AA51
                                                      SHA1:92D02866B3F7E2272930267FCB14FCCCA37AC894
                                                      SHA-256:7D27CA6C8931E30D1C0BD93DD350F055255513265B22AA89A172F33D26C1CE47
                                                      SHA-512:6C6ECF9570694E07AC37A27C017472A28E7765C8DBCAC61FD73CE6A6E3AD470030C62617BA83DAA70E8942BDB6429FF2D07758BDD634D256CEE3354714B07700
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......>X#'z9Mtz9Mtz9MtsA.tj9Mt.`Hux9Mt..t.9Mt..tx9MtAgNuy9MtAgIut9MtAgHua9MtAgLu|9Mt..ta9Mtz9Ltq;Mt.gDup9Mt.g.t{9Mtz9.t{9Mt.gOu{9MtRichz9Mt........................PE..d...M..\.........."......x...........n.........@.............................P............`.....................................................T....0.......................@.........p.......................(...`................................................text....w.......x.................. ..`.rdata...X.......Z...|..............@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileExport.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):91648
                                                      Entropy (8bit):5.53053238988422
                                                      Encrypted:false
                                                      SSDEEP:1536:HA7EGBc8Wtl+2Ql1Tuw3yAIFo2h1o5NmFdftqXfNX2SyRRSrNApY:HA7TZWtlXQlMws71umFiPKSrNAp
                                                      MD5:AF1F0896E66DE9136231BBCC65596342
                                                      SHA1:49E17B4A55ADE5C839BDC37E6363DD8C819EFF2C
                                                      SHA-256:B9E670AA882811E1BB6E8523A90E97F1DE78A84684DFDB57F7A0B4B44B012990
                                                      SHA-512:85B0A65F251DDF8E5DCBD655923A82E39DC64055D3241CBDA8778128ACDA48EDDC97319A0783BA5A22AFB9F3DA6CC0BCB4A81BC73BD15855DF9CC84B70A04B1D
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......pZ..4;h.4;h.4;h.=C..&;h..bm.6;h....1;h....6;h..ek.7;h..el.:;h..em./;h..ei.2;h..../;h.4;i..9h.ea.>;h.e..5;h.4;..5;h.ej.5;h.Rich4;h.........................PE..d...^..\.........."............................@..........................................`.................................................0/..........8....`..L...............X...P...p...................X...(....................................................text...l........................... ..`.rdata..6y.......z..................@..@.data...@....P.......:..............@....pdata..L....`.......>..............@..@.gfids..,....p.......J..............@..@.tls.................L..............@....rsrc...8............N..............@..@.reloc..X............`..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):86016
                                                      Entropy (8bit):5.530878377103536
                                                      Encrypted:false
                                                      SSDEEP:1536:5Yt8LA/s36ggvFQZRqDm1wxTZzkVll0YS13qPZRyY8p:G8LSSuiZI61wxTZzkVlzS13bY8p
                                                      MD5:5F6FFA24C38020BC8E239C1876F27D05
                                                      SHA1:D4CBBE2FFC61CA6651384A5D4DBE53B7ACDEADC0
                                                      SHA-256:9E004C6FE93B2DEBDFD69C31E111070064CE5FA75AB93C782D98195A390C28C2
                                                      SHA-512:5EB87EA9335CA937613A5EBFC8C87117BE9D19555430AB2757C85DECB17C58804A9B27CF1F95F07A17FDFED503B40B98AACB5A5D34BFE36C3DBA80DB440D988D
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........@O.H@O.H@O.HI7DHRO.H...IBO.H...HEO.H...HBO.H{..ICO.H{..INO.H{..I[O.H{..IFO.H...H[O.H@O.HjM.H...ILO.H..(HAO.H@O@HAO.H...IAO.HRich@O.H........................PE..d...n..\..........".................0..........@..........................................`.................................................X...........8....P..d.......................p.......................(....................................................text............................... ..`.rdata...w.......x..................@..@.data........@.......*..............@....pdata..d....P......................@..@.gfids..,....`.......:..............@..@.tls.........p.......<..............@....rsrc...8............>..............@..@.reloc...............L..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileNameCp.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):93184
                                                      Entropy (8bit):5.539462258265884
                                                      Encrypted:false
                                                      SSDEEP:1536:P7oveFB6B9iSKEH2MhXEGHs8cp66maE1AxTWokuLtEz30bA51RR6rgSb:P7qN97DWBdLmN1AxTWokum6I6rgSb
                                                      MD5:4BD361660BE84712DCA7BEDAF4DBBB74
                                                      SHA1:3631388688E7237E22FC940DF7AE1FE92BA8EF24
                                                      SHA-256:F2B9F37F99CDF9877DE6394B1484173BA8C01F9BD43E469CB2813FCF910577DB
                                                      SHA-512:5D037830097D30A77EE88CDB828F5FEE1A3AD277734EBD64569740C60115E6347D26DEEF77B7CC8269D95D65E8D95026D999EBC749DE9C199144249D87462A19
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........X...X...X...Q.q.J.......Z....h,.]....h2.Z...c...[...c...V...c...C...c...^....h).C...X...M.......S.......Y...X.u.Y.......Y...RichX...........PE..d......\.........."...........................@..........................................`..................................................B...............p......................0...p...................8...(.......................(............................text............................... ..`.rdata..F|.......~..................@..@.data... ....`.......D..............@....pdata.......p.......H..............@..@.gfids..,............T..............@..@.tls.................V..............@....rsrc................X..............@..@.reloc...............h..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileNewEx.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):68608
                                                      Entropy (8bit):5.37458281495525
                                                      Encrypted:false
                                                      SSDEEP:1536:PnLcBFQWbSyCpWskN+M317P9iYNRM+1rFIsT:PLvg2WpN+017P9u+1rFIsT
                                                      MD5:923EA71744650B4ED102B37A594C1958
                                                      SHA1:16553631C20463BA4E5530F1C76CDD7754489DA9
                                                      SHA-256:CF921296D8F617C7CBCAD8D70DC1D90C41C712AF2E672146599C25169BBC0B99
                                                      SHA-512:51B2494DA80A7F81FE53DA9F0210B703DB0D2CCCFAEEC7D00B0FCCC3CB0354AD96B16DA3EA508BFEE45613F7F0C913C08499B0CC12DFB86B0A5F25E9D746EFF8
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>X ?z9Nlz9Nlz9NlsA.lj9Nl.`Kmx9Nl..l.9Nl..lx9NlAgMmy9NlAgJmt9NlAgKma9NlAgOm|9Nl..la9Nlz9OlZ;Nl.gGmp9Nl.g.l{9Nlz9.l{9Nl.gLm{9NlRichz9Nl........PE..d......\.........."..................{.........@.............................p............`.................................................H...|....P..P.... ..d............`..........p.......................(....................................................text.............................. ..`.rdata...`.......b..................@..@.data...............................@....pdata..d.... ......................@..@.gfids..,....0......................@..@.tls.........@......................@....rsrc...P....P......................@..@.reloc.......`......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileRename.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):87552
                                                      Entropy (8bit):5.5487081696964236
                                                      Encrypted:false
                                                      SSDEEP:1536:leU7uJN9eCYxEj797tHiiHHImSrPHQJ7LNY71KSR+4nzIwYBSRRorv0hn7och:leU7gyE15H0mSUtO1n5s2orvg7o+
                                                      MD5:94188EBB7082EED01F6682A7C98B082D
                                                      SHA1:484753A82ACC0EE08FC79A96C6185488A3AFEDD6
                                                      SHA-256:EBD19A033C392E4DC590B72DC00EB7E0BCD646F098F77B8B3595FE84CE5B32B2
                                                      SHA-512:134B774F9341213656DD80D32B244FBB64819B8619ECEB9513BBE8E64A99F29D5BE97F6FCFBA5ADE8BA0CD6C964CF91DCD0D64A81C1FC180E41C6B3FEA8C511B
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......pZ..4;..4;..4;..=C{.&;...b..6;....&.1;....8.6;...e..7;...e..:;...e../;...e..2;....#./;..4;...9..e..>;..e..5;..4;..5;..e..5;..Rich4;..........................PE..d......\.........."............................@..........................................`................................................. +...............`......................0...p...................8...(....................................................text...L........................... ..`.rdata..Nu.......v..................@..@.data...@....P.......,..............@....pdata.......`.......0..............@..@.gfids..,....p.......<..............@..@.tls.................>..............@....rsrc................@..............@..@.reloc...............R..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileRenameEx.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):254464
                                                      Entropy (8bit):5.804661117522224
                                                      Encrypted:false
                                                      SSDEEP:6144:eSwmUdHS5OYDvW5sRBk+Q7Z1Tp2+C8DQz0OVJChLQlJiE0tQ7kmn6:eSwmUdy5OrevXVwV+Z7j
                                                      MD5:A23B81D0F44C722ED03A058AC86AAF17
                                                      SHA1:E22CE0F0DB856927F7DBC99A1A79B1E4811BBCAF
                                                      SHA-256:176B3A8087A912641358C4B1489773CCF51F5E5B1F59BB98A1EA438A62209606
                                                      SHA-512:4274E9A9E897FEE225E35D12BBAF6AE1986049C3B2EFD82AC32D3FBA58F8C23F3BCC43A02770BF0567690D8BD17D8ABDE5D0C514614A8F05B4B4E884B4917693
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........8.b.k.b.k.b.k...k.b.k_;.j.b.kg.Uk.b.kg.Kk.b.kg.Pk.b.k.<.j.b.k.<.j.b.k.<.j.b.k.b.k.a.k.<.j.b.k-<.j.b.k(<dk.b.k.b.k.b.k-<.j.b.kRich.b.k........................PE..d......\.........."......N.....................@.............................@............`..................................................i...........-...................0......@...p...................H...(....................`...............................text...;M.......N.................. ..`.rdata..F3...`...4...R..............@..@.data...0...........................@....pdata..............................@..@.gfids..4...........................@..@.tls................................@....rsrc....-..........................@..@.reloc.......0......................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileReproduction.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):62976
                                                      Entropy (8bit):5.385422230208554
                                                      Encrypted:false
                                                      SSDEEP:768:USL9pMiEIhlz1io4g0aAb5VW5hhhZymIS1C3wSz5gUQWmIgYARzo0Bz:USL9iiEulxe5OhCS1C3wSXdrARz/Bz
                                                      MD5:8D153B84719F7C17D2C8F0ACEA065C22
                                                      SHA1:7E9F5FFDD0550DD19083683BE7381D65B09867A9
                                                      SHA-256:C9AB637E8A7503CB2B2E88F97DAA33D5F09BC72B5C0B8132595B6FE7D7AF6396
                                                      SHA-512:BB2C4AF87E5FCDBEB48B1A7F22ED99D4BE011920C2B9B0ABB8BBA9B5E5EDC1D74A2AE0B4B06C360E4FFDE8EB96A07973E42F8823D0CEBE9B899D288AAC1A863F
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..~..~..~..w.t.n....|..j).{..j7.|..E..}..E..p..E..e..E..x..j,.e..~..[.....u.........~.p..........Rich~..........PE..d......\.........."......x...........n.........@.............................P............`.................................................H...h....0.......................@..........p.......................(... ...................0............................text...<w.......x.................. ..`.rdata..&Y.......Z...|..............@..@.data...(...........................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FileShortcut.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):101888
                                                      Entropy (8bit):5.592422780165084
                                                      Encrypted:false
                                                      SSDEEP:3072:O7gj2YEiAmCc3bHBKjnRN1BTbZTXrmNvf:OJYPAmCMhKjnRDBTbBXrmNv
                                                      MD5:EC6CE2C8D6BCCA4D7574FA5179A38ABD
                                                      SHA1:96A646975F038BA8589D84BB57678D960DE0C651
                                                      SHA-256:C61999D9B8662B1706E3FA6D3A8E7899025FB082C958F1C04554D11C51905A31
                                                      SHA-512:615702D48A7732F14188EA788EFCDB42EC322DC4BB41F0FDB615799CBD2B45878D1DBC4587C83FC63040249140333866DE57611AD47F074F5E0FF875900C1ACD
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... ...s...s...s..6s...sr.r...sJBks...sJBus...s..r...s..r...s..r...s..r...sJBns...s...s...s..r...s..Zs...s..2s...s..r...sRich...s........PE..d.....\.........."............................@..........................................`.................................................0Y..|...............................\...p'..p...................x(..(....'..................h............................text............................... ..`.rdata..x...........................@..@.data................d..............@....pdata...............h..............@..@.gfids..,............v..............@..@.tls.................x..............@....rsrc................z..............@..@.reloc..\...........................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FolderIconChange.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):67072
                                                      Entropy (8bit):5.3721084596205015
                                                      Encrypted:false
                                                      SSDEEP:1536:P9LV0yyULyqYirww1veirtzRzPrOeu2SnC:FL+yXWxK1veutPrOkSnC
                                                      MD5:367F95A8FA2803894EBB798FC915C52C
                                                      SHA1:C0D544F3C1453DB2E92C58E0DFE57A8A0099AF2E
                                                      SHA-256:B2935CF2706C1F17F72FAEE23AEC3EEA33D9157336E2488AD1C47870E1EDB19B
                                                      SHA-512:0840F2F7E465BAE8D9C87442ABEF9D7CB9AA7AC6BEAF05059BF91CA3BC4656E479DA282D6332B45F332C516B230634034385FFFC59BC1800AEF791B09D918AD1
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Yn..Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d...$..\.........."......~..........0s.........@.............................P............`.....................................................|....0.. ....................@..........p.......................(....................................................text....|.......~.................. ..`.rdata..B^.......`..................@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc... ....0......................@..@.reloc.......@......................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\FreeMem.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):20992
                                                      Entropy (8bit):4.766265534289937
                                                      Encrypted:false
                                                      SSDEEP:384:ir2o4g0aSMQzmduJvpbrD9hknibrJEJ1g:K2o4g0aNQpZN44+J6
                                                      MD5:A50AA4465FD46E43899A7A313979002F
                                                      SHA1:7D08E91EEC1E8475DC5AC8B2CAA5546B7796C4A4
                                                      SHA-256:83B74A90CF203B49BB9078CC4B57A92D55318437919CCE5064CE5A9C86BF7182
                                                      SHA-512:8CC7144E8DB39C78D8C3B6635FB5BDCE0867B2327B4047146F50F5A0B2F36E77EE85F3558933ADDE0DEEA00218C241270AC9EC734E79DD128F4E7DE7937CD60E
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..y#.*#.*#.**.8*).*..+!.*.(`*%.*...+!.*...+-.*...+8.*#.*..*...+&.*...+!.*..T*".*#.<*".*...+".*Rich#.*........................PE..d...%..\.........."..........>.................@..........................................`..................................................B..........p....`..d................... 9..p...................(:..(....9...............0..(............................text............................... ..`.rdata.......0......................@..@.data...X....P.......:..............@....pdata..d....`.......<..............@..@.gfids..,....p.......@..............@..@.tls.................B..............@....rsrc...p............D..............@..@.reloc...............P..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\LockProcess.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):69632
                                                      Entropy (8bit):5.3537654150002
                                                      Encrypted:false
                                                      SSDEEP:1536:ZLV8sXvIFFUhtJiUjwv9k81Zd2ihvRSjjmq:ZLqYvJJjwFr1Zd2Hjjmq
                                                      MD5:6E50326783BD2E53C31BF246C03395E1
                                                      SHA1:C7806A69FEDBE22A3CBF38C9022209DB401B047C
                                                      SHA-256:A8E6D0A28FE1751327218A086643D3CC1E6E2F3F65ABE20AAD5A7A80E0A88306
                                                      SHA-512:1A012971DC5C839EAD7BA5541B5F29833C3D85C610DAD096D90B519DDC963821B301062893D0398B62F9C564538B6F29043C7B081855816BF251091FDAF9FBC3
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...\..m.f4..m.^....m.^....m..3..m..3..m..3..m..3..m.^....m..m..o..3..m..30..m..mX..m..3..m.Rich.m.........PE..d......\..........".................|w.........@.............................p............`.....................................................h....P.. .... ..x............`..\...P...p...................X...(.......................x............................text............................... ..`.rdata...e.......f..................@..@.data...H...........................@....pdata..x.... ......................@..@.gfids..,....0......................@..@.tls.........@......................@....rsrc... ....P......................@..@.reloc..\....`......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\MakeArchive.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):78336
                                                      Entropy (8bit):6.087055710471887
                                                      Encrypted:false
                                                      SSDEEP:1536:Dfb8zWhFAKHgjWLS8YbOloUMo3xVgvk0D6VURSLfBEwSrhV:H8zWhFAKgjmYbOloUMo8TmVURSzerhV
                                                      MD5:3F8450E78B6BB4364D9892F3D9163C9B
                                                      SHA1:DED998F184F1AAEDF760784EA2E7984D50200277
                                                      SHA-256:A794EDBF53B0394995312F06F22B6266C174746537571408BBFA3409D5CD31B3
                                                      SHA-512:A39D7FADFAB59DABF550EB1EB88E54EC751386F87A794F3CB680CC0C2B650BA7506DFC4D99B9AB87AE967F1C0DF156AD524D0614203E4B849DE5102EA4387813
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,."h..qh..qh..qa.yqx..q...pj..q.M$qm..q.M:qj..qS..pl..qS..pf..qS..pt..qS..pn..q.M!qs..qh..q}..q...pc..q...qi..qh.}qi..q...pi..qRichh..q........PE..L...l..\.....................|....................@.......................................@.................................8...|....P.......................`......@...p...............................@............................................text...%........................... ..`.rdata..nL.......N..................@..@.data........ ......................@....gfids..0....0......................@..@.tls.........@......................@....rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\MakeBigFile.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):51200
                                                      Entropy (8bit):5.207623335379823
                                                      Encrypted:false
                                                      SSDEEP:1536:Bpt8aXgNo1Zh1tl1FltNdTD3VKRvYgrcjy:Bpt8aQq1Zz8YgrcG
                                                      MD5:224D8AAA317C41F8EE30F8AFA7053253
                                                      SHA1:FCCF4CF2EBD8377EF4A3F94080527E57009DA67C
                                                      SHA-256:C375E3D9892F3E171F34A9E659C98B74F5BA18D9917DF8F6B446CDAE263A05C3
                                                      SHA-512:F9B677628A6DBE9B91ACE8BBAC9133D01046D9067BCDBABFFF0F00B9B3B201214B0D2889868FA99FD8C8B3A9E31CCFD796DD02DFA39E4A9938E7DC26B4AC576A
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i.N...N...N...G...Z.......L......K......L...u...M...u...@...u...R...u...H......U...N... ......@......O...N..O......O...RichN...........PE..d......\.........."......V...v.......N.........@............................. ............`.....................................................h...............l......................p......................(...@................p..(............................text....U.......V.................. ..`.rdata...L...p...N...Z..............@..@.data...............................@....pdata..l...........................@..@.gfids..,...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\MakeSelfExtract.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):76800
                                                      Entropy (8bit):6.078599357646344
                                                      Encrypted:false
                                                      SSDEEP:1536:aObV09rFiM/1x4Af9dukmGwVOZ9nfwXrni:1VWrFinA4GwVOZ9nQrni
                                                      MD5:D74083E5AD25785B3900892BA370ADAD
                                                      SHA1:0399BCE6D1AE9D29661AF7180EEF00E352C29481
                                                      SHA-256:F5884BC602AD5CE89E5EFF0D84117D3EC1C32326C881A389105077940C7B88CE
                                                      SHA-512:8B913CB45AA1D5B95AB4527661F6A3C2CB3EC5D470BBD5F449C7A19644203186CCD1139CF7AA34F445C3FB5BA632BCE91E19652286836F9C8D850F26257017EC
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."H..qH..qH..qA.yqX..q...pJ..q.L$qM..q.L:qJ..qs..pL..qs..pF..qs..pT..qs..pN..q.L!qS..qH..qP..q...pC..q...qI..qH.}qI..q...pI..qRichH..q................PE..L......\.....................|....................@..........................p............@.....................................|....@.......................P..|.......p...................L...........@............................................text............................... ..`.rdata..`L.......N..................@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc..|....P......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\MemInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):54272
                                                      Entropy (8bit):5.313177588152028
                                                      Encrypted:false
                                                      SSDEEP:768:B0VNL66ZjdlOzbyUxi06YXSm2So4g0aRcR9uciPh1A16hzQKz3zYURyAzLX:YNL6+mCUxi0WmdTfih1lMURyILX
                                                      MD5:EF613CEA5C45980E2ED01F4B9F63FEFF
                                                      SHA1:54AC7F938F74FE0FDB1754DE4FBC052C684D7F5E
                                                      SHA-256:8F0F2E01CC1CE63B44678CA542C33EAFEE6B744276AE6557A014E0B29F601179
                                                      SHA-512:8C4343B60B6CD2870E92D2DAE5FBE4E0F63559EBBD96524AE8A4E6B8BCAF5C52143BC5F5AB848384EDA581F69702DABD2BE8ED77AADFD0C11C9FC3C35918E3BC
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<J..x+.Yx+.Yx+.YqS.Yh+.Y.r.Xz+.Y..^Y}+.Y..@Yz+.YCu.X{+.YCu.Xv+.YCu.Xc+.YCu.X~+.Y..[Yc+.Yx+.Y.*.Y.u.Xq+.Y.uoYy+.Yx+.Yy+.Y.u.Xy+.YRichx+.Y........PE..d...0..\.........."......b...v......HZ.........@.............................0............`.....................................................T.......@.................... ......`...p...................h...(......................p............................text...<a.......b.................. ..`.rdata...N.......P...f..............@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls................................@....rsrc...@...........................@..@.reloc....... ......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\MkDir.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):91136
                                                      Entropy (8bit):5.449222834059135
                                                      Encrypted:false
                                                      SSDEEP:1536:Y89a6LMzGRQm9UT/A8HY1o11o4HJ1A7+l9Du2/J1AQHYbr+sMS:YMXLAKUzA8HY1o124pS7+TDzVYbr+g
                                                      MD5:683CB607D7251FA48AAC6886C2BD1FBF
                                                      SHA1:1DF85A117F167ED91D83BCC94959D1688EEF6C3D
                                                      SHA-256:CDF8D65C80483B79F63D3B6FAB18C7D2A02F210598C3A27C3EAE915148AA16C6
                                                      SHA-512:53FBB7B2ED8B1BDC4EEBAC75152EA7DC13330301F241FF4997FACA156961E98B6B2EBFC64B730E436C999BFE804DBC3E9311626A168A2B6D2B0E0733870ED79F
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|.l.8...8...8...1..*.......:....h..=....h..:.......;.......6.......#.......>....h..#...8...........3.......9...8...9.......9...Rich8...........PE..d...=..\.........."............................@..........................................`..................................................-..........h....`..........................p.......................(....................................................text.............................. ..`.rdata..............................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.gfids..,....p.......H..............@..@.tls.................J..............@....rsrc...h............L..............@..@.reloc...............^..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\MoveFolder.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):103424
                                                      Entropy (8bit):5.625052476385928
                                                      Encrypted:false
                                                      SSDEEP:1536:SR678YZWwuyHNIrUaKXYRbG0rpMGk2lYsjEot1HzF5VtscfqGRjEBL7:SR67dZNJIrUfwpSYt1HzRWuEB/
                                                      MD5:A14805A1C75CF0F36B15F8DBA8E726FF
                                                      SHA1:588746678883CA549DB694B48A133CAB435825E4
                                                      SHA-256:E37945F95D09DBE428EB4956E5C12492EC5948D2513037B066BE61CBB1431F67
                                                      SHA-512:E4407786A989565EC6B3A186AC96361F5BB4881C3ACB51D0A44BA9D3E13E319B035460ABAE02AE3EB20B2BFCCA7DE115099C82F8FA1C00C2D5C6CDA4E1DC30D2
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................>....q.....Inc....In}........................Inf.................R.....:..........Rich............PE..d...P..\..........".................p..........@..........................................`..................................................k..h...................................`;..p...................h<..(....;...............................................text............................... ..`.rdata..\...........................@..@.data................l..............@....pdata...............p..............@..@.gfids..,............~..............@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\Option.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):630272
                                                      Entropy (8bit):5.734354508647865
                                                      Encrypted:false
                                                      SSDEEP:12288:D4Vv/qVgg3D6A2RMneciJRl0JTA/yT5d5xQ6lwS:DGql3Cb0dA/yT5d5xUS
                                                      MD5:78D310311B74703DE55177427627DE6A
                                                      SHA1:0F76DC50633A0B2C235FEF53386084DC523B7EB8
                                                      SHA-256:41BE95F50DDF832885042BE3DF036F4D7B838FBE690CD02F5EDA19C6E9A16A00
                                                      SHA-512:34A9998AF1BE3541972E68E2DA938095E45830227F0920ED0D455C617A88ADEFD5538814F0655BA390DB9717B370D5C964AF67C376DC4E92CACF7537AF90FD8E
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........-*..LD.LD.LD.4..LD.L.A.LD.t...LD.t...LD..G.LD..@.LD..A.LD..E.LD.t...LD.LE.OD.>.M..LD.;...LD.L..LD.>.F.LD.Rich.LD.........................PE..d...{..\.........."..................t.........@............................. ............`.....................................................0.......@....p...-...............9......p.......................(...@................................................text............................... ..`.rdata..............................@..@.data...X@... ......................@....pdata...-...p......................@..@.gfids..<............B..............@..@.tls.................D..............@....rsrc...@............F..............@..@.reloc...9.......:...d..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\RemoveZoneID.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):63488
                                                      Entropy (8bit):5.384777023709189
                                                      Encrypted:false
                                                      SSDEEP:1536:rLtR86O312+ybAUCqB1XnS6Ha7MnZpRRAzf:rLL86w2vjCo1XnS6HokAb
                                                      MD5:82E89C941487FCA7DC84F76DC963F0E6
                                                      SHA1:D3C52D1793F9AEB94A10C7403CDB0E325E855B03
                                                      SHA-256:D450E8BDD66E6BCB97411253D57451F15AED858962F0AE27F20CE62A16D87666
                                                      SHA-512:CCC14FD7AF070C5B3785935B4E1C8FE3F5D0D90AE2DB3DBD84FE185DE71026429327DF9F60B11C672D920A51A0DE662538632DFCEFA8E7148AFB5D37C17DCA91
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~..~..~..w.X.n.....|...j..{...j..|..E..}..E..p..E..e..E..x...j..e..~..\.....u....4....~.\..........Rich~..................PE..d......\.........."......z..........Hp.........@.............................P............`.....................................................h....0..@....................@..........p.......................(... ...................0............................text....x.......z.................. ..`.rdata..vY.......Z...~..............@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc...@....0......................@..@.reloc.......@......................@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\RmHardware.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.155236976758736
                                                      Encrypted:false
                                                      SSDEEP:384:dxcm9xdZ6EZ7P91B8o4g0avZptdqP+P6TJYTrUaH/XbsV1nxOubpbwYaICORqO4:us7lP8o4g0aPtdEv+H/L41xhbNwYZR7
                                                      MD5:2FDD4A1484E86D3DFEF6F76D374ABF5B
                                                      SHA1:A6382F86F8BF2A7A681AA48A568ACE4B15699EA2
                                                      SHA-256:7B2FEE4F6E175852E4732277A04EDC436EDB2B458C86D6F84E6A21E47F70D473
                                                      SHA-512:6903B93DB12CD848A74E87D1A0CAE2EDF911E7A759DC7D473F2E0EBABEC2E26DED297905618D45596EFBFE50291EE7EFE032A23AF57A6AA95FBAB8640EA18A30
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=._.yt1Pyt1Pyt1Pp..Pit1P.-4Q{t1P...P|t1P...P{t1PB*2Qzt1PB*5Qwt1PB*4Qbt1PB*0Q.t1P...Pbt1Pyt0P.u1P.*8Qqt1P.*.Pxt1Pyt.Pxt1P.*3Qxt1PRichyt1P................PE..d......\.........."......8...N......D2.........@..........................................`................................................. o..@...................................._..p....................`..(...@`...............P...............................text....6.......8.................. ..`.rdata...-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ScreenSaver.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.1480076605255585
                                                      Encrypted:false
                                                      SSDEEP:768:RjS3DXbmo4g0aoo/SSF4lvn1M8AiYlTBXNP:RUs17n1nAZlF9P
                                                      MD5:57146C31C86533F29EA7D09C0B413FE1
                                                      SHA1:5268D395BAEE666A2409DD43F08659899FBD989C
                                                      SHA-256:C75E3C4D83163640382C956F00CE5D7BC06E98B055D10457A499C4E914A377AE
                                                      SHA-512:E62EBDDD18621CF795A53F7ECF981C16E1E60CA1A8D97EDFE30D5330EE83A04B22A8607A0F2C6292344B2CDB190E3CF3976BB537F15A5001A9FC9AC687BBEDF6
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......=j..y..Yy..Yy..Yps.Yi..Y.R.X{..Y..^Y|..Y..@Y{..YBU.Xz..YBU.Xw..YBU.Xb..YBU.X...Y..[Yb..Yy..Y...Y.U.Xp..Y.UoYx..Yy..Yx..Y.U.Xx..YRichy..Y........................PE..d......\.........."......8...N.......1.........@..........................................`..................................................n..,...................................._..p....................`..(....`...............P...............................text...\6.......8.................. ..`.rdata..n-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\SettingInitialization.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):62976
                                                      Entropy (8bit):5.235219185015457
                                                      Encrypted:false
                                                      SSDEEP:1536:f0Lpr9ACMym1jEXulfkghv1s2NwmsitdR+nN:8L5Gj1jEXul841smsFnN
                                                      MD5:6C446B867942F90EFE9002837E5F8CFC
                                                      SHA1:24F8F1C564B00036EFA18B40284238F9E194023A
                                                      SHA-256:BAE899E375966D68F3B73223DEA564F52A5597422DE9685D01085067241DAF01
                                                      SHA-512:6BE6C30FAB990A936BEA5461946A1E26F8BEFB338044F9D7DA7FABC40AEA9737918A7CC004CD0A68F343617DFD8040C610502EA3967F9C809CD3F3D986936EF4
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......>.#?z.Mlz.Mlz.Mls..lj.Ml..Hmx.Ml.F.l..Ml.F.lx.MlA.Nmy.MlA.Imt.MlA.Hma.MlA.Lm|.Ml.F.la.Mlz.Ll..Ml..Dmp.Ml..l{.Mlz..l{.Ml..Om{.MlRichz.Ml........................PE..d......\.........."......n..........Te.........@.............................P............`.....................................................T....0.......... ............@.........p......................(...@................................................text....l.......n.................. ..`.rdata..8e.......f...r..............@..@.data...............................@....pdata.. ...........................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellCascadeWindows.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.149946575563224
                                                      Encrypted:false
                                                      SSDEEP:768:Kp2av6oHDo4g0aAg0s02qLJQz01fAKIYuBVND:Kp2YHDtFQo1IKDI3D
                                                      MD5:E811D7F78E964806C12E58EDDCEBDC5C
                                                      SHA1:781078A790ED182B3B3F985C88741B653925E9A1
                                                      SHA-256:7FCD293215BE27A42F00A3EB806BD71848CFBFCA80FB322C0FC6C81B3EE74B65
                                                      SHA-512:4D65254047A6368DD6A4A48A8CA04FDE5DB33AFABCC5A8D4837C334575AB69F1BB63DDA507C8E46DA4D8DDD83CB5838FF04B178F6B35E2AFF00F6383BE3CE121
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d...X..\.........."......8...N.......1.........@..........................................`..................................................n..,...................................p_..p...................x`..(...._...............P...............................text...\6.......8.................. ..`.rdata..V-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellMinimizeALL.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.1465372594470695
                                                      Encrypted:false
                                                      SSDEEP:768:Gp2av6oHPo4g0aAg0s02qLJQz01fIKIYuBQNO:Gp2YHPtFQo1AKDIiO
                                                      MD5:2E2989F1116EE684BA6C8E30A0E84661
                                                      SHA1:8C86B6FC610EE3657EF04E0A0055C5FE5A4DA815
                                                      SHA-256:35FB08DA22B62E51D8A6E6BEF34F1986FA7910F33722630C59DD599EB9FDA363
                                                      SHA-512:DBAF7F8C324D534F82979653D72CDD17F34E24EADF60D37F954252EEDF0E248952840D7265AFA4E644F0E4858649D663B7041452BF93594815678E8E24E49308
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d...d..\.........."......8...N.......1.........@..........................................`..................................................n..,...................................p_..p...................x`..(...._...............P...............................text...\6.......8.................. ..`.rdata..V-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellSetTime.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.142663787841749
                                                      Encrypted:false
                                                      SSDEEP:768:ywGL//7Vo3jo4g0a9/SSFV4z5Fe1uBA/sCYuBU9K:ywGe31f9Fe1Js5IWK
                                                      MD5:111E5842C4C4F03B2E872D542F0D17BE
                                                      SHA1:E325916CE70E9D5E67A2305D24A6103B10088C9C
                                                      SHA-256:31BB0A62C57D6EFF4A1E8138F96FAA13BDB14978C806ECB87AB15C1B5A0397C8
                                                      SHA-512:CB8C7C619479907C555CA3382F367D817A8F4284131D7A9E3B082A44F5E8F42FF4E95B732C12DB89ABC877F82B544D52F481906CF4270F255310F76B1A73863A
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d...0..\.........."......8...N.......1.........@..........................................`..................................................n..,...................................p_..p...................x`..(...._...............P...............................text...\6.......8.................. ..`.rdata..F-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellStartMenu.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.138673785767041
                                                      Encrypted:false
                                                      SSDEEP:768:UR2avCoH82o4g0aTNOks0Oab1Qz01s4KIYuBE:UR2gHUhNpQo1TKDIE
                                                      MD5:8638BBD56AA34F315EA167B4D5C6EDA9
                                                      SHA1:C49DDEE3CD39CC739A0EF5F62DF6C86C7B8C7C02
                                                      SHA-256:9A10A0062A205915E606D2E726CCD1DD837E204AF7FF84B79BF877C5CE76FA1D
                                                      SHA-512:A64E0957E87CACF3636FAE46D5ADFF7DD8B5E519992D60454FF9D510CFBD1AB67BE9E070C6ED1F82D49B21DADAB3F63FD6336A4267AE08518CBE39882EFBA1AE
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?._.{t1P{t1P{t1Pr..Pkt1P.-4Qyt1P...P~t1P...Pyt1P@*2Qxt1P@*5Qut1P@*4Q`t1P@*0Q}t1P...P`t1P{t0P.u1P.*8Qst1P.*.Pzt1P{t.Pzt1P.*3Qzt1PRich{t1P................PE..d...;..\.........."......8...N.......1.........@..........................................`..................................................n..,...................................p_..p...................x`..(...._...............P...............................text...\6.......8.................. ..`.rdata..V-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellTileHorizontally.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.153243899488113
                                                      Encrypted:false
                                                      SSDEEP:768:nh2avSoH7o4g0aAg0s02LLJ5DE121KYYuBsdl:nh2QHbAF5o1wKTIOl
                                                      MD5:A31C8240391E67CFF8F743565FCBD233
                                                      SHA1:15EF9DF92C9E0F2E0F6DBC957CDF555ED6E5FA46
                                                      SHA-256:1CC94FB71DF46B51C63B972509EDDBDD50718A582CA873258E080387E1ADC728
                                                      SHA-512:66F30752AEC1B6593453205F271BE99417A7EF47E2E3280464C88791BD8FE38BA91860D493A4BE6F0ACB5C196F6BC61D1603650AC550B0201ECA7A0BBB58CCAB
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d...q..\.........."......8...N.......1.........@..........................................`..................................................n..,...................................._..p....................`..(...._...............P...............................text...\6.......8.................. ..`.rdata..f-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellTileVertically.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.149261391820656
                                                      Encrypted:false
                                                      SSDEEP:768:mp2av6oHLo4g0aAg0s02qLJQz01kAKIYuB/ND:mp2YHLtFQo1zKDIlD
                                                      MD5:70CA7997DFAE8E7045180F8506BB23F9
                                                      SHA1:BD01A38A80B14A65A08A28CE441557FEBF3DB561
                                                      SHA-256:10DC8782B3ED65BE83625328F7FC33212D0840D8B0809EF3A223FD3BD769D988
                                                      SHA-512:66B91F85C8EA24054FDA42C82FC4CCF076B34EBE5AB3351324FC9FECA5DC48147D9B0962784611E0273942BD81487FA2745C772B1D792A1ACE98B2DD9370A034
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d......\.........."......8...N.......1.........@..........................................`..................................................n..,...................................p_..p...................x`..(...._...............P...............................text...\6.......8.................. ..`.rdata..V-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellUndoMinimizeALL.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.15329811579095
                                                      Encrypted:false
                                                      SSDEEP:768:Hh2avSoHPo4g0aAg0s02KLJ5DE18ilKYYuBbd9piv:Hh2QHPtF5o18MKTIR9piv
                                                      MD5:3F4BF95580A713AE60F48A8A722F184B
                                                      SHA1:0F2B07CF5A271125F1DD31CCF1CA50A2FC1585E0
                                                      SHA-256:3AC11BBC80B357BD3801B6924FB49B2E65CD0309D75537F797D90BAC0E46130E
                                                      SHA-512:4BE1F3D9476D622A4FEA403497EB9C2BA149E5E38891E0D72EF95CAAA91B6F8AEEB7B30E5EECDD7A0F9656CE24001497F157D95A26F29526A7E7C05A07946900
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d......\.........."......8...N.......1.........@..........................................`..................................................n..,...................................._..p....................`..(...._...............P...............................text...\6.......8.................. ..`.rdata..f-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\ShellWinHELP.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):5.142758189970238
                                                      Encrypted:false
                                                      SSDEEP:768:5RGu/CdoH7o4g0ag/SSFV475HY1SQXq4YuBA9a:5RG+HIflHY1BqzICa
                                                      MD5:57EC9346A7E5FA74D76C7003A998B9BF
                                                      SHA1:E838FFCF3A628B2CF14FD9A653E6978144EBD93D
                                                      SHA-256:4B9505752CB60A997297C1D489B7FD7EB2C157ADA8D0A7137CF3C6DF49F0E86C
                                                      SHA-512:BE28D1699C0E8E4195A4E5E7AAA9BAD5BD98ADA5AD0AAE85DE0DEF89B227D5DF98F1A0016723F4D67FAC1B26D97536D3DBFB4622000693F7E3C10460673354BD
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8j..|..Y|..Y|..Yus.Yl..Y.R.X~..Y..^Yy..Y..@Y~..YGU.X...YGU.Xr..YGU.Xg..YGU.Xz..Y..[Yg..Y|..Y...Y.U.Xu..Y.UoY}..Y|..Y}..Y.U.X}..YRich|..Y........................PE..d...G..\.........."......8...N.......1.........@..........................................`..................................................n..,...................................p_..p...................x`..(...._...............P...............................text...\6.......8.................. ..`.rdata..F-...P.......<..............@..@.data................j..............@....pdata...............l..............@..@.gfids..,............r..............@..@.tls.................t..............@....rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\SimilarCopy.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):233984
                                                      Entropy (8bit):5.71625020282846
                                                      Encrypted:false
                                                      SSDEEP:6144:10Kdm6H9whfKW2bRq0gql28yOdBYZwYuUbUyQFgU1:10Kdm6d4fKV9qJVzS5+UXN
                                                      MD5:CE11E332A616D30DFAE6D7BBDC5C95D6
                                                      SHA1:B8B8F3EF846C7E3C40E35FB0F09A2D5438DAC5F6
                                                      SHA-256:D98430EE9A98A8B6E9D815FCECC6F7681A729600CB6A00E8A098D6ACBDCDBCA2
                                                      SHA-512:D9D638557CF26C5E92465DFF5FF12B34A7FB49AF828A9077EE6A73C06ED6CA0F2929DBEC2139A89D36F570672EECACE019F448A2692D2305A7C2BE566AC13489
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................>....u......M^c....M^}............................M^f..................R.....:...........Rich............................PE..d... ..\.........."......F...R......x..........@..........................................`..................................................O..................................,.......p.......................(....................`.. ............................text...,E.......F.................. ..`.rdata.......`.......J..............@..@.data...`............\..............@....pdata...............b..............@..@.gfids..,............x..............@..@.tls.................z..............@....rsrc................|..............@..@.reloc..,...........................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\VersionCheck.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):66560
                                                      Entropy (8bit):5.312044346105525
                                                      Encrypted:false
                                                      SSDEEP:1536:1jlLBjQp+UD75RIulB1LTRxmUZByHdR/zVerL7:plLX28uf1LTRxWzVerL7
                                                      MD5:EF92BF11EF7D9A44D76102940E26A68F
                                                      SHA1:8DDA917DCDB306CBA4B1B54E905035631FA6CD6F
                                                      SHA-256:4E48AA82BC8708EC023530B2B78018D43C547F86757E0663317FB1457878358B
                                                      SHA-512:ECB283F23056D8582CB00AFB9F96AA40CB7E16399F600D60BD427B7B1C0277D71D1B99B49BCB83816B8785120548135724B41CEFDE492BD5987C2F0E3A752EF7
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~..~..~..w.T.n.....|...j..{...j..|..E..}..E..p..E..e..E..x...j..e..~..s.....u....8....~.P..........Rich~..........PE..d......\.........."......~...........r.........@.............................P............`.....................................................h....0.......................@.........p......................(...P...................8............................text...x}.......~.................. ..`.rdata..P^.......`..................@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\VersionInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):70144
                                                      Entropy (8bit):5.352208838968007
                                                      Encrypted:false
                                                      SSDEEP:1536:9LHSYo4bw4FUf8I01XTSoqhU4tlR/HnVp:9L/o4s+U0D1XTUOuHVp
                                                      MD5:32547EA6FA4E5C35DE75D1A9B55000BA
                                                      SHA1:45C01E03A6412F813DA136500D68EB492845CCFA
                                                      SHA-256:6CDA071434747F96BDA140EF6FB81ADC64BC1EBB97B6DE803228783954F4D9AE
                                                      SHA-512:58EE5E8C1371308B1AA7C52F0616282D5B847BE73C880CED2CECFC924F3321201DAB92F64D1DE3201B5009D40EB09A4689F0A2824E9050F9E5FB2720A1201881
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.G4;h.4;h.4;h.=C..&;h..bm.6;h....1;h....6;h..ek.7;h..el.:;h..em./;h..ei.2;h..../;h.4;i.:9h..ea.>;h..e..5;h.4;..5;h..ej.5;h.Rich4;h.................PE..d......\..........".................$u.........@.............................p............`..........................................................P..8.... ..@............`......@...p...................H...(.......................h............................text...\........................... ..`.rdata...d.......f..................@..@.data...............................@....pdata..@.... ......................@..@.gfids..,....0......................@..@.tls.........@......................@....rsrc...8....P......................@..@.reloc.......`......................@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Default\WinEx.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):68096
                                                      Entropy (8bit):6.118797822672869
                                                      Encrypted:false
                                                      SSDEEP:768:3MsLCyxn9iAo//JLOhyI19Ycm9fNqcRk2UG4Vgi/ebQVOOECUAz1XhwhzcvHNg:XLDn4ArPYfNqykGQVOOEPAz1ShzwHNg
                                                      MD5:C060926AB85841A9608B264F67F1A3DB
                                                      SHA1:8700809AE88A8664EA15B570A3A470E7129BB3AE
                                                      SHA-256:B1A3BEE86AB63298EF9B5FFC9DFEE5A62F5E834C0223120B3CC7F27E644B2AC5
                                                      SHA-512:95DB3F0B07E9F7CD3C8FE3B52CE3B81C76F0D18E7D9E5D6C464EF695D9C72F8D0BD5E456F765A96EF25A8032297EE11CF2136A53867B4AD5A71D34C4852F00A6
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........."P..qP..qP..qY.yq@..q...pR..q.M$qU..q.M:qR..qk..pT..qk..p^..qk..pL..qk..pV..q.M!qK..qP..qC..q...p[..q...qQ..qP.}qQ..q...pQ..qRichP..q........................PE..L...,..\.....................n....................@..........................P............@.....................................h.... .......................0.. .......p...........................`...@............................................text...E........................... ..`.rdata..T?.......@..................@..@.data...\...........................@....gfids..0...........................@..@.tls................................@....rsrc........ ......................@..@.reloc.. ....0......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\AdobeReader.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):24064
                                                      Entropy (8bit):4.92568033727783
                                                      Encrypted:false
                                                      SSDEEP:384:do4g0ado7FsftkG8Y6fGrWFY6+PU3rWFsN26avRnn:do4g0aW7qo1J2tp
                                                      MD5:5D0C0EDCA720A36186619E314C704AB8
                                                      SHA1:926C371ACD1BAA88AD4AEBD7914645E678A1F410
                                                      SHA-256:82D887C5104C49A2EBBE3F07F97A9D6FA16F24F521E23F2C7A94E9CC6E9FCF50
                                                      SHA-512:40E702A7F962D4C4AFC7F1CE4D6EB6E224FC8244B9F9EADCC1B35467D6A4C059FE2C074619C4BDFE30A5A43961CA83BFB218396FE00F345DA8A6E984AF712398
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.....C..C..C...C..C...B..C.=GC..C%..B..C%..B..C%..B..C..C..C%..B..C...B..C...B..C..sC..C...C..C...B..CRich..C................PE..d.....\.........." ..... ...D.......#....................................................`..........................................K.......K...............p......................p>..p...................x?..(....>...............0..h............................text............ .................. ..`.rdata...'...0...(...$..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.gfids..4............R..............@..@.tls.................T..............@....rsrc................V..............@..@.reloc...............\..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\InternetExplore.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):28672
                                                      Entropy (8bit):4.9265259797688685
                                                      Encrypted:false
                                                      SSDEEP:384:hfl7eShz5cPo4g0auRopDbO1g5zPX9zizwzEriFP2DDl0w+H7uhriFszkAWw9NWZ:yKN2o4g0auKPOkBA0UDlsH7Erk7k+
                                                      MD5:F6C84194A3E044B4E90E41C188ACF4AA
                                                      SHA1:62BEE01F4664E155C1F91DC40887DC7A23B8DC2B
                                                      SHA-256:D8D423B4A14560D7166032D89F468A6927E768AAF688450D82D5DA92B974B279
                                                      SHA-512:9B6ED99861C5C631F41DD3B5F3112318C2599F65B8046486679DF6CCEBD8B2DCCDBBB1E31D583D049CB8B98191B35DBC0260D94C71501533FCCABE822325D3F4
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i1..b..b..b...b..b#..c..b.r.b..b...c..b...c..b...c..b..b>..b...c..bQ..c..bQ..c..bT..b..b..b..bQ..c..bRich..b........PE..d......\.........." .....$...P.......(....................................................`..........................................d......Xe..................H...............,...0V..p...................8W..(....V...............@...............................text...H#.......$.................. ..`.rdata...1...@...2...(..............@..@.data................Z..............@....pdata..H............^..............@..@.gfids..4............b..............@..@.tls.................d..............@....rsrc................f..............@..@.reloc..,............l..............@..B........................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\PvPlugIn\MediaPlayer.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27136
                                                      Entropy (8bit):5.014952800495436
                                                      Encrypted:false
                                                      SSDEEP:384:oUHzo4g0aFqx5wmVLpCwB56qFzMrwFsf6HSCpRBD7qhL0Wel2TrwFs2vtVH4FYn:do4g0aF96oKyMRl7qhLWwTMv/Q
                                                      MD5:218E258E08BD274FC79FAA495AAE3C3C
                                                      SHA1:82DE440861828AC6D1659BB1B581B5DADFD8306C
                                                      SHA-256:A5375E948F3D126C7B94280D6632A76879EFBF05982A8828A3824562642B9922
                                                      SHA-512:E4561172A468F982CB6BD6E19E0BF30C9F77D03E781D2632A3DEAFE8A9E72812BAE9CEA1FF7A9309B549DA3EC14648C42A5043D1048A0C70696EADE10F928C7E
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s....^...^...^..^...^y.._...^AO.^...^..._...^..._...^..._...^...^q..^..._...^..._...^..._...^...^...^...^...^..._...^Rich...^........................PE..d.....\.........." .....&...H......X*....................................................`..........................................^......t_.......................................P..p....................Q..(....P...............@...............................text....%.......&.................. ..`.rdata...+...@...,...*..............@..@.data........p.......V..............@....pdata...............Z..............@..@.gfids..4............^..............@..@.tls.................`..............@....rsrc................b..............@..@.reloc...............h..............@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Brws\Brws.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):20480
                                                      Entropy (8bit):4.879533174446954
                                                      Encrypted:false
                                                      SSDEEP:384:dnT7mUFeo7rurTH5Z8InNW9EwDKYOGb+I:JOonuNExgI
                                                      MD5:F25D208CABFF5F9859DBDFEB1BF8FEF8
                                                      SHA1:111F2223EEA5016E60FC64692D83C002F51B7DB5
                                                      SHA-256:41AAA36117D0894DD887AD4AF11195CB8068B4AFBACA3D897112DC4BDCF763F5
                                                      SHA-512:DD14B9A9AFDE0E22016E6536F2F6719E67897AA7EBB08DF163FA48E782D52123E3A2884FFA85E23C6D94185B95D4456E9BFEFC7EE04CF277D69772CC60D32A7A
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../../../..&.&.-......,......-......&......&... ~.-../..0......-....J..../."...........Rich/..........PE..d.....\.........." .........B............................................................`.................................................t&..P....`..0'...@......................`!..p............................!............... ...............................text............................... ..`.rdata..V.... ......................@..@.data...@....0....... ..............@....pdata.......@......."..............@..@.gfids.......P.......$..............@..@.rsrc...0'...`...(...&..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Fin\Fin.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):30208
                                                      Entropy (8bit):4.741026153269577
                                                      Encrypted:false
                                                      SSDEEP:384:d8T7mUFeo7rOraHp0x360LDes97G4htJTHRo/tFui0KDCn:uOonbqxDTxJTxYUfo
                                                      MD5:A38478F841B53B150FCCA61A6F96F38C
                                                      SHA1:14A9C4EF05D5136F4B571688E3853DB111FDF9EA
                                                      SHA-256:A3BF168A377B0F99E7C5C22E7C34680DEFD3E7A43C86BCA3C89D6BD80B6EE2A8
                                                      SHA-512:F302A6102EE70FDB0BCAD719905C3C8BA105DAD5F7A7B37DC9719DAE1A10B99462F845B1A6DCD5772780E3E9EB8E06944D3A6F2F3447924BAF38839288243B4D
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../../../..&.&.-......,......-......&......&... ~.-../..0......-....J..../."...........Rich/..........PE..d.....\.........." .........h............................................................`.................................................l&..P....`...L...@......................`!..p............................!............... ...............................text............................... ..`.rdata..N.... ......................@..@.data...@....0....... ..............@....pdata.......@......."..............@..@.gfids.......P.......$..............@..@.rsrc....L...`...N...&..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\MArc\MArc.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):34816
                                                      Entropy (8bit):5.032186775711509
                                                      Encrypted:false
                                                      SSDEEP:384:zqS43yu7QkOvybNnL2hY2hI0RHHElynDElynhLKtgT:zlu7QkMybNnL2hYWI0xHX9M
                                                      MD5:D4E2F672EE75DD85A3E7C4754C4250CB
                                                      SHA1:128382A7A8ED571B620CD68AB7A444ABFAC8E5F6
                                                      SHA-256:DB3128B72FF12E5800813016822B97F1555A19DB9B4EAF9BEBF4BDDED9CF51EE
                                                      SHA-512:619F13533ADA2D118C0660A9E18A08DCD073BF250BF8026B610F08BB29424F0BC72F00C488501FDE9A34B1B476DC6D8BC5D85C3E404629BF295E146B843D5982
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!.........x............... ............................................@..................................$..P....P...f......................,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc....f...P...h..................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Seeker\Seeker.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):17920
                                                      Entropy (8bit):4.686006453499829
                                                      Encrypted:false
                                                      SSDEEP:192:daxJp7mUucCdo7c4W1r/MhcY+I5eCAJAahWKI/8RR:dgT7mUFeo7rurSH5eDJAasKIU
                                                      MD5:0B61C15DC3D35F3730AF9FDA5E34D7C1
                                                      SHA1:FCA9A39B410986681479A8E3E45C1AC9757824D3
                                                      SHA-256:73E2AA79A4F84E465B0268338651EB1F7F20E37EA30C762C3B56B8AC2BE3A63C
                                                      SHA-512:F57774A11D2673FAF37A95593EB77D8BE0EBAA493B424458CB43D57AAF4EC866728AB4F4C6793F6967D0F24A068FF14EBCE289599BB285D82086DE02BBE1C3FF
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../../../..&.&.-......,......-......&......&... ~.-../..0......-....J..../."...........Rich/..........PE..d.....\.........." .........8............................................................`.................................................t&..P....`..`....@......................`!..p............................!............... ...............................text............................... ..`.rdata..V.... ......................@..@.data...@....0....... ..............@....pdata.......@......."..............@..@.gfids.......P.......$..............@..@.rsrc...`....`.......&..............@..@.reloc...............D..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\.ja-JP\Txv\Txv.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):20480
                                                      Entropy (8bit):4.809781516796469
                                                      Encrypted:false
                                                      SSDEEP:192:dhDJp7mUucCdo7c4WVr/DVcY+IpWf+ATtqJKh4vTEJTG:dhT7mUFeo7rOrRHpgFTtUKhnJ
                                                      MD5:B081A7655AAF41F705450719E2C7A36E
                                                      SHA1:E1B1C3CA64E8188268FD852DEBD7F30A9A5BAA75
                                                      SHA-256:882CB5E3F07073E3AC85A821729D79FF88CF36CB785B51E403DEC277642ECC77
                                                      SHA-512:47A58CA8BE6910BB0F27526A2CBC19EFC9129E432407E89421AEF342970B4B30807D4832F4D567ACAAF019DCEA05DDE3FFD9597832A7B2427D7D3D1431801A08
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../../../..&.&.-......,......-......&......&... ~.-../..0......-....J..../."...........Rich/..........PE..d.....\.........." .........B............................................................`.................................................l&..P....`..h&...@......................`!..p............................!............... ...............................text............................... ..`.rdata..N.... ......................@..@.data...@....0....... ..............@....pdata.......@......."..............@..@.gfids.......P.......$..............@..@.rsrc...h&...`...(...&..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\Brws.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):97280
                                                      Entropy (8bit):5.277174804133632
                                                      Encrypted:false
                                                      SSDEEP:1536:Ho3g6LTVu147f/FaQ1pkzw4PG0uulvH0VpAodeKs4PGaDWVqr:Ho3pLT8GfY7duut0V5deKJuVqr
                                                      MD5:863257EC4FCAF5E34818B04080D50813
                                                      SHA1:C5CE890A7D582637B3B3F4114D1A3177E8888D52
                                                      SHA-256:EDE09DCADBDB557E66FBFFB8A6C4167F01848B780606C3FCCBC58165442B3C33
                                                      SHA-512:E8823569FD83400C3D9E42E0295300AA117784A9259DE50452EC02AB64F721B7238193EF1DF0454B4AEC94EAD88BBC6DFA7A3E628E5767BB39C50DCEF529ED60
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..r..r..r..6r..rr..s..rJ2kr..rJ2ur..r...s..r...s..r...s..r...s..rJ2nr..r..r..r...s..r..Zr..r..2r..r...s..rRich..r........PE..d.....\.........."..................=.........@..........................................`.................................................P1..|...............................\...@...p...................H...(.......................p............................text............................... ..`.rdata..|...........................@..@.data...8....`.......:..............@....pdata...............B..............@..@.gfids..,............N..............@..@.tls.................P..............@....rsrc............ ...R..............@..@.reloc..\............r..............@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\Fin.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):303104
                                                      Entropy (8bit):5.789509349380072
                                                      Encrypted:false
                                                      SSDEEP:6144:B+qmcCoo4PcQgC3U28l9HS6kRJdmm+MQcIwWdCN:gqmcxo4PL1vAm+MFII
                                                      MD5:07918214A482F06E0CF27A0007D46379
                                                      SHA1:1D9812C0D309FCC01D9C733B24B12958244E6BD2
                                                      SHA-256:83072C6736DF309B65B24F8F4BF9B435422191764127A5398986F5407D7DA533
                                                      SHA-512:857B9FF453C50CB4B8D9EF80BC8C387E1BD6198C629D64120C755A2438CF535B7BA54446B389368C484286EA9A758F7CE25CB1BB397E5DB68B96D54B5C90ADBC
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............O..O..O...O..O...N..O)9KO..O)9UO..O..N..O..N..O..N..O..N..O)9NO..O..OE.Oc..N..Of.zO..O...O..Oc..N..ORich..O........................PE..d.....\..........".................`k.........@..........................................`.............................................................x:...`.......................y..p....................z..(....z...............................................text.............................. ..`.rdata..F~..........................@..@.data........@.......*..............@....pdata.......`.......4..............@..@.gfids..,............L..............@..@.tls.................N..............@....rsrc...x:.......<...P..............@..@.reloc..............................@..B................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\ICON.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):82944
                                                      Entropy (8bit):4.254455940298376
                                                      Encrypted:false
                                                      SSDEEP:384:MPlIKD6KKDo5KDdPKD1KDvKDmKDdKDHX4KDxPKDWKDKKDSGCEKDwKDHKDlKD0KDf:MMq0fbGCe/TL+
                                                      MD5:E8750AC7FB73615AE6ABEE223E3B5E85
                                                      SHA1:0F9F1AE6C93CFD077CCC4353550344B50DC67618
                                                      SHA-256:AE16BB37FAEA37F30ACB7858F8DD10DDCE3BCB8431B3F92AC698943FE91001E1
                                                      SHA-512:24B7FDE8E6D0F21B46A0BC7DF4E44444E68BB02400CB3E2E843F0D4F9F22F15FF3F9F06A7FDCDDDB240DB9FDAC6310C806A161886C338802833C578AF43F8655
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...s...s...s.......r...s...r.......r...Richs...........PE..L......\...........!.........B...............................................`....................................................... ..(?...........................................................................................................rdata..p...........................@..@.rsrc...(?... ...@..................@..@.......\........T........................rdata......T....rdata$zzzdbg.... .. ....rsrc$01.... +...4...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\MArc.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):365568
                                                      Entropy (8bit):6.150560549640472
                                                      Encrypted:false
                                                      SSDEEP:6144:ERvjVrgzIAoSulzVtrfL364qWgDynIaVFUMSLf0dGwq159gGlVbwnjLnf/Rnnv8W:ejNgzIAoSuFrfLUW01f0415j+v8W
                                                      MD5:FA5B14BE8C70286AFA1C0F8AD3049C57
                                                      SHA1:9ABC557E441F48648F1BE10D5B97EF51884F20AA
                                                      SHA-256:2E724F683E18A564C6A76D081A575108A5EA1B2B5ACCF17B0E250B472E10639E
                                                      SHA-512:A1D5D7D96A69015A8840E46A3BE2E0DDD761E078369BB8653EBACCB7307F8C8955537D2E0F616E47FC23F62B1554F5991B2C2274583B6F8A1A721D0924B4CBB6
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;J..Z$.Z$.Z$."..Z$.n.!.Z$.V...Z$.V...Z$..'.Z$.. .Z$..!.Z$..%.Z$.V...Z$.Z%.TY$...-.Z$.....Z$.Z..Z$...&.Z$.Rich.Z$.................PE..L.....\.................@...X.......g.......P....@.......................................@.................................T........ ..02...................`..p~...C..p....................D......PD..@............P..(............................text...%>.......@.................. ..`.rdata..V....P.......D..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...02... ...4..................@..@.reloc..p~...`......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\Seeker.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):197632
                                                      Entropy (8bit):5.490503330198693
                                                      Encrypted:false
                                                      SSDEEP:3072:J1dEUW1Ngote67l7CI6T4Evln0GuJVcTnLYeVEftUKAR6IdkM+DV9+48peE:J1qUONNt97lGIsfln0spVjKA1eV9+A
                                                      MD5:F70C92B6ABA17DC4E13632A37B451192
                                                      SHA1:6C2D41D43C95CBE053E575EA36454F8F66B7D8E5
                                                      SHA-256:39732850F308D228F1E0B5CC5495B02E55A7CB58B0E2C225A5F460B1F3CC49CB
                                                      SHA-512:09642113076281ECE87F3555969A080E73094E544DC7E09F19C43B48E7F5362ED9F1E7A4ACCA26C2FE0976893D371DDF40F54B8DC7623AB37CC083F6B7510A9F
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zT..>5.Y>5.Y>5.Y7MBY*5.Y.l.X<5.Y...Y;5.Y...Y<5.Y.k.X=5.Y.k.X05.Y.k.X"5.Y.k.X85.Y...Y#5.Y>5.Yj1.Y.k.X.5.Y.k.Y?5.Y>5FY?5.Y.k.X?5.YRich>5.Y................PE..d.....\.........."......D..........(n.........@.............................p............`.................................................0............6...................P..(...05..p...................86..(....5...............`...............................text....B.......D.................. ..`.rdata..RK...`...L...H..............@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls................................@....rsrc....6.......8..................@..@.reloc..(....P......................@..B........................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\SendToCompress.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):71168
                                                      Entropy (8bit):6.112001250417419
                                                      Encrypted:false
                                                      SSDEEP:1536:kxpk4xTG8/p6gEGoSbspRpR6VQJ1sW3cdQkLE:KG8hJF7bsPp2weQkLE
                                                      MD5:300FA9E5D45DE30B3CBE50B32EA38DCD
                                                      SHA1:B53481F7A7974AD59B32D5ADE0984CCE26C5906B
                                                      SHA-256:23C6BF76A89691FBE9901B21A8E6943ACDAAC7B1844125DB3B5503871A96A4F8
                                                      SHA-512:B70B3858ADC8C75D35F42C0B050310D24255A539F10494EB3EF9675920E44A88B33C0889923CD50E4E8E3368CE00AA3E5AC1CBCE482C7DFC700717598000B324
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."n.."n.."n.I...."n.I..."n.I...."n..|m.."n..|k.."n..|j.."n. ..."n.."o."n.j|g.."n.o|..."n.."..."n.j|l.."n.Rich."n.................PE..L......\.....................x....................@..........................`..............................................T...<....P..................................p...........................@...@............................................text............................... ..`.rdata..lW.......X..................@..@.data........ ......................@....gfids.......@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\SendToExtract.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):71168
                                                      Entropy (8bit):6.1194865362904665
                                                      Encrypted:false
                                                      SSDEEP:1536:gxhk4xTG8/p6gEGoSbspRpR6VQJ1sW3cdQkSV:uG8hJF7bsPp2weQkSV
                                                      MD5:41E9B6A5A7B7E90E3A4B3FBB4AF92EB5
                                                      SHA1:E5A8B3A0B1E2DA3B428A73CD49E6EED9E7DAFEBD
                                                      SHA-256:7A2FBFEBC50FB4F966EB183EE6FC1521310CD98B50B1F60C119A9D2557D37E89
                                                      SHA-512:E8BA45336901C08E70EF3923A144B22AE3D4C181DE23E10CFA40113CD418D7B42AB29DF89FA6E5DF1940C4D403F13B2C591097BD71FEC859388A3B6DC0F60460
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."n.."n.."n.I...."n.I..."n.I...."n..|m.."n..|k.."n..|j.."n. ..."n.."o."n.j|g.."n.o|..."n.."..."n.j|l.."n.Rich."n.................PE..L......\.....................x....................@..........................`..............................................T...<....P..................................p...........................@...@............................................text............................... ..`.rdata..lW.......X..................@..@.data........ ......................@....gfids.......@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x64\command\Viewer\Txv.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):256000
                                                      Entropy (8bit):5.600422628512669
                                                      Encrypted:false
                                                      SSDEEP:6144:vO1xf1U2O5zvYsD3O+ls1ksDQi5xu5AJwU1AtXs/KV:vO/HO5zQUTs1Fis/q
                                                      MD5:DB195AA462CE9E9D2F6EAF52CE5C06BE
                                                      SHA1:B01D00FFA797585F1D51F9DA9C24925F0BABBC00
                                                      SHA-256:95053AF2029898DECA7266BA19BB2168FB13B1BAB3B7B1C11464244122AD90D8
                                                      SHA-512:F769B37034662C1D620910164A44CDAA07047DC0CADDECB31EE4EC016144B468DDC98EC0DF7CF08D094BFCA17C08A3D745A46C4F9C8EAAA9D45402911A28EA7C
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jr..............'k..:....J..,.....^.+.....@.,....M..-....M.. ....M..2....M..(.....[.5...........M..?...Mo./......./...M../...Rich............PE..d.....\.........."..................[.........@.............................P............`.................................................0o.......... 7...................@..........p.......................(....................0...............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....pdata..............................@..@.gfids..,...........................@..@.tls................................@....rsrc... 7.......8..................@..@.reloc.......@......................@..B................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\Asr.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):1243136
                                                      Entropy (8bit):6.338799881799426
                                                      Encrypted:false
                                                      SSDEEP:24576:puqoEeA1VmwzvBDcuhmhHphW7o1B7pXjwBRJxBxg0dEocpVSuvPh1rHNo:pDotAWihcPh6U1BJuIh1rHNo
                                                      MD5:4DD66F127C832FACCCDFB8B31BBD5A88
                                                      SHA1:E7453290CE092D88E1397384B3A66FCD2F999317
                                                      SHA-256:B28903D126E84900CB884B98219936BEEBECA444EACA27ED30AD8D04D12474F4
                                                      SHA-512:B0A0DAF42C88A4AA35DD4F508D6273DF242A5E553A7DF5CE00B37947B0E69E53FA3002DFA3449A7794768DE21A4BC035DEBA36DFD4C6C4CAB5C40897F8F31AA1
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......4 .FpA..pA..pA..y9[.dA......rA......wA......sA..K...zA..K...~A..K...xA..K...XA......oA..pA...G......$A....7.qA..pA_.qA......qA..RichpA..........................PE..L....\.....................d....................@..........................`..................................................X........W.......................o...@..p....................A......`...@............................................text............................... ..`.rdata...Q.......R..................@..@.data....E... ...(..................@....gfids..d....p.......,..............@..@.tls................................@....rsrc....W.......X...0..............@..@.reloc...o.......p..................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\AsrLoad.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):39936
                                                      Entropy (8bit):5.166348371635687
                                                      Encrypted:false
                                                      SSDEEP:768:txECNwtkUoYm1W2opCyvolpKglVclAkHfis:0CNwktYAropCyglAgjclAkHf
                                                      MD5:318A44C9F184EF1F86523225190DE4A9
                                                      SHA1:7D93E37152D7AFE449F4F5E7E1BA406FAED01594
                                                      SHA-256:81258F313C591C78D158CF80CE40E09B84CC0BEEF9AD7F498B231BCDB309E68C
                                                      SHA-512:94CF574AA089208FF69CA6CC48EAA1D2BAC940A69675EE63C5E1A49F49980DAFDCFAAA4D3D5496003CCC8ED0A68A0E7A5C41B394847C9A1D571D80213299CAD5
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0...^..^..^.....^.i.[..^.Qs...^..]..^..Z..^..[..^.._.7.^.._..^...W..^.....^.....^...\..^.Rich..^.........PE..L...@.\................. ...|...............0....@.......................................@..................................?...........P..........................P7..p....................8.......7..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........P.......>..............@....gfids..0....`.......@..............@..@.tls.........p.......B..............@....rsrc....P.......R...D..............@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\Associate.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):52224
                                                      Entropy (8bit):5.9424364807924155
                                                      Encrypted:false
                                                      SSDEEP:768:Fnimt/YBQG3CQO2rP0xlYlDI9hSk0RjEgZ17LDtKqNYGBYcpCw2gs:IAG3CQOhIDI9YkhgZ17LRjVZChgs
                                                      MD5:854C4C4B28F48D56D690CDD6F2884C24
                                                      SHA1:E490B6ACFFD96AB6A778922E32C487813A183A1C
                                                      SHA-256:0650FD17F9D1523763B2B2CE7B4DED22A710BAC6C0AFB497238ACDCA3AD1861E
                                                      SHA-512:B068F1508853919EA2D45A604B511FC7DA607C92244D4EA50B3B25C6FB8BEE547A78FEBDBA02691D70A29810F967C7274B40A826588736658A43B61787DF1765
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p;cA.U0A.U0A.U0Hi.0Q.U0.HP1C.U0..0D.U0..0C.U0zOV1E.U0zOQ1O.U0zOP1].U0zOT1G.U0..0Z.U0A.T0..U0.O\1I.U0.O.0@.U0A..0@.U0.OW1@.U0RichA.U0........................PE..L.....\.................f...h......"_............@.......................... ............@.................................l...h.......8...........................@...p...............................@............................................text...Ud.......f.................. ..`.rdata...6.......8...j..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\Lang\Asr.ja-JP.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):5.234015747698049
                                                      Encrypted:false
                                                      SSDEEP:768:zQu7QkMGbpUAaiHD/QtTQXRuPiK9+PJT/a+OAWTtAI+5n:8uUkMGbuAaQD/ITQXMPDoJT/abAQt0
                                                      MD5:1F938D773B5BA5EC2A5448ADDFD39280
                                                      SHA1:B5FE6E8B8D2FDCEAFF0CB0919F867F706F952857
                                                      SHA-256:2E201CBA8023E67FABC91E02181F82FA0ACFD9CF9ABB32603ED2EAA752311795
                                                      SHA-512:66C23B873C749266E52ECB2581A11F3B09B99033EDC9249EAD2C8C9E1D49FCC92506AFC100D4D7E49F5D455B6988B2E1519E11F61FD848FB83148DBE9F556B1B
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!......................... ...............................@............@..................................$..P....P.......................0..,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc........P......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\Unreg.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):28160
                                                      Entropy (8bit):5.630242788784423
                                                      Encrypted:false
                                                      SSDEEP:384:VBBO9l+j+I2N+H+tqqfd47v3FDPSVwidaYR5BL8tDQoTxy1CkOmME7woLpEbP7lV:TL68ggDPSvphoTxHkRMBoLGbP7I4J1N
                                                      MD5:4A90B33FFE3771D70706C90FB1EFE64C
                                                      SHA1:E120F16C99C19DA4AB64D2756C9CAF4ED64182B9
                                                      SHA-256:478182F6C882A354F07972AC0F0C9BD2A7128A683D8A84AC13822CA55C781E07
                                                      SHA-512:22E825F0F90327F3501AAAB555F64A858A9384CE19782604293809DFC02F8CCFBF7033CF1ED1E91A7228F5DC0F8362C8B8656F6D279445BB197877BCD9E60FBD
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........$!.Jr.Jr.Jr...r.Jr/.Os.Jr.y.r.Jr.y.r.Jr..Is.Jr..Ns.Jr..Os.Jr..Ks.Jr.y.r.Jr.Kr..Jr].Cs.JrX.r.Jr..r.Jr].Hs.JrRich.Jr........................PE..L....\.................4...<......&0.......P....@.......................................@..................................d..........x............................[..p....................[.......[..@............P...............................text....2.......4.................. ..`.rdata... ...P..."...8..............@..@.data................Z..............@....gfids..0............\..............@..@.tls.................^..............@....rsrc...x............`..............@..@.reloc...............f..............@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\.ja-JP\FileRenameEx\FileRenameEx.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):16384
                                                      Entropy (8bit):4.8360534166164575
                                                      Encrypted:false
                                                      SSDEEP:192:zLfSuCO3ZJhj8u/jgkOvFfzU3K1WF5jHk334eRDEDAZRqKFwT:zrS43qu7gkOvFbyNHk3hRDAKFw
                                                      MD5:1C33119CCBB0CE7E6C1354DDB271B375
                                                      SHA1:66B5527E6044CB7EC903D25FBB320732906FED69
                                                      SHA-256:9A175ACEEBFE496318EE32BFE4F2B704EEF9FB220559BA41217B9FEC692137F7
                                                      SHA-512:87E7783EFA9E59526145CF73C736AACF5D58B8F042B2D63D3D263BFE6915E40507B4E95F9474CF28AAD58292B72100298D9C682999E55BD9C0DB20BA5C7F8D30
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!.........0............... ............................................@..................................$..P....P.......................p..,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc........P... ..................@..@.reloc..,....p.......>..............@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ArcDllInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):71168
                                                      Entropy (8bit):6.094347574084356
                                                      Encrypted:false
                                                      SSDEEP:1536:S5WERhVBiXmSPwBXyd5KAkx8VQPAtkOTcwIArDM6u4bwnp4U:GZRhg+yNVQPcZTKArDM6bMp4U
                                                      MD5:0DD7717FDD22BB571CEA115A8AE4BED8
                                                      SHA1:316FFE1CD4CBB4826CBFE23B69F46217A0978B44
                                                      SHA-256:FBFC227590D522F13D32A92222811DA0AF6FF62960135317D19D78CCD608F5E2
                                                      SHA-512:BE2666433FCC59C1068F0402CA5C98065E1004DC2F214FF3C21EE883B86251ED19A084D2C134862AA852183309647D5384D968E7D9335A4E5C31DE8FE001D37F
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........7..DVpNDVpNDVpNM..NTVpN..uOFVpN...NAVpN...NFVpN..sO@VpN..tOJVpN..uOXVpN..qOBVpN...N_VpNDVqNMTpN..yONVpN...NEVpNDV.NEVpN..rOEVpNRichDVpN........................PE..L......\.....................r....................@..........................p............@.................................x...|....@.......................P..........p...........................0...@............................................text...%........................... ..`.rdata...F.......H..................@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ArcPack.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):257024
                                                      Entropy (8bit):6.197999100849133
                                                      Encrypted:false
                                                      SSDEEP:6144:DNKBCR7CZSEambWd+z5gVg5kJL+Na7g4q1:5KBC7CZ1CVg5k1e
                                                      MD5:0E23E6DB6988B6DD9F09DC2852995176
                                                      SHA1:E1885A0254DC527479CBCF4502C7A11A5D8251DF
                                                      SHA-256:AFBF18348781EB9ACD438201D4B8534C99F4763138A30E639AE7F98D182F1E95
                                                      SHA-512:3639BE7FC9BCD6E33C1D90120F1B8806B7FF2003B3ADCE6B627BB9089FCC5A9FFC8587256C744AE7CC9FB2A2D410F0A6151E93E7BA55DF7D5A90EDD10FF41110
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........udR..7R..7R..7[..7F..7...6P..7.*.7W..7.*.7P..7i..6U..7i..6\..7i..6O..7i..6T..7.*.7O..7R..7...7..6K..7...7S..7R.7S..7..6S..7RichR..7................PE..L.../..\.....................Z......PO............@..........................@............@................................. W...........(.......................\......p...........................p...@............................................text...%........................... ..`.rdata..............................@..@.data................Z..............@....gfids..0............`..............@..@.tls.................b..............@....rsrc....(.......*...d..............@..@.reloc...\.......^..................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ArcUnPack.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):203264
                                                      Entropy (8bit):6.194656333411924
                                                      Encrypted:false
                                                      SSDEEP:3072:KnfiMuUDJQulA3UOSZWoJWHZoKxFcjPmg9J1pdPXZ3gcWwve2rUAANw4:KqwAE/WyKIjZ77t5gae7/Np
                                                      MD5:3E0466006DE123E31789D644ADCBA2AA
                                                      SHA1:DF5E1C0E2AB604D65CCCFA52FBFE39F1A3E97EB2
                                                      SHA-256:57494FC9C9F9284E54CF5B3D701CBA55E0093A44F905B4160924CC09980D9CCA
                                                      SHA-512:DFFC75C8D0EC9AD8D30C03FB79C7635534E5EF249840225F476104A0CFB5DFA98B086877450C94696782547B82D2DF68FF146ABA032491ABE05B0485A6BD9B93
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............................D......|lS.....|lM.................................|lV.........)...6......3.b.............6......Rich............................PE..L...A..\................. ...................0....@..........................`............@.....................................................................C...q..p...................\r.......r..@............0..D............................text............ .................. ..`.rdata.......0.......$..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\BindFile._xe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):13824
                                                      Entropy (8bit):5.126325180665128
                                                      Encrypted:false
                                                      SSDEEP:192:pt0IQU5fTG0hsW3kOf36dOu3PxmACsAJ5/z6U3YHdzmG/79w:pt3QB0KW3kOP6dOu/xmuAaHdTD
                                                      MD5:FCB4A30CE5AD90B72AEB058D439394A3
                                                      SHA1:10E2AB9B2C6F1E6A1F8E2B0EA1AF1F24498144BF
                                                      SHA-256:581C79926C30B226CC2889BB7A6F3DDA05804DC006D3E1DBE1DCDAD6347CDEC0
                                                      SHA-512:1108F115BBCFDFB19E0E321F619FC6BA5EE114F1D58864D4492EB1B46857A6BA401D738BB250C78A62A7118D06A3CDBF2E8133A892953D2F9B6A900BF210F7B1
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D...D...D...<m..D.......D.......D.......D.......D....5..D...D...D..F....D..C....D...Di..D..F....D..Rich.D..........................PE..L.....\.....................$...............0....@.......................................@..................................8.......`.......................p..P....3..p...........................p3..@............0...............................text...;........................... ..`.rdata.......0......................@..@.data........@.......(..............@....gfids..P....P.......*..............@..@.rsrc........`.......,..............@..@.reloc..P....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ChgImgFmt.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):60416
                                                      Entropy (8bit):6.080894487155128
                                                      Encrypted:false
                                                      SSDEEP:768:XCXr7r7RwW/RSXNGnP5R5qmA3xGcapMNk5mTH+J3SrOOAg/Ww/xAyiXQg:yXJt/RPW0capGkzSqAWw/PiXQ
                                                      MD5:379BF9239AF961AA368136172109854D
                                                      SHA1:1AA0A33B01A65C08A1E348682B95AE28B38774E6
                                                      SHA-256:3F61C70AC9B5C311173F72DE7A6D50D2D77A3C59F376322F937DF8F697751EC8
                                                      SHA-512:A4A3D5197D7D95626C5EB8206EF12FC395EDB23F10EF423FAA21E513670963169A3EDAAC24932AC7A1C97EB883DB65E4D3C21ED215EF883E05A5160466BE3ABD
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Cx..".@.".@.".@.Z.@.".@P..@.".@h{.A.".@P..@.".@P..@.".@.|.A.".@.|.A.".@.|.A.".@.|.A.".@P..@.".@.".@. .@.|.A.".@.|.@.".@.".@.".@.|.A.".@Rich.".@................PE..L...1..\.....................h.......z............@..........................@............@.................................................................. .........p...................P.......@...@...............D............................text...&........................... ..`.rdata..~<.......>..................@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ChgTxtFmt.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):70144
                                                      Entropy (8bit):6.142251010315882
                                                      Encrypted:false
                                                      SSDEEP:1536:dLMFkWhhRNuaY1d6k1tVpksiArHm+6/gpw:tMFkaR6tVp+ArHmD/gp
                                                      MD5:9FFFA0F7BA09B66C5CAF38FBE7189FE1
                                                      SHA1:D677170EDA971EBBCB5BC959CE93B668AA5C9842
                                                      SHA-256:AEBB77EB792D230C03FA759E19EA02F409A020F7D11AD8C1D7DDAAA161F0E8F8
                                                      SHA-512:62727AEA480A707C0D42D0D6516CE8EF4A619F7DC83ECB65FDA51AB83C90D59A8509EC704CC4F266099E26E98EE87243B4138680D006E8137F7410B828542AFA
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Pj..Pj..Pj..Y.L.@j..3..Rj.....Uj.....Rj..k4..Tj..k4..^j..k4..Lj..k4..Vj.....Kj..Pj..}h...4..\j...4 .Qj..PjH.Qj...4..Qj..RichPj..........................PE..L...@..\.....................t......(.............@..........................`............@.................................4...|....0..@....................@......p...p...................<...........@............................................text...E........................... ..`.rdata..hB.......D..................@..@.data...p...........................@....gfids..0...........................@..@.tls......... ......................@....rsrc...@....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\CreateErrorReport.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):45056
                                                      Entropy (8bit):6.026720607746906
                                                      Encrypted:false
                                                      SSDEEP:768:ZQJifpQQ4B+kEUDQ7CyGTOnQpD3GvrgJ+UNteBs8j:hiQ4Uk1DNyGTOQpCvr6Fte7
                                                      MD5:3165E6BD0D4F9F5CB17D26CF79B9062D
                                                      SHA1:FB6F17A0299494A67CF9252F23F055084E58699E
                                                      SHA-256:8A1690D35EE2DA88D6055BCCA6E483BCB38F0505885CDBFB333F8400115BBAC9
                                                      SHA-512:2C40B0D58E75E410FF498EB14F11BC32D6FE75EC345FD5A406E3E182DA808C2BB1E4F6E84183C255989CA18C978AB15F8B213320392AA7C6FE4B138E1062403A
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..{...{...{...r.G.i......y...N......N..y...N..c...@...~...@...u...@...g...{.....@...|.......~.....+.z...{.C.z.......z...Rich{...........PE..L......\.................\...V.......Q.......p....@.......................................@.................................$...h...............................T.......p...........................0...@............p...............................text....Z.......\.................. ..`.rdata..z....p...0...`..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\CreateErrorReport\report.bat

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):242
                                                      Entropy (8bit):5.159852923210077
                                                      Encrypted:false
                                                      SSDEEP:6:hefBbwAEGZfPnJDJqQ9vcAVOc+hBi/Al9IAeK51Vy:8BREGZXJDJHciOc6Bi/AIAeK51Vy
                                                      MD5:095891BC2F1A7CB1BE78F46447A40E6F
                                                      SHA1:23ADAC4A688370C4E3D152450F93203C6CD155F3
                                                      SHA-256:7D751DB9678BEF019B414D870BD5723CC3B741FCE1286B46F2CD113293F525E0
                                                      SHA-512:024A5A21714F673CA772A92EE033B45C3BB76598DFAFEFA2925C6CD7131594B83CF68F57DA0B4221660ABDCABF635820F1A6815D1A4859F650E26D3A490472C1
                                                      Malicious:false
                                                      Preview:@echo off..cd /d %~dp0..cmd.exe /c wevtutil qe application /f:text /c:3 /rd:true "/q:*[System[Provider[@Name='Application Error' or @Name='Application Hang'] and (Level=2) and TimeCreated[timediff(@SystemTime) <= 1800000]]]">report.eventlog..

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\CreateErrorReport\report.ja-JP

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:HTML document, Non-ISO extended-ASCII text, with LF, NEL line terminators
                                                      Category:dropped
                                                      Size (bytes):4120
                                                      Entropy (8bit):6.257425141401826
                                                      Encrypted:false
                                                      SSDEEP:96:2v/JtnxtLjFf5D/4P2CA8KdJ1uappfKYl5FA0qYAPJORg0saiQL8YgvkNKU8:2v//z9CXkL0arNUPtIgh3
                                                      MD5:5A98DB72AC8FE9312AE5EC192A95AABF
                                                      SHA1:6D1C8BD72BA48DF7A1810DEF346783870ECAE187
                                                      SHA-256:8C5F0585CB8BD8DE607776D6313223E6F0881DB7BBCB09F0F4856137D85E6D48
                                                      SHA-512:8E40FD1E3C90905A14E345A32717C9D70C80FB33EF33E69808A8046984BE92836837B61E98B58B53A57803081A5FE0487832153A076CF7CA60749B56FC3DFB03
                                                      Malicious:false
                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html lang="ja">..<head>...<meta http-equiv="Content-type" content="text/html; charset=Shift_JIS">...<title>.....s.....|.[.g...</title>...<style type="text/css">span.c1 {color: #FF0000; font-size: 80%}.</style>..</head>..<body>...<h3>.....s.....|.[.g...</h3>As/R.....[.U.[............l..........A.........W.....L.^...s...........B<br>........c..........@.\..............i....u.t.@.C....R.s.[.@.\.v......30..........j.A..P...Q..........L.....p.......................B<br>...................................A.....p........v........t.......................B<br>....<br>......M.............[.J..........t.@.C.......i.A.h...X.o.[.Q..j.A...M......................W...............\........A..W........A...e...X.....|...L............B<br>....<br>........[.U.[.......M.......................B<br>..

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\CreateLink.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):80384
                                                      Entropy (8bit):6.1787275353758835
                                                      Encrypted:false
                                                      SSDEEP:1536:N3e2bS7ZHxFWpE0zeeOcjQrI1iFkQV3elotd+rkTl0:NbS7ZRFoE2J9jQnZV3lz+rkTl0
                                                      MD5:33D8DCED2471891236385C71077E8DDC
                                                      SHA1:915554C80B9667EF6974C447C8AB363529A6E930
                                                      SHA-256:86FAE320A0D655EB2A379891566501D7CA7EB2D0F92AC0FD3622581971E0C480
                                                      SHA-512:60D248FD05691AF5281C694D94737072173AAF8AE730C09072C83CAF09EC3EF1C4B3A8376F5A70FD753B997E0BABB35DFA483F3E7468A29E741B98D68306FB7A
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Pn.Pn.Pn.Y.L.@n..7.Rn.....Un.....Rn.k0.Tn.k0.^n.k0.Ln.k0.Vn.....Kn.Pn.Jl..0.\n..0 .Qn.PnH.Qn..0.Qn.RichPn.........PE..L...b..\.....................z....................@.......................................@.....................................|....P..x....................`..H...p...p...................<...........@............... ............................text...5........................... ..`.rdata...H.......J..................@..@.data........ ......................@....gfids..0....0......................@..@.tls.........@......................@....rsrc...x....P......................@..@.reloc..H....`......."..............@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\CreateLocalTumb.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):62976
                                                      Entropy (8bit):6.1546677995022625
                                                      Encrypted:false
                                                      SSDEEP:1536:iadpKMHLcvylvOkQzVgqSilf05rguuFoD:iadcMrezVgHilf05rgul
                                                      MD5:98C476825745EF7985684B3CD579FD0E
                                                      SHA1:2A31ED08D5F6F944306C0F67DDFCF841F044DF70
                                                      SHA-256:CB007B376438451FF744CCC4BCB6E04CDA11D41D8E25376CA54A570CA293229F
                                                      SHA-512:AF34DD20B0A87B84638E1D15E245DF3DF64EE18A02BBF5D20FECB806B7592CD5047DED95E3E954A3AAC37A3FE844BD4954BA88BFD0B4F354B6A38B877D24F332
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..DVp\DVp\DVp\M..\TVp\..u]FVp\...\AVp\...\FVp\..s]@Vp\..t]JVp\..u]XVp\..q]BVp\...\_Vp\DVq\hTp\..y]NVp\...\EVp\DV.\EVp\..r]EVp\RichDVp\........PE..L......\.....................j......t.............@..........................@............@.............................................(.................... .........p...........................P...@............................................text.............................. ..`.rdata..t?.......@..................@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...(...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\CreateTumbImg.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):53760
                                                      Entropy (8bit):6.060504215699042
                                                      Encrypted:false
                                                      SSDEEP:768:L7l3r0vKSzSLeVVGYwQw+ouwYIJkGsoDzLljtEVzC0IWrzMExI4e:3lA9+LeCUw7uwY6karEVz1zr4EL
                                                      MD5:0CBAB2A404C6A1D064B2CB7D9CB31B3C
                                                      SHA1:534B4E3524E5BD62CEC18A78F9C676F4499DA1F5
                                                      SHA-256:CE3F1AE45D1F76262059F2E82D5369BA6DF6F57648912E9BAC9E0D1EC1D2124C
                                                      SHA-512:AFED3F8A0952A5E343F9A435023AAFF4562CBED73293274654892152598E5EDD27B34EE1B318A4FF450BCB2A35CF2DB58DCCF2246FF8E560E075739DEE9BC03A
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..DVp.DVp.DVp.M..TVp...u.FVp.....AVp.....FVp...s.@Vp...t.JVp...u.XVp...q.BVp....._Vp.DVq.JTp...y.NVp.....EVp.DV.EVp...r.EVp.RichDVp.........PE..L...q..\.................t...`......hj............@.......................... ............@.................................T...........................................p...................l...........@............................................text...Er.......t.................. ..`.rdata...9.......:...x..............@..@.data...P...........................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\DivFile.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):69632
                                                      Entropy (8bit):6.0831295167960615
                                                      Encrypted:false
                                                      SSDEEP:768:2x5/rkDlKkje3as15Y1HunSgLS00RVCvEb+8V+BV0RdkacLGt7KJ/sLhl7QIsgMG:MIEkC3a40VMBVMkGl7BsgMO1r4B8LQ
                                                      MD5:46BA70FC413E9B3F4575301982CBDBF6
                                                      SHA1:188777CE9EF239DFC73EAC40198EEA4695AC8C3F
                                                      SHA-256:388EA1425C93EF01238E40160094FB6516723CB409146F5CA6CF6F0FD932F1A8
                                                      SHA-512:5DB298332787C35922C319E157D7F058E57E4DEC16B37F7293B27BFD83EB0EBCEF5B55E156F759E026D96E811F7FEC8BF3E267C29D0856579CE5713A83C18D85
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b..i...i...i.......i...0...i..:....i..:....i...7...i...7...i...7...i...7...i..:....i...i...k..p7...i..u7...i...i...i..p7...i..Rich.i..................PE..L...P..\.....................n......J.............@..........................`............@.....................................|....0..0....................@..4.......p...............................@...............@............................text.............................. ..`.rdata..\?.......@..................@..@.data...............................@....gfids..H...........................@..@.tls......... ......................@....rsrc...0....0......................@..@.reloc..4....@......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\DriveInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):51200
                                                      Entropy (8bit):6.02158914948901
                                                      Encrypted:false
                                                      SSDEEP:768:lcV8rtIVutykZ07YNnLS7Kb0S4hnxrkaJ4BhBaGtVc5+GGNhzHqbI+dcj:2QaqZfLS2b0S419kx5tVc5bAtlP
                                                      MD5:B62D9FB562284A3DC0271BDB75823D30
                                                      SHA1:963A079838B0FC1EA9855BD26B7F44F808C7E5E8
                                                      SHA-256:8605D2749FD62A7D6F9FBCC472A7203FC56658B619C94C616F6F6EBB261F7F0B
                                                      SHA-512:7FE55EB8B1A27C0395C61BD628C3EE4B5E45F4E79BE9AA65B07538D75B98596BD646DC4746B921EA8CF6EB36B693D9D29715540F8637964068CE2F3D82B4BB9D
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..I6ie.6ie.6ie.?...&ie..0`.4ie...3ie...4ie..7f.0ie..7a.8ie..7`.+ie..7d.0ie...-ie.6id..he..7l.?ie..7..7ie.6i..7ie..7g.7ie.Rich6ie.........PE..L...O..\.................l...^.......]............@.......................................@.................................D...T....... ...........................`...p...................,..........@...............`............................text...ej.......l.................. ..`.rdata...4.......6...p..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\Export.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):47616
                                                      Entropy (8bit):5.994759249430592
                                                      Encrypted:false
                                                      SSDEEP:768:2zlrBsgsA3leX54dXc/cx8Xl4yk7kbK2gV1tmNQHpOyz6ZUHxokn:MnwA30XTcx8Xl9kRVuNQHRuZ6xln
                                                      MD5:11B18B5438408D8CEA30BA39AE818830
                                                      SHA1:F5E7630B217BFD85AAD4C1841A0A2B3EAA8E906C
                                                      SHA-256:A5BC11955874E70EBE28565081AFBDC51981833BABD271D167224E7878DF0755
                                                      SHA-512:D6BE4B8AADC23DEDDD0D5289AC308CA87969426C7ED6B78992DE8ED666900E4B827FA2C71512DFF990267A1164FE8B5145314CC61BE6878109BCFC848B37F287
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{)..?H..?H..?H..60u./H......=H...(.:H...6.=H......;H......1H......#H......9H...-."H..?H...I.....6H.....>H..?Hq.>H.....>H..Rich?H..................PE..L...^..\.................b...Z.......Y............@.......................................@.....................................|.......................................p..............................@............................................text....a.......b.................. ..`.rdata..85.......6...f..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileAttribute.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):77824
                                                      Entropy (8bit):6.0511020203581305
                                                      Encrypted:false
                                                      SSDEEP:1536:akx40xBoxf03oWQrIUzJXy2lWEktpKfNgBoVg4UVrX6T6J5OSv:ak40xGxoQrImJyTJoVg4UVrX6T6DDv
                                                      MD5:D59131D8911B2D156005406B6E9B1429
                                                      SHA1:1118FE5527EF18F756973ADBAA94454272A8AC9B
                                                      SHA-256:79CD94AC40C49CC3402CE556B6710BC39DE86ECD2D1E886FBB9A530BB8E784C7
                                                      SHA-512:89B988957C094656084B02A362CF9468EEC838FBC9F8FB265E3E6823086A395EF23409C4E8D71515D0B465A4EA1C9A722DA6EA745EBF34163963D7EDAA8014E5
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........?T..lT..lT..l].|lD..l...mV..l.?!lQ..l.??lV..lo..mP..lo..mZ..lo..mI..lo..mR..l.?$lO..lT..la..l..mX..l..lU..lT.xlU..l..mU..lRichT..l........PE..L......\..........................................@.......................................@.....................................|....@.......................`..4.......p...................L...........@............................................text...5........................... ..`.rdata...G.......H..................@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc..4....`......................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileCpMv.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):209920
                                                      Entropy (8bit):6.212670153642316
                                                      Encrypted:false
                                                      SSDEEP:3072:F3fmCxehuKoqqnwDIsUBb4s/sE6dUB5rxXZ3gmiahr4NKDTuH:F3+Wq7DCBbF/96o15gFaKNKTu
                                                      MD5:1D966FC0D509B5B91CE15CD6D5D091D4
                                                      SHA1:4BC8DDC05BB41BCBFECC930739BB1337BC588F7F
                                                      SHA-256:1F028EEA7DE3911385B0F2CEE6D2689553A31D39DEE8713D2C1C694DB3DC8F30
                                                      SHA-512:5C45D69C6653076AC58D23422B85EF204CB74616BFDF03F8998CAC8C353D90CA370E2B6E9BB1F869A1D01A293671DFD252F94A4890DAFDBA27BF7F0B36EEF1D3
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?..M?..M?..M6.M+..M...L=..M.K.M:..M.K.M=..M...L7..M...L1..M...L"..M...L9..M.K.M$..M?..M...M...L-..M...M>..M?..M>..M...L>..MRich?..M........PE..L...,..\.................(..........R........@....@.......................................@..................................................................0..$G.....p...........................@...@............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data...h...........................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..$G...0...H..................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileDelete.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):68096
                                                      Entropy (8bit):6.099168370695454
                                                      Encrypted:false
                                                      SSDEEP:1536:+hEL9Qz96PkvAfBrETErJTkNsVPOXeDriDe+B81O:+hEL9QTvAfgsVPOXeDriDe+
                                                      MD5:088470C862A338F95C66DBD7EA379B1C
                                                      SHA1:28C1506D88419EC4C15E8385D93DD7F606B81983
                                                      SHA-256:A612A73E11B864D480276F0D08906A9640D7BB985AE65AC376EE93B47B6AD983
                                                      SHA-512:0DF53CCDCEA1D36ECB1E7CA19B9839BBEB5164915D55918BACC78545F61EAD4EAD81554277D47A84483B1EDABA7805D68C7DE2A338AAB113952B46C1315ADE32
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............rf..rf..rf......rf..+c..rf.+....rf.+....rf..,e..rf..,b..rf..,c..rf..,g..rf.+....rf..rg..pf.a,o..rf.d,...rf..r...rf.a,d..rf.Rich.rf.........................PE..L...;..\.....................t....................@..........................`............@.................................,........0.......................@..,.......p...................\...........@...............@............................text...5........................... ..`.rdata..2B.......D..................@..@.data...x...........................@....gfids..0...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc..,....@......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileExecute.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):50688
                                                      Entropy (8bit):5.9761338793824414
                                                      Encrypted:false
                                                      SSDEEP:768:ggArEoyRJo6q9Ly9tmeYU+Ellxl2ACgp4ekVEl7V8Q92ygR9XoFdDZ6Tm8:t9EL9+Ln/j2ACgp5kmVxkYbV6TN
                                                      MD5:642B4E6EBFED6953BE3574B8BCD9CA81
                                                      SHA1:963B9BAF6A668618633366CAC70C6B8D6D2FBC51
                                                      SHA-256:9DBA520A8D5E65A1646AC48EE1C194612F54E10C6BD0F4663593B39ABEB5B756
                                                      SHA-512:A1AA8A4098AFB812D49C9543D9C34BAF2019CB4B4B92DC1843520BA919A993375CC557F9F583CEA659905F13554A5AFE46B3F09E0B7EAFDF34E38AAEE0302FD8
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........7..DV.LDV.LDV.LM..LTV.L...MFV.L..^LAV.L..@LFV.L...M@V.L...MJV.L...MXV.L...MBV.L..[L_V.LDV.LAT.L...MNV.L..oLEV.LDV.LEV.L...MEV.LRichDV.L........................PE..L...K..\.................l...\......zc............@.......................................@.....................................T.......................................p...................\...........@............................................text....j.......l.................. ..`.rdata..(4.......6...p..............@..@.data...<...........................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileExport.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):77824
                                                      Entropy (8bit):6.140340087734584
                                                      Encrypted:false
                                                      SSDEEP:1536:JgKHNJk1gTjCOmpoO1CkiVEf14H+v7Nr1AW6p:1HNJAOjOpoRVEf1sS7Nr1A3p
                                                      MD5:0409DAC3F45944C5F0F8A178B3A14796
                                                      SHA1:6D43F0FE81F10EFD88879A515DDA5A0D65CB881F
                                                      SHA-256:B6ADBA521574A482B7E3B5EC71D9C896E1492091F1FBB0AB1E6F906907395589
                                                      SHA-512:F1FC7BC3E7E8CD370A0EB5064C2A36E9EA037A0536A7D8F8F183FF2D3634474A0F0FA8203A19C8B4A5192E8C3B9572925F7BA3F6664BA937E537F273E123EB52
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jb#...M...M...M..{....M..ZH...M.......M.......M.5]N...M.5]I...M.5]H...M.5]L...M.......M...L.+.M.]D...M.]....M.......M.]O...M.Rich..M.........PE..L...\..\.....................~...................@.......................................@..........................................P..8....................p..p.......p...........................`...@...............l............................text...5........................... ..`.rdata..rG.......H..................@..@.data...`.... ......................@....gfids..0....0......................@..@.tls.........@......................@....rsrc...8....P......................@..@.reloc..p....p......................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):72192
                                                      Entropy (8bit):6.1426175127427145
                                                      Encrypted:false
                                                      SSDEEP:1536:8BC644byZPJiXBu3YY3rdCkwxrVPRQBTfk3M0Ekpc9Ip89:8BC640yZwXBub5yZVPRQBTfcM0/+9Ip8
                                                      MD5:8215ED3E6ED710E91FDEA85D7BB5097F
                                                      SHA1:D6D3CEE4F122FAAB68B50F2E97EB4A57DA22FA50
                                                      SHA-256:24B902AA9E1FAF337663687FC57DBE1E115E00F571C871CAC83C71536D51F7C0
                                                      SHA-512:198377F582C0EE11453D80EFBD8FA9D52C9EBE28DCF231354ED0DF2A6933D0676252555E2FC53B435CDCFFDCA337372492A36E9F9ED7AC27B63FB290C4954B68
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......^v.....U...U...U.o?U...U.N.T...U..bU...U..|U...U!I.T...U!I.T...U!I.T...U!I.T...U..gU...U...U>..U.I.T...U.ISU...U..;U...U.I.T...URich...U........................PE..L...l..\.....................x....................@..........................p............@..........................................@..8....................P......0...p...............................@...............l............................text............................... ..`.rdata...G.......H..................@..@.data...4...........................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc...8....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileNameCp.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):79872
                                                      Entropy (8bit):6.1141096758493445
                                                      Encrypted:false
                                                      SSDEEP:1536:1ZbvH3H88whf2uDckYWro6VvxT2o0lMBELh671rUhIbm7:1ZvXHFwhf2tWTVvxT2o0yBA01rUhkU
                                                      MD5:9B659567CB8E34A6C3267220335D8D18
                                                      SHA1:D7E86133DFFCE0C4987B48ED817638756740F046
                                                      SHA-256:1D9C47F1ECD4CA1A3CB3928368F1661E46C10B155646E9CBDEDF694B55B34C70
                                                      SHA-512:C71A22BDEDE9F56E549D6A5F25EF5EF92CFD376510C5D1EB8C5E9D58BB314438D78AEEB717CCA0650E4687344658A14683AD5D55ADC64D3EB4B41BF6125F2211
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......V>..._..._..._...'4.._......._...i.._...w.._..)...._..)...._..)...._..)...._...l.._..._...]......._....X.._..._0.._......._..Rich._..........................PE..L......\..........................................@.......................................@..........................................P.......................`..$...P...p...............................@............................................text.............................. ..`.rdata..nJ.......L..................@..@.data...H.... ......................@....gfids..0....0......................@..@.tls.........@......................@....rsrc........P......................@..@.reloc..$....`....... ..............@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileNewEx.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):56320
                                                      Entropy (8bit):6.070400333477194
                                                      Encrypted:false
                                                      SSDEEP:1536:OxcyJuEOCIkkotRGBQuO+mkG/hNV772h/+lrAs1j3:OxdJuyIpowfE/DV7Sx+lrAs1j3
                                                      MD5:5185BC706C42E42109B749B5E9B2C3C2
                                                      SHA1:10730A992176AF06CEA79BEF2C2FB1D5DDAA1A4D
                                                      SHA-256:45433C0DE3E9F35575882CDB4C8055D78FF4CD1DCEECE3CB9BAEEB5EB083A25A
                                                      SHA-512:CBF1D51E6E4FF385C4FCEE147F36EB6F77A15C0156F5DB64E8ED19DCE6DED808BA1E9BA8B58FCE95EBB054C776D7269EDCDCCE7257AB574AF0E4D5EFA2509424
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........9..DXpLDXpLDXpLM .LTXpL..uMFXpL...LAXpL...LFXpL..sM@XpL..tMJXpL..uMXXpL..qMBXpL...L_XpLDXqL]ZpL..yMNXpL...LEXpLDX.LEXpL..rMEXpLRichDXpL........................PE..L......\.................|...b......7q............@..........................0............@.....................................|.......P.......................x...@...p...............................@............................................text...#{.......|.................. ..`.rdata...9.......:..................@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...P...........................@..@.reloc..x...........................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileRename.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):72192
                                                      Entropy (8bit):6.111064446718912
                                                      Encrypted:false
                                                      SSDEEP:1536:L/7oHcwcyxYPWff/OKgZXqkh4VgrbrWjhZj63:/QcgfXOFMVgrbrWtZ+3
                                                      MD5:E246DE04FC59AE54184713660070BCC2
                                                      SHA1:C7C0EE8179AB26245F15EC99D20C7DA6E749AE25
                                                      SHA-256:7694B7EABB17CF7AC005C0F134C9132ED306BA38177C03644ED481C2C4B5B2FD
                                                      SHA-512:652466DF7E04BC76CE6348F0778CE40B360BAEDBD4E8057C4A30EA78B16CD383733184C58A559EA2BAE4552B18D8FFD631E143D5372D5796D698E2DA77AD1DA6
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.......W..#.B..W..#.\..W.......W.......W.......W.......W..#.G..W...W...U..i....W..l.s..W...W...W..i....W..Rich.W..........................PE..L......\.....................x......h.............@.......................................@.................................t........@.......................`..t.......p...................|....... ...@...............L............................text...%........................... ..`.rdata...C.......D..................@..@.data...`...........................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc..t....`......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileRenameEx.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):192512
                                                      Entropy (8bit):6.36632291234506
                                                      Encrypted:false
                                                      SSDEEP:3072:LVA1E+X7IKUzsGIs7dAQhqifIIoyQSK1eZ1H77YQP4qBKrTkqwfoFU:LVJqGIsr/QN1sb7YQPFB8k5
                                                      MD5:6D445CF8A78F26F42CE3C770BF78ED24
                                                      SHA1:F4B80EF5B686653349B7D871E03D0F70BE067F17
                                                      SHA-256:7228F01788007A9E14300466D701E0FF3AFD5A9148395F792E6507D545005A21
                                                      SHA-512:EF9BCF7015DD075ABE3F81C4094377650D4E11AE61CD6BA5ED34B2599644F0D629807F7421E33A6C04954B5707E43BCA4A86FE0C6F0B8D47763356BD65643603
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.~.)..E)..E)..E .E=..E...D+..E.E.E,..E.E.E+..E.E.E1..E...D...E...D'..E...D7..E)..E...E...D...E...D9..E...E(..E)..E(..E...D(..ERich)..E........PE..L......\....................."......>.............@..........................0............@..................................g...........-......................\;...%..p....................&......P&..@...............L............................text............................... ..`.rdata.............................@..@.data...d............z..............@....gfids..8...........................@..@.tls................................@....rsrc....-..........................@..@.reloc..\;.......<..................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileReproduction.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):50688
                                                      Entropy (8bit):6.030045034867183
                                                      Encrypted:false
                                                      SSDEEP:768:iu0YrkgMMgCFgxIIsQf8gHlpl9iyHw1SkztvuJIoVFNdeIfBi5vIXqlRM:iliJFCfRLYyHw8koIoVscM5pl
                                                      MD5:0FD846630A2766B6DEE5EB1394E9A541
                                                      SHA1:B9DBFD688B23A8B5545757D61D806216F52BD3DC
                                                      SHA-256:7859D1671D29EF39804E76119FBD9456A58638A36A27FBCAC333CA83996B0484
                                                      SHA-512:73AF38A1E0452274610EF6564A70ACAD53BA2E92C0254A0B0690BFB9AF1890BE0C8BF02B7A48C5480135DAF5ACB6997C26A540243B5B645FD2804D0319DBC743
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S."H2.qH2.qH2.qAJxqX2.q.k.pJ2.q..%qM2.q..;qJ2.qsl.pL2.qsl.pF2.qsl.pT2.qsl.pN2.q.. qS2.qH2.qW0.q.l.pC2.q.l.qI2.qH2|qI2.q.l.pI2.qRichH2.q........PE..L......\.................l...\.......c............@.......................................@.....................................h......................................p...........................`...@............................................text....j.......l.................. ..`.rdata...5.......6...p..............@..@.data...D...........................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FileShortcut.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):82432
                                                      Entropy (8bit):6.161640250864486
                                                      Encrypted:false
                                                      SSDEEP:1536:xbc4c0StJHBo1FolObllYk5oVK3+XeqaRr3bJl/:Rc4cLtJhyFUO/BoV61r3f/
                                                      MD5:5514E18AB0E93126A9A5A2A5C605A3CF
                                                      SHA1:E9DCFA5C2A79E0352EB8154D1ED1ABC255D561B0
                                                      SHA-256:1A029EE4D809705536DD48B0A22C381D5E5BB1913BB672CBD70D0AA701346799
                                                      SHA-512:0290EC0A4B37586FD743B43B03AA340F9EA38FE8CB88581F97C6D48D901E1505BDDE5BDE14285A9D3C94677D6BB0F95A614AF48F88273874E443A9CACFCB0FE5
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......%...a..Ra..Ra..Rh.YRq..R...Sc..R.%.Rd..R.%.Rc..RZ..Se..RZ..So..RZ..S}..RZ..Sg..R.%.Rz..Ra..R@..R...Sl..R.5R`..Ra.]R`..R...S`..RRicha..R........................PE..L.....\.....................~....................@.......................................@.................................|...|....`.......................p..........p...........................0...@...............,............................text............................... ..`.rdata..PI.......J..................@..@.data........0......................@....gfids..0....@......................@..@.tls.........P......................@....rsrc........`......................@..@.reloc.......p.......(..............@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FolderIconChange.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):54784
                                                      Entropy (8bit):6.07388500320948
                                                      Encrypted:false
                                                      SSDEEP:1536:sEMI8w0g4UnctVhQClkc0VPNXJlrrJnC2re:sEMFg0QCcVPPlrrJnC2re
                                                      MD5:BB14598B97D83AD728EDCA924D6BF8E1
                                                      SHA1:F23E70A3EDA8C3BD8A9D38C459BFCD6677C1F0F2
                                                      SHA-256:B59CFA85221AA4E95C6605F11503F73D81769F13053576FF872068775BF4F2BC
                                                      SHA-512:9BA09F2EAB6AAC71A43AFCBB84ADAB6DC8EDFFB1FFD45EE234F6D36DA4B1DD8F704C0B774464279A40681A75C66CEA6736CB0B73E705CD5AAA1CFBFAE2DEE6D2
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.AB(.AB(.AKP AR(.A.q.@@(.A..}AG(.A..cA@(.Ayv.@F(.Ayv.@L(.Ayv.@^(.Ayv.@D(.A..xAY(.AB(.AI*.A.v.@K(.A.vLAC(.AB($AC(.A.v.@C(.ARichB(.A........PE..L...$..\.................t...d.......k............@.......................... ............@.................................l...|....... .......................|...@...p...............................@............................................text....r.......t.................. ..`.rdata...9.......:...x..............@..@.data...(...........................@....gfids..0...........................@..@.tls................................@....rsrc... ...........................@..@.reloc..|...........................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\FreeMem.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):17920
                                                      Entropy (8bit):5.211530157183605
                                                      Encrypted:false
                                                      SSDEEP:384:Da8L1msxkbAqvUm+XkOHNcvZSDbASKGGbF:D1FkEq/CkENcujKR
                                                      MD5:AA0568879A1140909532F0C5283B0B6B
                                                      SHA1:00AAB952BE42983CB5D8DDA5D501D4ED9F560060
                                                      SHA-256:FE2724BE4C1AB5FB33E6F817CCE20054CAD04C0185EFC13514A2A7349E74E58A
                                                      SHA-512:D5C772FB31EA2E92B09E3FC29DD9706D133D5C2AB417BF644C597136F4503FAE6B120600E8F9E4202A0D1EC3FD4A7291E7CBE15DA1B6A9A27496079193B7B1DF
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E..U............................J.....:.......:.......:...............:.................~.....................Rich....................PE..L...2..\.....................0...............0....@.......................................@.................................$<..........p.......................x....4..p....................5......`5..@............0...............................text............................... ..`.rdata..$....0......................@..@.data...|....P.......0..............@....gfids..0....`.......2..............@..@.tls.........p.......4..............@....rsrc...p............6..............@..@.reloc..x............B..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\LockProcess.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):55808
                                                      Entropy (8bit):6.046026104370968
                                                      Encrypted:false
                                                      SSDEEP:768:WZ0roY0REuF/Ss8b3KocxDsCCp61mkcQzqbD7OAKStrt0Jdeti:ytrhF/EFcsCCp6okCbDrJqHci
                                                      MD5:7869A054CFCFAE22ECEDAAECF3F37336
                                                      SHA1:10D08A6BB855070B8C396C3937DCAA6DAD8C942B
                                                      SHA-256:503620F0661976F18749E27AF79E98F9439ABA4DB0FE141A3733E79581F03E90
                                                      SHA-512:C7E38B3871B2630DD8BF6141F3B47EB908BACE96801AFCA9CBE52A4E6B2EA461F5A688BAE4B52C17D96BCB3E294A0A1287DB1687C3F1E9154DDB4131D1554A0F
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................B....o.....W<.....W<.............................W<..........................F..........Rich...........................PE..L......\.................v...f.......k............@..........................0............@.................................<...h....... ..............................p...................`.......@...@............................................text...ut.......v.................. ..`.rdata..b;.......<...z..............@..@.data...l...........................@....gfids..0...........................@..@.tls................................@....rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\MakeArchive.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):78336
                                                      Entropy (8bit):6.087055710471887
                                                      Encrypted:false
                                                      SSDEEP:1536:Dfb8zWhFAKHgjWLS8YbOloUMo3xVgvk0D6VURSLfBEwSrhV:H8zWhFAKgjmYbOloUMo8TmVURSzerhV
                                                      MD5:3F8450E78B6BB4364D9892F3D9163C9B
                                                      SHA1:DED998F184F1AAEDF760784EA2E7984D50200277
                                                      SHA-256:A794EDBF53B0394995312F06F22B6266C174746537571408BBFA3409D5CD31B3
                                                      SHA-512:A39D7FADFAB59DABF550EB1EB88E54EC751386F87A794F3CB680CC0C2B650BA7506DFC4D99B9AB87AE967F1C0DF156AD524D0614203E4B849DE5102EA4387813
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,."h..qh..qh..qa.yqx..q...pj..q.M$qm..q.M:qj..qS..pl..qS..pf..qS..pt..qS..pn..q.M!qs..qh..q}..q...pc..q...qi..qh.}qi..q...pi..qRichh..q........PE..L...l..\.....................|....................@.......................................@.................................8...|....P.......................`......@...p...............................@............................................text...%........................... ..`.rdata..nL.......N..................@..@.data........ ......................@....gfids..0....0......................@..@.tls.........@......................@....rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\MakeBigFile.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):43520
                                                      Entropy (8bit):5.843062362448254
                                                      Encrypted:false
                                                      SSDEEP:768:XDEy5KxShlr5c2Vt/KmOCkDWFPVzchVZDX+0w7YYrMxSS/bk:zEykUh37t/Km3kBhVZi0sYYrOhDk
                                                      MD5:127E987EDB1773E830658BFFC84C9A8E
                                                      SHA1:CF75DC8E889338A3FF97FA78DFF71753943D80BC
                                                      SHA-256:B6760F5CDEC7F5823FD23C2DC1DA92D68BEC1F63E7ED221128C6F4E460A6ABDE
                                                      SHA-512:4B183A0FD4F82EE096B1E69F0499CE2BF403474C454C284F16589021032519DD841FF52CDD7F26BA5553A11A88E812AB9DEDD1E7731FB044A3948DBF689207B9
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Nx.d...7...7...7.a 7...7.@.6...7..}7...7..c7...71G.6...71G.6...71G.6...71G.6...7..x7...7...7m..7.G.6...7.GL7...7..$7...7.G.6...7Rich...7........................PE..L......\.................T...X......8L.......p....@.......................................@.....................................h...............................\.......p...................L...........@............p...............................text...uR.......T.................. ..`.rdata...0...p...2...X..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\MakeSelfExtract.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):76800
                                                      Entropy (8bit):6.078599357646344
                                                      Encrypted:false
                                                      SSDEEP:1536:aObV09rFiM/1x4Af9dukmGwVOZ9nfwXrni:1VWrFinA4GwVOZ9nQrni
                                                      MD5:D74083E5AD25785B3900892BA370ADAD
                                                      SHA1:0399BCE6D1AE9D29661AF7180EEF00E352C29481
                                                      SHA-256:F5884BC602AD5CE89E5EFF0D84117D3EC1C32326C881A389105077940C7B88CE
                                                      SHA-512:8B913CB45AA1D5B95AB4527661F6A3C2CB3EC5D470BBD5F449C7A19644203186CCD1139CF7AA34F445C3FB5BA632BCE91E19652286836F9C8D850F26257017EC
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."H..qH..qH..qA.yqX..q...pJ..q.L$qM..q.L:qJ..qs..pL..qs..pF..qs..pT..qs..pN..q.L!qS..qH..qP..q...pC..q...qI..qH.}qI..q...pI..qRichH..q................PE..L......\.....................|....................@..........................p............@.....................................|....@.......................P..|.......p...................L...........@............................................text............................... ..`.rdata..`L.......N..................@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc..|....P......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\MemInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):45568
                                                      Entropy (8bit):6.0143299476405065
                                                      Encrypted:false
                                                      SSDEEP:768:ByvBi9r5wmSnjn250Mz8kx+ECDRechV4ENX0Y8b8zf8bMt:U4nK250MwkVCZVDNX0YgY84t
                                                      MD5:39669FF843312F95C5A7FF5C31DDCACE
                                                      SHA1:5456141D0BCA49482EA770A47267E0857E7B44F1
                                                      SHA-256:88E1A76BEA68C83F71459F8279F1D98A3AC69F5063BBD8D89D770D65796B1744
                                                      SHA-512:65AB2E85E4E6EEE642FEAA89447EDE068FC45C3744C78A3B70DF40376285AD27AA4FD856B73A731B568D1F6B1F23C85C1318819D6D9FE3D87CF1CED102E1D01E
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m.....I...I...I.tzI...I.U.H...I/.'I...I/.9I...I.R.H...I.R.H...I.R.H...I.R.H...I/."I...I...I...IeR.H...I`R.I...I..~I...IeR.H...IRich...I................PE..L......\.................^...V......(T.......p....@.......................................@.................................\...T.......@.......................t.......p...........................`...@............p..8............................text....].......^.................. ..`.rdata..,1...p...2...b..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...@...........................@..@.reloc..t...........................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\MkDir.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):77824
                                                      Entropy (8bit):6.0636829483827315
                                                      Encrypted:false
                                                      SSDEEP:1536:LJOE0/NMCDFUqKP1S6sClb3Ghk0mjUeCDdDC5hBVKPBIYwrnxSmy2:1ONlMCDFUqi1S6hG7mjKDy0BIYwrnQj2
                                                      MD5:51E959BD79F88A4AE3BAF97037BA74DB
                                                      SHA1:9A34C684BF978F55838DFC37A4BCBC8654E0E84F
                                                      SHA-256:771524D14BB91437384055D8199840358BC1F2215C8C368E62179BF51989E727
                                                      SHA-512:7CC08FAA4F81F2F2A3F4866B1961E2242D5E3DABCBEC8FAEEBE0AA94CF2A972EAA2ED4154ABB5FC81723DC952D0211644DA0DCBD1D2112DEFD7ED4D27C125502
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.k............................................9.......9.......9.......9....................................................Rich....................PE..L......\............................~.............@.......................................@.................................L........P..h....................p......P...p...............................@...............P............................text.............................. ..`.rdata..zR.......T..................@..@.data........ ......................@....gfids..0....0......................@..@.tls.........@......................@....rsrc...h....P......................@..@.reloc.......p......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\MoveFolder.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):84992
                                                      Entropy (8bit):6.161969212361687
                                                      Encrypted:false
                                                      SSDEEP:1536:xjYoJbTyReNUGU/jD1piIxkiU7ML0z6T2pb5SkjATVHThyr5cTzIgK2WVPBftH0m:hYoJCReNUGU/jDDDKiR4zRsVHTQsW7fd
                                                      MD5:7A68AB66E94EDB99B3D534CB61C678EE
                                                      SHA1:4368969BE8670A7CE91E0C0B213613E9255531E6
                                                      SHA-256:D0347FF48F6711804728711AF552CEDE8111DF2BDB5BAF74F923C7524E188048
                                                      SHA-512:AB986DBBFB7E077C751C7D632681DCD6A9F657DE2195842039282D91F76ABA5D1AB74BE1F6CA1635E67321BE145CCC6FDABAA3D634C425E7867B6473C2476664
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L..L..L..E.K.X.....N...&..I...&..N..w..H..w..B..w..Q..w..J...&..W..L..'....C...'.M..L.O.M....M..RichL..................PE..L......\.....................~....................@.......................................@.....................................h....`.......................p..L...p...p...................<...........@...............H............................text............................... ..`.rdata...K.......L..................@..@.data........0......................@....gfids..0....@......."..............@..@.tls.........P.......$..............@....rsrc........`.......&..............@..@.reloc..L....p.......2..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\Option.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):496640
                                                      Entropy (8bit):6.184857234148228
                                                      Encrypted:false
                                                      SSDEEP:6144:cu6X8W3swIlO2MEbYZcx2FhHhrVnN5n9pdZxVFgjp5Delvkq6gzZB9m:yX8W8wIlBMIYxTl9pdZ2HwB9m
                                                      MD5:A8053C1857271C56D504C0AD8D9C7DA9
                                                      SHA1:43446C3EC4F0ADF609FB8F331F3E55A5018BFFCD
                                                      SHA-256:C538E19326C7880FC5125704C84985F9914DB6F86FA1FDC50C67D4E166EF3069
                                                      SHA-512:30A04717E51939779C6FFA3326D94CA52C95C51B599ACADDDBCCB1A8FE7B581F00408A2527B817BC8E4A15A2CE76A5940BBF7656BDC21D589B871BC069247157
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5..q...q...q...x.^.e......s...T..t...T..s...J...x...J.......J...S...J...y...T..n...q..........9.....2.p...q.Z.p.......p...Richq...................PE..L.....\..........................................@.......................................@.....................................0....0..@....................P..l....%..p...................L&.......%..@............................................text............................... ..`.rdata..............................@..@.data...d3..........................@....gfids..H...........................@..@.tls......... ......................@....rsrc...@....0......................@..@.reloc..l....P......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\RemoveZoneID.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):51200
                                                      Entropy (8bit):6.022505861835999
                                                      Encrypted:false
                                                      SSDEEP:768:+gQrcYhfYSy7QwUAkrRaQHI+lxlz4Ua5LkzAcP4pVoTsFF5P1IY/b4V:/Fixycn7pjz4Ua1k5P2VwKfPz0V
                                                      MD5:FE6FF45A035EE2444E9F732EE9A9852D
                                                      SHA1:079E2F5178D9BCD79D86F58C91D9F9D5EB0B2CFD
                                                      SHA-256:FF82407EAFEA7ED9010C99A8620D6A4E1B810C4332B342CDBCA330DFD24E9745
                                                      SHA-512:1056560963FA79083FB90740175E614074EF7376A4B81C90A3D365686D58FD951AFB13532216D1017088EFB550D92346C4FEE9AE06CC14B610C766F3B1F9CB6F
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........."H..qH..qH..qA.yqX..q...pJ..q.=$qM..q.=:qJ..qs..pL..qs..pF..qs..pT..qs..pN..q.=!qS..qH..qT..q..pC..q..qI..qH.}qI..q..pI..qRichH..q................PE..L....\.................n...\.......d............@.......................................@.....................................h.......@...............................p...........................P...@............................................text...Ul.......n.................. ..`.rdata..&5.......6...r..............@..@.data...<...........................@....gfids..0...........................@..@.tls................................@....rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\RmHardware.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):28160
                                                      Entropy (8bit):5.692462757295453
                                                      Encrypted:false
                                                      SSDEEP:384:0w5tNyNug0JD0Gapc9NSbyuZOrny9gX1+pQIcRJS+nD0LukO+FJeW2gTdVXpzwKe:H/B1+pQI8JSO0aktJ3BdVJwKtjBwjBq
                                                      MD5:11A6051DD8BB9B53D6C2D8B45D4683A0
                                                      SHA1:CD7ED6CEDD0189F53F5CA076808720CBDC8F3C59
                                                      SHA-256:548BCDB90FD1AC1A2B92371A2BBF1C4C9A1B920712358C164FF3083A979D29B9
                                                      SHA-512:E6F310FDF66CBC15D01652162C6E6CCFC06436B8608C54D10DB79D8B25A441377A0E34C5436788D45468AFBD3D28770A6D9212C67A6A5403DE35C0E4BB3A9A14
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........:kA.T8A.T8A.T8H..8Q.T8..Q9C.T8.n.8D.T8.n.8C.T8z.W9E.T8z.P9O.T8z.Q9].T8z.U9G.T8.n.8Z.T8A.U8.T8..]9I.T8..8@.T8A..8@.T8..V9@.T8RichA.T8........................PE..L......\.................4...<......./.......P....@.......................................@..................................b..@...............................,...@X..p....................Y.......X..@............P...............................text....2.......4.................. ..`.rdata..l....P... ...8..............@..@.data...<....p.......X..............@....gfids..0............Z..............@..@.tls.................\..............@....rsrc................^..............@..@.reloc..,............f..............@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ScreenSaver.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):28160
                                                      Entropy (8bit):5.673192867444552
                                                      Encrypted:false
                                                      SSDEEP:768:iV8X11i9Y43SP0aktcBsyVVOGz4h/NTh:iV8l1AY4SP9kyzVVOGm/F
                                                      MD5:2895E75F34286D82F21BD25ACD7BDE7A
                                                      SHA1:266C3F90446963AF82BEE8E4B5C12D6BCA52EB23
                                                      SHA-256:A70048A24B6A9269FE6FB8B44D206A375FA419522C33279B5978B937F7452BDA
                                                      SHA-512:16886A3C8ACB3F34130F1854AB449584053907570A5D5053F2731004410F2CEC8DC0C55397E52DC4B99F0F7020D524832ECA16362F6288BBD414D5FA324B1E2A
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I.nB(.=B(.=B(.=KP =R(.=.q.<@(.=..}=G(.=..c=@(.=yv.<F(.=yv.<L(.=yv.<^(.=yv.<D(.=..x=Y(.=B(.=.).=.v.<K(.=.vL=C(.=B($=C(.=.v.<C(.=RichB(.=................PE..L......\.................4...<......b/.......P....@.......................................@..................................b..,............................... ....X..p....................X.......X..@............P...............................text....2.......4.................. ..`.rdata.......P... ...8..............@..@.data...<....p.......X..............@....gfids..0............Z..............@..@.tls.................\..............@....rsrc................^..............@..@.reloc.. ............f..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\SettingInitialization.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):52736
                                                      Entropy (8bit):5.87940280082323
                                                      Encrypted:false
                                                      SSDEEP:1536:LvMnfKszUcDR0y7kf7VB2d74LRtyfi1dMv:LvM59WygVE4LRtyK12
                                                      MD5:CA8E4B82106A174F536399CAE71CE4AB
                                                      SHA1:AE82A5F189A5DC608EF67C3489BB49419D323F5E
                                                      SHA-256:65B73E03B5BB08B1DB754EE0C81AE3AA1194C74E4496E22935C5A79A56AC8C5A
                                                      SHA-512:102261B3A4AC1165E51DDBA5D8FE37284953D3A716E4AB86C9250E87218B2578790ECB94CFD8BBF1B01342740146F47C8DB54668C0E996F8033B433F66DF2FFC
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........9..DXpLDXpLDXpLM .LTXpL..uMFXpL...LAXpL...LFXpL..sM@XpL..tMJXpL..uMXXpL..qMBXpL...L_XpLDXqL.YpL..yMNXpL...LEXpLDX.LEXpL..rMEXpLRichDXpL........................PE..L......\.................d...l.......\............@.......................... ............@....................................T...............................$.......p...................L..........@...............T............................text...Uc.......d.................. ..`.rdata...D.......F...h..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellCascadeWindows.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.750869349214829
                                                      Encrypted:false
                                                      SSDEEP:768:0QamgmdIQcYj6yDgqko8IS1zVuithbJphv:0Q9gMIzyDpkx5lVuCb/
                                                      MD5:D656A996614EF9071D159333CAE875CD
                                                      SHA1:43A2B0F3FAD424805472DCAF14EC24E345B25944
                                                      SHA-256:749CAE3652DF3B05B8A5659DFBA40676DF88696EA7DD6E0DEDF8CCD317B31196
                                                      SHA-512:9300D632C638979FE46E2107AD2B7437895176700C56F712FE6DAA5B4CD0BFC7D8340C33F1FA2052A203AC32548C22883CFFD1974567930B5B7E11B4044811A1
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L...e..\.................4...:......b/.......P....@.......................................@.................................tb..,...............................$....W..p....................X......`X..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...D....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc..$............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellMinimizeALL.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.749082941782223
                                                      Encrypted:false
                                                      SSDEEP:768:2/haJ1mdIQtiS74yko8oEDVyqthutphq:2/hY1MI7S7RkxXVy6ur
                                                      MD5:C8AFCF18AD2EEC166366D2B7C8A45085
                                                      SHA1:F937D0B18320F5694DEF82D510AA1E7515B73E90
                                                      SHA-256:B57FD95455EFFF6262879B804F98B189CCDAE52DBA2C20B9D5F494FB4E4BA4F9
                                                      SHA-512:EB4CC6271FB5B367F1AD4869736E3BC6361E926CC20F9174246AC6DF0D9CA33A9502F6CA83EA79CEBE0A324773042ACE93087252B8A9FD67B20B39DB8CB9780E
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L...s..\.................4...:......b/.......P....@.......................................@.................................tb..,...............................$....W..p....................X......`X..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...<....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc..$............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellSetTime.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.745876428189006
                                                      Encrypted:false
                                                      SSDEEP:768:tpca11ydIQ5HS74Sko8xVVVQPth0TphC:tpck1wICS7JkxlVQX0t
                                                      MD5:2DE6568693CC5F720F5AE811DEEB9930
                                                      SHA1:6B0A9729E047BD6C391F99CFBEE7A49509B28097
                                                      SHA-256:157D064E2D1D1CBEB08DC474D24B7C381B34AB3339E5841E74E140319F525713
                                                      SHA-512:519140A7ACB331263DA7589E293C7F14CABD8F57883226494397ED87B9BADD9598A307BCFC7A4C7B9D906B5ABEE3094074075FBFA32B85EF4844AC57BB2E1197
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L...>..\.................4...:......b/.......P....@.......................................@.................................\b..,............................... ....W..p....................X......PX..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...<....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc.. ............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellStartMenu.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.741772311110448
                                                      Encrypted:false
                                                      SSDEEP:768:Ir/haJ1mdIQZ6S74Sko8xVtVUEth43php:G/hY1MIHS7Jkx9VUE45
                                                      MD5:F0879F97E0543843996F9EFE8AC1EBE4
                                                      SHA1:9EDA74BCD05C28BD23AC841838166C27C13206EE
                                                      SHA-256:25849404919067F3650FA173EE2E4D5A6E990794BD9777C779FC6CD5DD643EAF
                                                      SHA-512:9F91F8A4352749EE41FA19EB4D524E2A7E49B127CF169C28DFA4EC71438EBD19CD4008EEACC1BC4CC7C30A950C36E80CBB857ECD369A9743CD65FA941EDCBB2C
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:.A.T@A.T@A.T@H..@Q.T@..QAC.T@.n.@D.T@.n.@C.T@z.WAE.T@z.PAO.T@z.QA].T@z.UAG.T@.n.@Z.T@A.U@.T@..]AI.T@..@@.T@A..@@.T@..VA@.T@RichA.T@........PE..L...J..\.................4...:......b/.......P....@.......................................@.................................\b..,............................... ....W..p....................X......PX..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...<....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc.. ............d..............@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellTileHorizontally.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.754823573838595
                                                      Encrypted:false
                                                      SSDEEP:768:QQamgmdIQFb6yDgqko8IS1zVIOth1LphS:QQ9gMI/yDpkx5lVIe1V
                                                      MD5:18787B1F693429600B2117E0D2F31E73
                                                      SHA1:CE177D0B3A7F6B93EE883158D5E9D48C42DE42A5
                                                      SHA-256:11B63B7AE2E394F7E7A6E8E5F32CA4E1B19E744E215505773242C36B78113229
                                                      SHA-512:44B08557F2B08E894903A1F92744AD7BCA5E06A807170C1E3DA12945B6F1A0AD42770520B5AACB60976ED7DC0AF02D0CCD940C9013208168D839C9F4EA4B5EB4
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L......\.................4...:......b/.......P....@.......................................@.................................tb..,...............................$....W..p....................X......`X..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...D....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc..$............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellTileVertically.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.751448542700327
                                                      Encrypted:false
                                                      SSDEEP:768:1QamgmdIQcYX6yDgqko8IS1zVkkthN3phv:1Q9gMIvyDpkx5lVkEN5
                                                      MD5:E83ECC8BDF2AA107D5774704B3318326
                                                      SHA1:C614A339383685C71BB29F2ED191D09CBFB051DA
                                                      SHA-256:5A5843A55611C73EE423375E5FFBBA947F425CE439978321060738A29D7271E5
                                                      SHA-512:E7C5CC44CE0F34391DC069CE50FA97117497CEB2B1174862813F2E5214786EB632CF39AD63B1E472D02DB9398D0B2CAAE0CB19B5A563056FE3C5F65B6026F9A1
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L......\.................4...:......b/.......P....@.......................................@.................................tb..,...............................$....W..p....................X......`X..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...D....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc..$............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellUndoMinimizeALL.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.755144464969013
                                                      Encrypted:false
                                                      SSDEEP:768:yQamgmdIQFr6yDgqko8IS1zVsPjthXpivtphS:yQ9gMIPyDpkx5lVsPLXpivr
                                                      MD5:6C35B212E4E989162E1B39AAA4DAFDD2
                                                      SHA1:6C6FA05C7A5C158F6A0468A7645A105C5E8E6675
                                                      SHA-256:1FC092C2EBA3D3CD5D76BBD3DF9C2D27F0973902A75B7AC24A7DC144BCBB35AD
                                                      SHA-512:C7B15874C3DA3A806AAD563790EEC918F137E1987972A23CAEF28B2935CCD48051082698E1CF9834B6D69C788CAC0F82ED85E572C7A827D955906D2576A4E25F
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L......\.................4...:......b/.......P....@.......................................@.................................tb..,...............................$....W..p....................X......`X..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...D....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc..$............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\ShellWinHELP.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):27648
                                                      Entropy (8bit):5.746507365806136
                                                      Encrypted:false
                                                      SSDEEP:768:E/haJ1mdIQ1+S74Sko8xVtVinthktphC:E/hY1MIPS7Jkx9Vi/kr
                                                      MD5:8765868D1E8A40621ADD696B92568D02
                                                      SHA1:41BA3194750EBA495F587096E999BE66F0989834
                                                      SHA-256:8A38866AA566B8AB6032BE2B0E8D7C4F6E2CDF55CE837079753D7E831D01C7F8
                                                      SHA-512:2127EF9B5B5EF246C4D8ACAA5770527DD981163AB8EB6A7BDA38390FC00F687E301FD7ED9B3567A5EFEC2392BC56EA0D6BC98BDAD7AE7D2DC1CD91B73E123FA9
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I..B(.IB(.IB(.IKP IR(.I.q.H@(.I..}IG(.I..cI@(.Iyv.HF(.Iyv.HL(.Iyv.H^(.Iyv.HD(.I..xIY(.IB(.I.).I.v.HK(.I.vLIC(.IB($IC(.I.v.HC(.IRichB(.I................PE..L...Y..\.................4...:......b/.......P....@.......................................@.................................\b..,............................... ....W..p....................X......PX..@............P...............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...<....p.......V..............@....gfids..0............X..............@..@.tls.................Z..............@....rsrc................\..............@..@.reloc.. ............d..............@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\SimilarCopy.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):182784
                                                      Entropy (8bit):6.2101165743171105
                                                      Encrypted:false
                                                      SSDEEP:3072:dGosQys50tlwhtOo894MEM7tYMt3sjjaMX1H1JUwQXZ3gpwQt90Zuzr0oLsJ23+4:dGoWtC8bEMyMKjttjQ5gplt90Qcc
                                                      MD5:E21718A1D443B55D448188783954C476
                                                      SHA1:DACAF7A018B63E8A82A587B56C26A9E3C3A9F3AB
                                                      SHA-256:EABACA14EF6E5B609D84F7462925398BF053532501027B68A445F140E09D10D6
                                                      SHA-512:4D34DA52A1A1ECE7D265C70876C2B51A2FB48177BBA8E79B1A9682C9C7E22C2FE58C010D298F82BB7DFABE22FE2FA595E6E91756B31427E2CEA8895B17F214BE
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......xr<S<.R.<.R.<.R.5k..(.R..JW.>.R....9.R....>.R..MQ.;.R..MV.2.R..MW.!.R..MS.:.R....'.R.<.S.I.R..M[.3.R..M..=.R.<...=.R..MP.=.R.Rich<.R.........................PE..L......\.........................................@.......................................@.................................Tk..................................p;...3..p....................4......P4..@............................................text...E........................... ..`.rdata..............................@..@.data................x..............@....gfids..0............|..............@..@.tls.................~..............@....rsrc...............................@..@.reloc..p;.......<..................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\VersionCheck.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):53760
                                                      Entropy (8bit):5.972963477375622
                                                      Encrypted:false
                                                      SSDEEP:1536:BR/k0fQpl/qMO4IkxGVLTp0mrR8rL7UB:BRc9D/XoVLTp0yR8rL7
                                                      MD5:8CDB6B3DCB0525F9B4FE00B8B64264EA
                                                      SHA1:1940B4D91BE40AB216656338BBB7DD3981103325
                                                      SHA-256:131FA1A95709A2770383FD1C6AAA05571E507B0647D1383923A24DDE61A1F9A5
                                                      SHA-512:60653DEA120FB2DDDFB15470CBB332404C0E7103D8D1089689F221DD113F91073149C025A6F7409E68BA511AFAEF6C02087C4C605D1D15E28E80EC03E85CE767
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!H.jrH.jrH.jrA..rX.jr..osJ.jr.M.rM.jr.M.rJ.jrs.isL.jrs.nsF.jrs.osT.jrs.ksN.jr.M.rS.jrH.krO.jr..csC.jr..rI.jrH..rI.jr..hsI.jrRichH.jr........PE..L......\.................p...d......tf............@.......................... ............@.................................4...h...............................@.......p...................L..........@............................................text....o.......p.................. ..`.rdata...9.......:...t..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\VersionInfo.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):59904
                                                      Entropy (8bit):6.046323840399343
                                                      Encrypted:false
                                                      SSDEEP:1536:RACXizJxw0OMS8EJskXVHTM+wk/4Snv9vZmW:RACXi9k9JrVHTM+//4Snv
                                                      MD5:F6C70B5B28B6466441AEA83D3EB2D56C
                                                      SHA1:8834F51FFD98493A2E05DC78299E2B2D8DF3E032
                                                      SHA-256:DCD7D88C59EA2E2396C0F3F3C139F25D4CE6779DE5EABA6C8C77C3EAD2BD6D05
                                                      SHA-512:40AFF54A4222A26819FEA803EB2FC5796B7B2E34299E77A2149ACDEB9CD776BF30BD822352006A01D473BA5C7FCA31BCBAFC5EACF26E21A3FF3FAAE5D6B7ADA7
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;..;..;..CR.;..Kb..;..s...;..s...;..e..;..e..;..e..;..e..;..s...;..;..9..9e..;..<e>.;..;V.;..9e..;..Rich.;..........PE..L.....\.................~...n.......n............@..........................0............@.................................<...........8..............................p...........................@...@............................................text....|.......~.................. ..`.rdata...>.......@..................@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Default\WinEx.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):68096
                                                      Entropy (8bit):6.118797822672869
                                                      Encrypted:false
                                                      SSDEEP:768:3MsLCyxn9iAo//JLOhyI19Ycm9fNqcRk2UG4Vgi/ebQVOOECUAz1XhwhzcvHNg:XLDn4ArPYfNqykGQVOOEPAz1ShzwHNg
                                                      MD5:C060926AB85841A9608B264F67F1A3DB
                                                      SHA1:8700809AE88A8664EA15B570A3A470E7129BB3AE
                                                      SHA-256:B1A3BEE86AB63298EF9B5FFC9DFEE5A62F5E834C0223120B3CC7F27E644B2AC5
                                                      SHA-512:95DB3F0B07E9F7CD3C8FE3B52CE3B81C76F0D18E7D9E5D6C464EF695D9C72F8D0BD5E456F765A96EF25A8032297EE11CF2136A53867B4AD5A71D34C4852F00A6
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........."P..qP..qP..qY.yq@..q...pR..q.M$qU..q.M:qR..qk..pT..qk..p^..qk..pL..qk..pV..q.M!qK..qP..qC..q...p[..q...qQ..qP.}qQ..q...pQ..qRichP..q........................PE..L...,..\.....................n....................@..........................P............@.....................................h.... .......................0.. .......p...........................`...@............................................text...E........................... ..`.rdata..T?.......@..................@..@.data...\...........................@....gfids..0...........................@..@.tls................................@....rsrc........ ......................@..@.reloc.. ....0......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\AdobeReader.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):19456
                                                      Entropy (8bit):5.614276420982344
                                                      Encrypted:false
                                                      SSDEEP:384:YJoy2dhAShVVgWReE9kOtJ/pOi4+hQi+9VyRemoH:YXSHVgekwhpON+25Vy5y
                                                      MD5:7F78B0173A3700DA4A709A895D5D4BBE
                                                      SHA1:B113155367FB5D3D266343855A8C50E5ACED8FA0
                                                      SHA-256:D8A1D78497110FD90D4E05E609B28DF53BDD588AA4B45871C6F3E850FDF20B5D
                                                      SHA-512:82609B6709FD955407AB47B6117CFD795958ACDBF726DAEC6D5740D36697B326B47231A3F3E3EC308E7055448E25D7216098BDB2BDF620C56A16573B0CF371DA
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^........................z.............!.|.....!.{.....!.z.......~.....!.~.......v..............................}.....Rich............PE..L.....\...........!.........2.......!.......0............................................@..........................@......dA.......................................7..p...................\8.......8..@............0..(............................text............................... ..`.rdata.......0....... ..............@..@.data........P.......:..............@....gfids..8....`.......<..............@..@.tls.........p.......>..............@....rsrc................@..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\InternetExplore.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):22528
                                                      Entropy (8bit):5.732773810298832
                                                      Encrypted:false
                                                      SSDEEP:384:994keTvC2ctwXCOk0wlqEJkOenxqWd6QflauWJnf2WBUBNo8:7YhX5k0wnkTnxqEeu0fxBs
                                                      MD5:D1A72AA69903DAEE2F979A9343247B68
                                                      SHA1:C40C36BD0CE123E3F8BCEDB20B73CE437B76EF41
                                                      SHA-256:BC08C59DA786C56CB8CB5284C8C3AB60A088931B7A372CBBCEED6CABD2C58A1A
                                                      SHA-512:73CE45EF3276212EB10E98C97500A775E14F4E1897036DABE5D6FCD2CCB5B5415E1B2876D3A031183D4D1FE7DB8D8B3429B2AEC99EC6FA7B10639698C05A626D
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................k....&........J3.............................3..........T.....T......Q.......o....T......Rich...........PE..L.....\...........!..... ...:.......%.......0............................................@.........................pE......HF.......................................;..p...................\<.......<..@............0..h............................text............ .................. ..`.rdata.......0... ...$..............@..@.data...<....P.......D..............@....gfids..8....`.......F..............@..@.tls.........p.......H..............@....rsrc................J..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\MediaPlayer.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):22016
                                                      Entropy (8bit):5.648342539287798
                                                      Encrypted:false
                                                      SSDEEP:384:Z6p0rym+AuLvBYW/xeJLbeD9+nUNBU/ikORr4FhqLWv1AK1R8WiiUwFK:ZbcviLE9gC6ikUcFhqLuWAR8GUo
                                                      MD5:2A9AAFE646D09976334A63A6CA141BA0
                                                      SHA1:C575EB018ED31B981B20D71D99CE3482796F71BB
                                                      SHA-256:93CFE01A71CAB7361AFCC4DA425AF5A69E9AE09A792ADBC7F30EC17CE7A1A50D
                                                      SHA-512:964E82B43D47A244773109B14CF05D69FECAD0961D96730FFA1B2A48F7B20468EC2AC0D50FB4171B024606E0C4F1DB324BCC02A82453F6016BA874D219F9A66F
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@....................}.+.....E&......-.......*.......+......./.}...../.......'.............................,.....Rich....................PE..L.....\...........!....."...6......H'.......@............................................@.........................PR......$S.......................................H..p...................|I...... I..@............@..D............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........`.......B..............@....gfids..8....p.......D..............@..@.tls.................F..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\PvPlugIn\RealPlayer.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):20992
                                                      Entropy (8bit):5.6236439479559515
                                                      Encrypted:false
                                                      SSDEEP:384:YJ0eS8wUOQjqnT02iV+yVgymkEJkOt1JWiY0n68i+9atJjaCw:YN7oTxiwyVg3kw1JWtu5aGC
                                                      MD5:ABFF46C355CF260AD6728CD75C3741DF
                                                      SHA1:FC7E440A3FB4C63CAB2A6F76509755E02528F85C
                                                      SHA-256:C1F3829123DFA2DE18E91FC6962DDD982A317FE61EFD311784125A7DF8637C1C
                                                      SHA-512:ACE7185BABB3A33EAC993D977DF41A18A88BF39D30E4196DE08B8A1DB9CEB8D20C64ED43E99BB5E508B3488A31DCD37E944E10B792207C8CC8DDE079CF444EDB
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^........................z.............!.|.....!.{.....!.z.......~.....!.~.......v..............................}.....Rich............PE..L.....\...........!..... ...4.......%.......0............................................@..........................A.......B.......................................8..p....................9......09..@............0..(............................text...o........ .................. ..`.rdata..:....0.......$..............@..@.data........P.......@..............@....gfids..8....`.......B..............@..@.tls.........p.......D..............@....rsrc................F..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Brws\Brws.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):18432
                                                      Entropy (8bit):5.001016464464304
                                                      Encrypted:false
                                                      SSDEEP:384:zHS43yu7QkOv0NbN8IntW9EwDKYOGb+I:zWu7QkM0b7kxgI
                                                      MD5:A499FD9AC7374A74DD34EDE6981CA770
                                                      SHA1:CE2861384E9940998A84F837E8977192270DD9D9
                                                      SHA-256:1C30A7958F1D827CA709866EC9AAA6C6F93A8CCCABC7199EA081A7AE625FD446
                                                      SHA-512:CCD081A4F9D190A55A5CF88E7D17F13253187AD179BE3D2CA0D7A158C08A062D53FF97D464D5C795489CFCDA19D881E0C837F0F13A6254685B2695C6B8E9FC84
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!.........8............... ............................................@..................................$..P....P..0'......................,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc...0'...P...(..................@..@.reloc..,............F..............@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Fin\Fin.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):28160
                                                      Entropy (8bit):4.808844065947119
                                                      Encrypted:false
                                                      SSDEEP:384:ziS43yu7QkOv/brB60LDes97G4htJTHRo/tFui0KDCn:zNu7QkM/brJTxJTxYUfo
                                                      MD5:5EF247CBECA7A0CD9057C2951ECD1907
                                                      SHA1:4FCF96B423BCF017FF77A69C90300F898F448741
                                                      SHA-256:7CA6047C78D69B9787505F63AC937BEABA4941D182002311467E9E629481E4E3
                                                      SHA-512:9F6AE4BDD135A420644E864BC9E2CEF3517F83A6C6DCCB9F94DF38B128E494FC06BE321E9B420286ECAE2EC15D964F320EF7FE9ECB6BF124C3B8B4D19578D666
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!.........^............... ............................................@..................................$..P....P...L......................,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc....L...P...N..................@..@.reloc..,............l..............@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\MArc\MArc.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):34816
                                                      Entropy (8bit):5.032186775711509
                                                      Encrypted:false
                                                      SSDEEP:384:zqS43yu7QkOvybNnL2hY2hI0RHHElynDElynhLKtgT:zlu7QkMybNnL2hYWI0xHX9M
                                                      MD5:D4E2F672EE75DD85A3E7C4754C4250CB
                                                      SHA1:128382A7A8ED571B620CD68AB7A444ABFAC8E5F6
                                                      SHA-256:DB3128B72FF12E5800813016822B97F1555A19DB9B4EAF9BEBF4BDDED9CF51EE
                                                      SHA-512:619F13533ADA2D118C0660A9E18A08DCD073BF250BF8026B610F08BB29424F0BC72F00C488501FDE9A34B1B476DC6D8BC5D85C3E404629BF295E146B843D5982
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!.........x............... ............................................@..................................$..P....P...f......................,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc....f...P...h..................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Seeker\Seeker.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):15872
                                                      Entropy (8bit):4.82049295742857
                                                      Encrypted:false
                                                      SSDEEP:192:zYHSuCO3ZRhj8u/jAkOvcfzU3qaDJAahWKI/8RR/:zmS43yu7AkOvcbaDJAasKIU
                                                      MD5:0E5B6E88610DCF54449B135A7460EA3A
                                                      SHA1:CEB84946954D1B56947A118BF3688288C436DF00
                                                      SHA-256:4D27AEAEE4B9B0BCA4EFBC2694A9042D8F57790D074E53B53725060D83D0102B
                                                      SHA-512:A0E9D28C0E1FBC1335852699213FF461D09B1BE62651B1C8CB3F12D861D2A3F174D32574C7200A4653B5BE33E76F57E19B90BE6E071BEE5B0694AEB8D1BC0699
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!......................... ............................................@..................................$..P....P..`....................p..,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc...`....P......................@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\.ja-JP\Txv\Txv.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):18432
                                                      Entropy (8bit):4.929200383221225
                                                      Encrypted:false
                                                      SSDEEP:192:zxHSuCO3ZRhj8u/jQkOvtfzU3qBP+ATtqJKh4vTEJTG3:z9S43yu7QkOvtbdFTtUKhnJ
                                                      MD5:0C1A25CAF913C4B06311D3A522CBB705
                                                      SHA1:9873BFDBA9990530282A5D6E95B4FF052D52804D
                                                      SHA-256:B8E81F9854D74F83DFAB55E5789A9C451AA457FC0F00C9677F7901BF2C9CCB1B
                                                      SHA-512:B6B260CBC2B008BB4FBED27991A2D6B1948B1979E5A292D98586F968C9F14E75A141A0A1B056DDD44159397B7B91461AA640059D0C9769459A1A5AD831D52C8C
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............lw....J.....J.....J.....J.....b./..........(J.....-J......s....(J.....Rich....................PE..L.....\...........!.........8............... ............................................@..................................$..P....P..h&......................,.... ..p............................!..@............ ..l............................text...t........................... ..`.rdata....... ......................@..@.data........0......................@....gfids.......@......................@..@.rsrc...h&...P...(..................@..@.reloc..,............F..............@..B................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\Brws.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):79360
                                                      Entropy (8bit):6.00329653399952
                                                      Encrypted:false
                                                      SSDEEP:1536:gusvbNxGko8Af8KiyjAA7OwXKmNDuEBP16rKmNbI2Yrw+D/:gus9AfT/jlOwXK8DuE1YK8bI2Yrw+b
                                                      MD5:40B328F26E2A5E8BD90AF22F3EBE070D
                                                      SHA1:5C8DA273DADBA4E774569AE245DD63C820A9E94B
                                                      SHA-256:A00DDA83283402D476B96DA5C262E2E59383FF3E7B2C83851860C4C75B2F6749
                                                      SHA-512:A0866E6775A5EB5EC3AE14C934F889454524EB10A50A27FED0906E5439DC767CA741A15E5ADFCE8C60716AFA2903896A4F625D5D97EEA8461AA4E29A9E9E86A1
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............R...R...R..[R...Rd..S...R\%.R...R\%.R...R...S...R...S...R...S...R...S...R\%.R...R...R...R...S...R..7R...R.._R...R...S...RRich...R........................PE..L.....\.............................;............@.......................................@.....................................|....@.......................`..4.......p...................l...........@............................................text............................... ..`.rdata...c.......d..................@..@.data...`...........................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc........@... ..................@..@.reloc..4....`......................@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\Fin.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):231936
                                                      Entropy (8bit):6.359554762549108
                                                      Encrypted:false
                                                      SSDEEP:3072:3oGs/n7Ijn6QsR+gR8aBbR2ttNP1aJ66KcWrSlXHmlm+F/Bt0r7gdBb0HRgu:3oGs/nDQfgR8aBAtF+tmBHCgLTu
                                                      MD5:3E28BBBB2C3E9FC326EEBE6873591D71
                                                      SHA1:7F7130EDEC57D272F1DAFBF0FC88A9A6F0666E1F
                                                      SHA-256:46D17FCD0A11AF3308C4F7C8266CC3B5FAFBCEC72E011290965ABBA2673952B9
                                                      SHA-512:DA314FBC019CCDA57CCF62367CAD061693BCAABA2919CCBC6198604B1C79C216FF853C35EBAA3F2AAA251DFA1F062C15593C77DF73125BA1CB8C82B6F889AD50
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D.YU..7...7...7......7...2...7..^....7..^....7.;.4...7.;.3...7.;.2...7.;.6...7..^....7...6...7...>...7.......7.......7...5...7.Rich..7.........PE..L.....\.................$...h...............@....@.......................................@..........................................@..x:.......................Q......p..........................p...@............@...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc...x:...@...<..................@..@.reloc...Q.......R...8..............@..B........................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\ICON.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):82944
                                                      Entropy (8bit):4.254455940298376
                                                      Encrypted:false
                                                      SSDEEP:384:MPlIKD6KKDo5KDdPKD1KDvKDmKDdKDHX4KDxPKDWKDKKDSGCEKDwKDHKDlKD0KDf:MMq0fbGCe/TL+
                                                      MD5:E8750AC7FB73615AE6ABEE223E3B5E85
                                                      SHA1:0F9F1AE6C93CFD077CCC4353550344B50DC67618
                                                      SHA-256:AE16BB37FAEA37F30ACB7858F8DD10DDCE3BCB8431B3F92AC698943FE91001E1
                                                      SHA-512:24B7FDE8E6D0F21B46A0BC7DF4E44444E68BB02400CB3E2E843F0D4F9F22F15FF3F9F06A7FDCDDDB240DB9FDAC6310C806A161886C338802833C578AF43F8655
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...s...s...s.......r...s...r.......r...Richs...........PE..L......\...........!.........B...............................................`....................................................... ..(?...........................................................................................................rdata..p...........................@..@.rsrc...(?... ...@..................@..@.......\........T........................rdata......T....rdata$zzzdbg.... .. ....rsrc$01.... +...4...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\MArc.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):365568
                                                      Entropy (8bit):6.150560549640472
                                                      Encrypted:false
                                                      SSDEEP:6144:ERvjVrgzIAoSulzVtrfL364qWgDynIaVFUMSLf0dGwq159gGlVbwnjLnf/Rnnv8W:ejNgzIAoSuFrfLUW01f0415j+v8W
                                                      MD5:FA5B14BE8C70286AFA1C0F8AD3049C57
                                                      SHA1:9ABC557E441F48648F1BE10D5B97EF51884F20AA
                                                      SHA-256:2E724F683E18A564C6A76D081A575108A5EA1B2B5ACCF17B0E250B472E10639E
                                                      SHA-512:A1D5D7D96A69015A8840E46A3BE2E0DDD761E078369BB8653EBACCB7307F8C8955537D2E0F616E47FC23F62B1554F5991B2C2274583B6F8A1A721D0924B4CBB6
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;J..Z$.Z$.Z$."..Z$.n.!.Z$.V...Z$.V...Z$..'.Z$.. .Z$..!.Z$..%.Z$.V...Z$.Z%.TY$...-.Z$.....Z$.Z..Z$...&.Z$.Rich.Z$.................PE..L.....\.................@...X.......g.......P....@.......................................@.................................T........ ..02...................`..p~...C..p....................D......PD..@............P..(............................text...%>.......@.................. ..`.rdata..V....P.......D..............@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc...02... ...4..................@..@.reloc..p~...`......................@..B................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\Seeker.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):159744
                                                      Entropy (8bit):6.064380645507989
                                                      Encrypted:false
                                                      SSDEEP:3072:J1oRVrRGVMUmVCebjTEk9YOlhmheDtCa/9nTWzKbfnaUba17Of2FeETO5R:J1kVwMUmXjTEk9YOWMRC89nLBa17Of2A
                                                      MD5:39619D2927B295EF246385FD38E1F0AC
                                                      SHA1:9ED554E84058E848B359BA0E2481B6F3B87E0C1D
                                                      SHA-256:9C441BBE04D80FDFCCCCEEC3215AE435420236AF9260A3C2155B4BAA5BA555AA
                                                      SHA-512:801F69EF1095CA42F62E0DCA7BE4B80734661469FAD4C2E9777915C4ADB43EEC5086E9FAB8CBB7D7EBE7B036C465D610519958F6CCFD88E6969C9DC7ACB5603B
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........b.|.1.|.1.|.1..o1.|.1.%.0.|.17.21.|.17.,1.|.1.".0.|.1.".0.|.1.".0.|.1.".0.|.17.71.|.1.|.1.x.1}".0.|.1x".1.|.1.|k1.|.1}".0.|.1Rich.|.1........................PE..L.....\................. ...T.......b.......0....@.......................................@..........................................@...6.......................2......p..............................@............0...............................text...3........ .................. ..`.rdata.......0.......$..............@..@.data...............................@....gfids..0.... ......................@..@.tls.........0......................@....rsrc....6...@...8..................@..@.reloc...2.......4...<..............@..B........................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\SendToCompress.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):71168
                                                      Entropy (8bit):6.112001250417419
                                                      Encrypted:false
                                                      SSDEEP:1536:kxpk4xTG8/p6gEGoSbspRpR6VQJ1sW3cdQkLE:KG8hJF7bsPp2weQkLE
                                                      MD5:300FA9E5D45DE30B3CBE50B32EA38DCD
                                                      SHA1:B53481F7A7974AD59B32D5ADE0984CCE26C5906B
                                                      SHA-256:23C6BF76A89691FBE9901B21A8E6943ACDAAC7B1844125DB3B5503871A96A4F8
                                                      SHA-512:B70B3858ADC8C75D35F42C0B050310D24255A539F10494EB3EF9675920E44A88B33C0889923CD50E4E8E3368CE00AA3E5AC1CBCE482C7DFC700717598000B324
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."n.."n.."n.I...."n.I..."n.I...."n..|m.."n..|k.."n..|j.."n. ..."n.."o."n.j|g.."n.o|..."n.."..."n.j|l.."n.Rich."n.................PE..L......\.....................x....................@..........................`..............................................T...<....P..................................p...........................@...@............................................text............................... ..`.rdata..lW.......X..................@..@.data........ ......................@....gfids.......@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\SendToExtract.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):71168
                                                      Entropy (8bit):6.1194865362904665
                                                      Encrypted:false
                                                      SSDEEP:1536:gxhk4xTG8/p6gEGoSbspRpR6VQJ1sW3cdQkSV:uG8hJF7bsPp2weQkSV
                                                      MD5:41E9B6A5A7B7E90E3A4B3FBB4AF92EB5
                                                      SHA1:E5A8B3A0B1E2DA3B428A73CD49E6EED9E7DAFEBD
                                                      SHA-256:7A2FBFEBC50FB4F966EB183EE6FC1521310CD98B50B1F60C119A9D2557D37E89
                                                      SHA-512:E8BA45336901C08E70EF3923A144B22AE3D4C181DE23E10CFA40113CD418D7B42AB29DF89FA6E5DF1940C4D403F13B2C591097BD71FEC859388A3B6DC0F60460
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."n.."n.."n.I...."n.I..."n.I...."n..|m.."n..|k.."n..|j.."n. ..."n.."o."n.j|g.."n.o|..."n.."..."n.j|l.."n.Rich."n.................PE..L......\.....................x....................@..........................`..............................................T...<....P..................................p...........................@...@............................................text............................... ..`.rdata..lW.......X..................@..@.data........ ......................@....gfids.......@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\Asr\x86\command\Viewer\Txv.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):204288
                                                      Entropy (8bit):6.164436832739145
                                                      Encrypted:false
                                                      SSDEEP:3072:20EEsaFzKOyBlt8h1w2mUM0SmJVf0HNOwxwx/LGAS8SZKFB3Q94SaurHrVqZDZ3l:20EEW5zBU5Vf0qg4+9u4rVQDZ3l
                                                      MD5:4F1929F23201BC1C530A84C10009232E
                                                      SHA1:17A76ECF62C6B0AB776078E6BB67180EC3AAE4BD
                                                      SHA-256:1439D05667875BD1730663FBD8F05566270F87389472F5C9833A0ADCAF2AB1A2
                                                      SHA-512:0A17D4CF62654A6A1296AE09D94917990FB45D69CF9305DF00FF83074E77653F6CB3F40D686A9C04F9DAC6A26D536F9E0F9B86B1DCA110FF9A853DA54B9A1904
                                                      Malicious:false
                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Z}..4...4...4......4.O.1/..4.wk....4.wk....4...7/..4...0/..4...1/..4...5/..4.wk....4...5.G.4.=.=/..4.8.....4.......4.=.6/..4.Rich..4.........................PE..L.....\.....................Z.......X............@..........................p............@............................................ 7................... ...A...Q..p...................\R.......R..@............................................text...1........................... ..`.rdata..............................@..@.data...............................@....gfids..0...........................@..@.tls................................@....rsrc... 7.......8..................@..@.reloc...A... ...B..................@..B........................................................................................................................................................................................

                                                      \Device\ConDrv

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:ASCII text, with CRLF, CR line terminators
                                                      Category:dropped
                                                      Size (bytes):1752
                                                      Entropy (8bit):3.954667384703488
                                                      Encrypted:false
                                                      SSDEEP:24:pHdaTA+mCyGfUquWqrBQdpsgjQ1W6ekeAP:fYB8quWqFQfb94
                                                      MD5:48B97E2754F5BF5E2CD0E98964628EBF
                                                      SHA1:86CB287D3D5B43D773EB3BB17F651C54D90A7637
                                                      SHA-256:8B246E0F3A942CCDDA319A1AFF064A55531C72FB16B033B952D3D1CF367611FB
                                                      SHA-512:5F940379D21625D65C44ECE50624F558ABED32DDEF2A10279BDD7CAE5391BA12771B2AD7FE7E87F6C3A1F36B16DD2DFE42A125242CA2F0C50A500C000DF699D8
                                                      Malicious:false
                                                      Preview:..7-Zip SFX 19.00 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Extracting archive: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe..--..Path = C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe..Type = 7z.... 0%. . 5% 148 - Asr\Common\img\mame4\ViewMode\modeDetalList.bmp. . 5% 202 - Asr\Common\InitTemp\Menu\_TaskTray.txt. . 5% 260 - Asr\Common\InitTemp\Tablet\TabletAssist\FileManageMode\Property. . 5% 316 - Asr\Lang\.ja-JP\MkDir\sample\__\___.txt. . 5% 387 - Asr\Lang\.ja-JP\Option\MacroHelper\mouse_pos.txt. . 5% 398 - Asr\FirstSetting.exe. . 25% 408 - Asr\x64\command\Default\ArcUnPack.exe.

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample1000?????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):1624
                                                      Entropy (8bit):2.6315980935726166
                                                      Encrypted:false
                                                      SSDEEP:48:JwpKWL2lJQZq005MfRbJkFy/De2B/R/XL7+5Wvxgxf:JGKWsJb005MfdJkgLe2BZ/H+5Wvxgxf
                                                      MD5:7D465ECBDBD44843C589BD5E9950C4D0
                                                      SHA1:88566C6A7D14B9EFC92636A8EBD30A13128B44B5
                                                      SHA-256:01A1F2CBBE98C47D2E39E4034055BF84A31F624EFBC03E20D76B6B086B9866FF
                                                      SHA-512:40AD0967DA60BFE811B18C94691CA3038E2FEC150302BDEE4651ABBC40292FD486311FD1838E65B3AE194C9D094E5315CDEC5AD144B9618284606C55C472970E
                                                      Malicious:false
                                                      Preview:..2.....3.....5.....7.....1.1.....1.3.....1.7.....1.9.....2.3.....2.9.....3.1.....3.7.....4.1.....4.3.....4.7.....5.3.....5.9.....6.1.....6.7.....7.1.....7.3.....7.9.....8.3.....8.9.....9.7.....1.0.1.....1.0.3.....1.0.7.....1.0.9.....1.1.3.....1.2.7.....1.3.1.....1.3.7.....1.3.9.....1.4.9.....1.5.1.....1.5.7.....1.6.3.....1.6.7.....1.7.3.....1.7.9.....1.8.1.....1.9.1.....1.9.3.....1.9.7.....1.9.9.....2.1.1.....2.2.3.....2.2.7.....2.2.9.....2.3.3.....2.3.9.....2.4.1.....2.5.1.....2.5.7.....2.6.3.....2.6.9.....2.7.1.....2.7.7.....2.8.1.....2.8.3.....2.9.3.....3.0.7.....3.1.1.....3.1.3.....3.1.7.....3.3.1.....3.3.7.....3.4.7.....3.4.9.....3.5.3.....3.5.9.....3.6.7.....3.7.3.....3.7.9.....3.8.3.....3.8.9.....3.9.7.....4.0.1.....4.0.9.....4.1.9.....4.2.1.....4.3.1.....4.3.3.....4.3.9.....4.4.3.....4.4.9.....4.5.7.....4.6.1.....4.6.3.....4.6.7.....4.7.9.....4.8.7.....4.9.1.....4.9.9.....5.0.3.....5.0.9.....5.2.1.....5.2.3.....5.4.1.....5.4.7.....5.5.7.....5.6.3.....5.6.9.....5.7.1.....5.7.7.

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample50?(???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):578
                                                      Entropy (8bit):3.3838963948706304
                                                      Encrypted:false
                                                      SSDEEP:12:QRBoz4YNugFw4oWjCgC9OR66uhONTogd3f+aV6EZ9WvuXJKI:QYzV84RjlCTgd2aVhDZJP
                                                      MD5:A5981FA4F56DB429540EED66A69C6605
                                                      SHA1:DB88A3AB0B737CEA3E54E5E70BB00D65C236BC0C
                                                      SHA-256:A0B1B0FCF4FD6983AE1F5BD2D896D3850DB589F72608833512A337ADA5105DD0
                                                      SHA-512:6D5C6A91ED4A121B34F9984B679F57D4B4376D5E645BCAEA0E6791DA4DFC89F12B1CCB48416F77E1EE7FD295B190E43DA48C47E147A5734E02AF0A0AF1322A13
                                                      Malicious:false
                                                      Preview:..0.1. ..0....0.2. ..0....0.3. ..0....0.4. ..0....0.5. ..0....0.6. ..0....0.7. ..0....0.8. ..0....0.9. ..0....1.0. ..0....1.1. ..0....1.2. ..0....1.3. ..0....1.4. ..0....1.5. ..0....1.6. ..0....1.7. ..0....1.8. ..0....1.9. ..0....2.0. ..0....2.1. ..0....2.2. ..0....2.3. ..0....2.4. ..0....2.5. ..0....2.6. ..0....2.7. ..0....2.8. ..0....2.9. ..0....3.0. ..0....3.1. ..0....3.2. ..0....3.3. ..0....3.4. ..0....3.5. ..0....3.6. ..0....3.7. ..0....3.8. ..0....3.9. ..0....4.0. ..0....4.1. ..0....4.2. ..0....4.3. ..0....4.4. ..0....4.5. ..0....4.6. ..0....4.7. ..0....4.8. ..0....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??(16??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):234
                                                      Entropy (8bit):3.5296063706231915
                                                      Encrypted:false
                                                      SSDEEP:6:QS/lWlau43lehlQlfbiPlSj3lSl9MNlohlcla8yr/8uDolQyl:QS/liau43lehlQYPlelWyNlohlcg8w81
                                                      MD5:B10D9290C70CA121F95C4AFEA6133DB7
                                                      SHA1:62E327365A16CBE93C7D73D932B17B6C04AE4488
                                                      SHA-256:DB30EE7FF4F2CEF79DFCAAD7E37522E3ED480E38BD8A5D807A65AA076112B5A5
                                                      SHA-512:1BE3A65F72B2E6E8547ED94ACA997A66C783AC51D47C13F9FD6CA9FC4A6F49C5B534B852B8658B979D148FD507EAF4A91A7FADF7B3418D3569DF0C8CFFB667EF
                                                      Malicious:false
                                                      Preview:..0.1. ..S....0.2. ..S.Sqg....0.3. ..Sqg....0.4. .qg.Sqg....0.5. .qg....0.6. .qgWSqg....0.7. .WSqg....0.8. .WSWSqg....0.9. .WS....1.0. .WSWS......1.1. .WS......1.2. ...WS......1.3. .......1.4. ....S......1.5. ..S......1.6. ..S.S......

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??(32??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):506
                                                      Entropy (8bit):3.732285936218069
                                                      Encrypted:false
                                                      SSDEEP:12:QSCliavlxmP43l0uVlWahlorY6USg9dbrIllABTxBzGQr3ROV0uPfl:QSCldlgal06lWahlBtnS6xbhOVZF
                                                      MD5:DC1B0B663A05C19BE3C2E0041D8737EE
                                                      SHA1:50F08D9B00DBAD0F55592F80721FD15603AD4F80
                                                      SHA-256:FDCE9101C4CEB290E5495589D7A580CB6514644ADF0AEBC115A023953F77CDE9
                                                      SHA-512:2D9D64BBEDD00D6A6761D5CBDE3F5B54D89CBBA457D1ACFD7E464A17B3452264311D0246077FBA329ECABF671164B5E8E88605DB8E93CE92BD100DF2E7C0686A
                                                      Malicious:false
                                                      Preview:..0.1. ..S....0.2. ..S._qg....0.3. ..S.Sqg....0.4. ..Sqg._.S....0.5. ..Sqg....0.6. ..Sqg._qg....0.7. .qg.Sqg....0.8. .qg._.S....0.9. .qg....1.0. .qg._WS....1.1. .qgWSqg....1.2. .WSqg._qg....1.3. .WSqg....1.4. .WSqg._WS....1.5. .WSWSqg....1.6. .WS._qg....1.7. .WS....1.8. .WS._......1.9. .WSWS......2.0. .WS..._WS....2.1. .WS......2.2. .WS..._......2.3. ...WS......2.4. ...._WS....2.5. .......2.6. ...._.S....2.7. ....S......2.8. ..S..._......2.9. ..S......3.0. ..S..._.S....3.1. ..S.S......3.2. ..S._......

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??(8??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):90
                                                      Entropy (8bit):3.424751985026255
                                                      Encrypted:false
                                                      SSDEEP:3:QKogC4vMlFlmLla2UrIlKjlAElyJFlhol9:QKe4cmLlanKLlhol9
                                                      MD5:97001D09352A7787A43D762684B5E82D
                                                      SHA1:552203A671AF7482941317B677874CB373B56E08
                                                      SHA-256:64C1E2F7908702A5857745E9E88D930A174A25E1759FA2BD9FC6E83942E5E533
                                                      SHA-512:1FE69BD471B558E1433DD01B992F60F416F3640F7F7E73D019EB27F0C2F70B6A10886F913B39E2482A9612FE491CDD6E860FEEAF4F87C4515E3B0F0486EF26C2
                                                      Malicious:false
                                                      Preview:..1. ..S....2. ..Sqg....3. .qg....4. .WSqg....5. .WS....6. .WS......7. .......8. ..S......

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):62
                                                      Entropy (8bit):3.364383003446739
                                                      Encrypted:false
                                                      SSDEEP:3:QnNl/BlFlL20lvrFlYil:QnNlDL5rQil
                                                      MD5:3F87A17C61FFA7F1666C91E928849667
                                                      SHA1:4CAE1079F37492FC044F01AFA6A00A9C44895A40
                                                      SHA-256:702476D8262BA5A69DCFD618FCC130CF36E2B012DC302081FFB70A3B84124B2A
                                                      SHA-512:18F840EB502973A247CB36A5FF02ED331F9C49EDBD4F152A3DC4A6A4DD9EDB137F91B96C46FFAF46EEB9E4FF1DFC69B6158FF38C2B9ED6FD2D0F33C0AE00128C
                                                      Malicious:false
                                                      Preview:..1. .qg....2. .......3. .WS....4. ..S....5. .)Y....6. .0W....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):146
                                                      Entropy (8bit):3.0925951062324923
                                                      Encrypted:false
                                                      SSDEEP:3:QOo2vqLwB9lvoTvm1Z0BZlvsTv2zZ4lBlvMvy3MBv:Qo+4vMCZYvIUZaTvuS4
                                                      MD5:E4F37056190348429372F920A439C5DF
                                                      SHA1:878ACB22DD394C24E21F0B2A6EC4FD2C102DA35F
                                                      SHA-256:7F060BC273F3475F979E2973D2F8B73978414C7FE3F0E90EF6B39F46F9AE6593
                                                      SHA-512:377625CCE8F3982C7F23195F86649CB2B1C8732D52B1861F1F80F24F302422D50C8D4A91F00143BD3A05604B1226ED6D25BE6E3E9A7BE9C28512F25FFE1514F7
                                                      Malicious:false
                                                      Preview:...!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!.....!....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample???(???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):122
                                                      Entropy (8bit):3.2002153614215705
                                                      Encrypted:false
                                                      SSDEEP:3:QEWvlVNlfeolvUlPXoNLlFolfClI4vVIlFmlvlllf04vPGlFXZs2:Q99oomlvo2lfH4ilUl9krltZs2
                                                      MD5:B6FD424D94F4E026768779E91079DE25
                                                      SHA1:1B0884202F232FCD084A92A4CBCD2795702D1AC9
                                                      SHA-256:FB376C9991E6EE8F425B34B1401F478DC816E4330A23A7DE7433184BD9E9BEC0
                                                      SHA-512:805A021005B734494A51D2A2866343670119D9D7CC0867026BC8958666BA2FF83001893952ABB35DCFCB8BF38C55BB87FC8CBF306C76F565F3AD24405F814765
                                                      Malicious:false
                                                      Preview:..0.1. ..2....0.2. ..2....0.3. ..2....0.4. ..2....0.5. ..2....0.6. ..2....0.7. ..2....0.8. ..2....0.9. ..2....1.0. ..2....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample???(????).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):122
                                                      Entropy (8bit):3.160588583912251
                                                      Encrypted:false
                                                      SSDEEP:3:QE2vPNlf+olvUlvXoNLlFHolfsrlo4NIlFGlvflfU4vPGllXZM2n:QdWomlPoWlfse4il0lSrlNZM2
                                                      MD5:8A20F1F06907E31F10BFC2303C89A648
                                                      SHA1:D76FA62D233F83CC82B7ACA58B20E24776461C6B
                                                      SHA-256:37D7B744F65D683F78B84A999EF46405A305504A76859E0DDAC6258B63EFADB0
                                                      SHA-512:FBF8C22DAC76FC72773E51E15969EBEEEC8D7B7C0495D825D1861C891952DBDD4E5D0922F2A629514258D29C6F52CCDE39451312C671D8A6107937C68C0F4E82
                                                      Malicious:false
                                                      Preview:..0.1. . 2....0.2. .!2....0.3. ."2....0.4. .#2....0.5. .$2....0.6. .%2....0.7. .&2....0.8. .'2....0.9. .(2....1.0. .)2....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample???(??????).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):284
                                                      Entropy (8bit):3.215492259841853
                                                      Encrypted:false
                                                      SSDEEP:6:QQnQawFQ46mkZ8aEBk4G+0FIaIdo4S2kBU6cZ84+en:QQnzwFrunEB32LIdzOfcZ/p
                                                      MD5:57801EAED6D5AFA8D3F3FCE5AF2DBF22
                                                      SHA1:DEAD257FB1713EE05A2780958D485E5A1B988ED2
                                                      SHA-256:0348B0E06606226BFBF89F99E15A1C08F2BF4395796E3E79515995E617A3C580
                                                      SHA-512:96F0700D63B5B0BC1883B4184D63A89CA26800B29CF8A99FA6779B26D681B920601D96B7C6A666BD776A8A1C86CE9F20F1C671851050EB20FECEDE21C9E8C088
                                                      Malicious:false
                                                      Preview:...2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample???.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):50
                                                      Entropy (8bit):2.963074189428569
                                                      Encrypted:false
                                                      SSDEEP:3:Qevgol9IvoKlvR4vl2Kil:QugvVvRiq
                                                      MD5:4DF1287FE6521F1E848957E35ACC901A
                                                      SHA1:835AB2C68233DD7E738E6911F04038361B1B906E
                                                      SHA-256:C5AACA565E0E2D9AB1AE9EE2BCA8428BF6BDCD156DAD9D59DA1834F4AB2BF09D
                                                      SHA-512:2F378542C10717AAFCAE1E7CAE46BA3CCF304B4DFB9F708194B04F29EDEC0371AF7192DABD17950F24F84553E1DCED0A37E1A9F24BE623DEA003EF53E3B96391
                                                      Malicious:false
                                                      Preview:...&.....&.....&.....&.....'.....'.....&.....&....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):44
                                                      Entropy (8bit):2.9081265670005676
                                                      Encrypted:false
                                                      SSDEEP:3:QMDolvysDol96v+ceWil:QM0lqs0yvU
                                                      MD5:7C03A2D7E145D90EA610B40A7245BCFE
                                                      SHA1:03CE12CA3ABB44C0CEDC9BFCB2F805A8BFE6625B
                                                      SHA-256:BEFD06CC7471780A1748C458B844F1772AC1F5BFCB4B6AFE166129A256E3893E
                                                      SHA-512:48FD2BC71F79EAE741F08A2307F5F9B1449A003BDF3BA820173C0F4E3DD53F7A036C37BD4B93F3513A554CC6C037750F4CFEA1DC83F5EA6C6FF5543C73581967
                                                      Malicious:false
                                                      Preview:..i&....j&....k&....l&....m&....n&....o&....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample?????(1??/???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):74
                                                      Entropy (8bit):2.9784026893685516
                                                      Encrypted:false
                                                      SSDEEP:3:QVBl9UB5lvMTvlriyFBlvsvlhS:QvYvo9iwTvO/S
                                                      MD5:CD9B512D9CE5F2CC065FA4A78F64210F
                                                      SHA1:9C294709906CD465CDC6B71FF029F9588BDB199B
                                                      SHA-256:54CFF2FD9A0218D2049C27A5423C66B4B5C549AFD6642250E8BEC4E7E4E0EADC
                                                      SHA-512:F2075EFC9C93CDEC660FBF7E7C0184398892BEC2484CAF033BF315BE5485BFED97FC17AAE25A6A79D55FE368A69F7F7B0A70BCACA040E2E8A86736728A3A815B
                                                      Malicious:false
                                                      Preview:..p!....q!....r!....s!....t!....u!....v!....w!....x!....y!....z!....{!....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample?????(??).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):458
                                                      Entropy (8bit):3.5763943827264235
                                                      Encrypted:false
                                                      SSDEEP:12:QOao6TO8ZVJ7KONsOJQPKgywSo15GrYDzSB:QOF6SAVJ7KONv2PcwS0GrYDze
                                                      MD5:705388071F1A5B1CBFCFCBDDB129BD04
                                                      SHA1:D91BEE9481C668850675BE472845FA2BE7105AC0
                                                      SHA-256:8D9057FFCF03BDFA807B4461771B51ECA0D35F207E731FDB0E6BBF9F7B20ECEE
                                                      SHA-512:1F34703E37974728E4A61208EE3CD31B3D6C281AB506AD383D27ED27F765C43A27841965D289E9F7BE5BFC75485ECC9BB00B408A0129AA513731B8C3D164E3C8
                                                      Malicious:false
                                                      Preview:..1.0.^.-.1._..R....1.0.^.-.2._..S....1.0.^.-.3._..k....1.0.^.-.4._..|....1.0.^.-.5._..`....1.0.^.-.6._.._....1.0.^.-.7._.J~....1.0.^.-.8._..l....1.0.^.-.9._.uX....1.0.^.-.1.0._..W....1.0.^.-.1.1._..}....1.0.^.-.1.2._. o....1.0.^.-.1.3._.!j.|....1.0.^.-.1.4._.!..]....1.0.^.-.1.5._.........1.0.^.-.1.6._..wo`....1.0.^.-.1.7._.>_.c....1.0.^.-.1.8._.9R......1.0.^.-.1.9._.mQ._....1.0.^.-.2.0._.Z.....1.0.^.-.2.1._.zz....1.0.^.-.2.2._..n....1.0.^.-.2.3._.Dm....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample?????(???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):564
                                                      Entropy (8bit):2.2237343657281023
                                                      Encrypted:false
                                                      SSDEEP:6:QMggqosXl+lzlSlblPayaWfWYlJT2sDeQHCql9:QJXkZYBlDeYDT2sDeQHCqv
                                                      MD5:A8C1DC1910A4F91D4AD5AC58B697B811
                                                      SHA1:37CF49845863E587B9C9205F2726C2BCAC7FEBE3
                                                      SHA-256:FB717338F1F890DA4607DD5679D46E168A6618EAF01E85D029397645D0B2EEC0
                                                      SHA-512:CAB66289E45F4068D7E11BC0D08DE70BBDFB1F55AC97FCB983820CA5ADCBAD50AB27814D19F887A1DDB9F05744E2A26D007D48065BDA7896A9878328D1487C42
                                                      Malicious:false
                                                      Preview:..i.....i.i.....i.i.i.....i.v.....v.....v.i.....v.i.i.....v.i.i.i.....i.x.....x.....x.i.....x.i.i.....x.i.i.i.....x.i.v.....x.v.....x.v.i.....x.v.i.i.....x.v.i.i.i.....x.i.x.....x.x.....x.x.i.....x.x.i.i.....x.x.i.i.i.....x.x.i.v.....x.x.v.....x.x.v.i.....x.x.v.i.i.....x.x.v.i.i.i.....x.x.i.x.....x.x.x.....x.x.x.i.....x.x.x.i.i.....x.x.x.i.i.i.....x.x.x.i.v.....x.x.x.v.....x.x.x.v.i.....x.x.x.v.i.i.....x.x.x.v.i.i.i.....x.x.x.i.x.....x.l.....x.l.i.....x.l.i.i.....x.l.i.i.i.....x.l.i.v.....x.l.v.....x.l.v.i.....x.l.v.i.i.....x.l.v.i.i.i.....x.l.i.x.....l.....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample?????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):190
                                                      Entropy (8bit):4.392172617286914
                                                      Encrypted:false
                                                      SSDEEP:3:QSd4wMKdeXzvQII7n7PvJWJG2ovSIzj3KcsV1jvVocIRVS4cIRVskIilEIRV1ocF:QS/MHXz/I7n7PvJYe7zj3xsV16cIRVWq
                                                      MD5:208CBBA9F06C80A0A67E6040CF9ECE4F
                                                      SHA1:BD5FCFA2BBDBC1AA075B6BC01E1080FD48BDE36A
                                                      SHA-256:5D78C6D350D0C5A5300F8A7563772DFC47C6A5F9E7204E944929AFC74365FAFE
                                                      SHA-512:0151F87B9C1B318A4B079B182225B2F0209FE45D6869AE3E109C3FAB8045B74255B48D19C3635011CD42A29B6EB4D150D8841B768FEC664355645B55329BF9A7
                                                      Malicious:false
                                                      Preview:..wm\.9.....wm\..x....wm\.2..l$X....wm\..x\m....wm\..l.S....wm\.wm.N.0.X.....m4l\..].0.....m4l\..0.0.0.0n0tz.0.....m4l\..nAm.....m4l\..].....m4l\.Vn.....m4l\.`l.....m4l\..{.t.04X....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??????(???).txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):146
                                                      Entropy (8bit):3.0925951062324923
                                                      Encrypted:false
                                                      SSDEEP:3:Q/ofklvw2lvnc/flvEHZ8lvdUlvkOlvrgDflv4Htolvl:Q/6svRn4NvWWd8vlroNvOil
                                                      MD5:0E330F7A57ADE6F43218E11984C4A4F3
                                                      SHA1:D9A39A7E549A09BF9737BA39348C175F8CB45091
                                                      SHA-256:58AEA707A94C3046BE1073271633480E1318248B3A33BB19594E6818EBFA8012
                                                      SHA-512:1CECCBA95118C20DFDAA2A5BC074DB0227FF45E78B228372A1E053B5DBA2FC85D52BDA00310E770C72DA902A235A3A36899B8B9D7ED67B24B845E4FB5ED6F706
                                                      Malicious:false
                                                      Preview:..................................................................................................................................................

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample??????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):90412
                                                      Entropy (8bit):4.382677740174461
                                                      Encrypted:false
                                                      SSDEEP:1536:r2EzR/me6m0IAbMY6i1xI+0iCtR/S0GIS2nYbONBxGny6fWrI5dBAQSBvR+UymUZ:rhYg0IAyi1xEfVSEFNBxGny6fWc5dBAe
                                                      MD5:6AACC034A12E4D72FCBDB47CCA3F761B
                                                      SHA1:2AF236FEC8FCE029D88351B86390ED1998B1AC6F
                                                      SHA-256:075BD56615EC857D7564982EEA3254B47214E35DA5D5B819BD783DFD4E7D7230
                                                      SHA-512:7AF504BB01522107864B9A002B2E436DF316C469D974083946C0E577C7C466CA6FB3386819D2C11DDEA863D6292D0B8B3557D63E6DC2AC24BBE65A58341B78AF
                                                      Malicious:false
                                                      Preview:.././.2.0.1.6.t^5..g..n0.`1X.0.0h0k0W0f0D0~0Y0.0...././.yrk0._JSo0.0.T.N.N/^peL0&N.0g0D0.0n0g0..juo0.S.[j0$Pg0o0B0.0~0[0.0.0...././.PO.U0.0g0.0.0.0.0/..0.0.0j0i0...0L0puj0.0.0n0.0hQf0.T.N.0.0.0.0k0W0f0D0~0Y0.0....0.0.0.1._.PO.....0.0.0.2._.4.(g....0.0.0.3._..Kj....0.0.0.4._.0u-N....0.0.0.5._.!n......0.0.0.6._..O.....0.0.0.7._.q\,g....0.0.0.8._.-NQg....0.0.0.9._..\.g....0.0.1.0._..R.....0.0.1.1._..T0u....0.0.1.2._.q\0u....0.0.1.3._.PO.0(g....0.0.1.4._.q\.S....0.0.1.5._.~g,g....0.0.1.6._..N.N....0.0.1.7._..e.....0.0.1.8._.(gQg....0.0.1.9._..g....0.0.2.0._..n4l....0.0.2.1._.q\.]....0.0.2.2._.`l0u....0.0.2.3._.?......0.0.2.4._..h....0.0.2.5._.Kj,g....0.0.2.6._.q\.N....0.0.2.7._..w.]....0.0.2.8._.-N.\....0.0.2.9._.MR0u....0.0.3.0._..0u....0.0.3.1._..\.]....0.0.3.2._..\0u....0.0.3.3._.._.....0.0.3.4._.w.7..]....0.0.3.5._.Qg.N....0.0.3.6._.......0.0.3.7._..w.N....0.0.3.8._.BW,g....0.0.3.9._.`......0.0.4.0._.R.(g....0.0.4.1._..N....0.0.4.2._...Qg....0.0.4.3._..y0u....0.0.4.4._.*Y

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample???????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):342
                                                      Entropy (8bit):4.926911788109244
                                                      Encrypted:false
                                                      SSDEEP:6:QUo4Meo7WD4MK6FpAHG5oa55Ovl5549l55+t555NoAqRPSlSXolUol4LH4RHG:QUo7ecWvKQAm5o85g5Gb5w57QRPWSXrn
                                                      MD5:797543A7F03A9D2464EB2D3DECB6220E
                                                      SHA1:4907EF95ED2A5691244C9516B8D7AF563F90FDE2
                                                      SHA-256:AC53A1EE4310443B05346EF99E7C26FA9D3457D4F45505E453351ABD686363B3
                                                      SHA-512:87BC28BD305FA8C8DC6C80ABEC757EB103ABAEEC36F05DD0A17F35B9BC43187774BE6ED4BCC8985EF603E2BC96BF048B28ABB42952872E0674CDDBFAA2C8CD0F
                                                      Malicious:false
                                                      Preview:...eL.\..Nir.....eL.\.ofr......eL.\..^ir..WN.0ir.....eL.\..Y.0c0_0.0n0.....eL.\.]0n0.N.....e8^\..0.0.0.0.0.0.0.0.....e8^\..0n0.....e8^\.r0h0.....e8^\.D0H0.....e8^\..0.0.....N.N\..Nir.....N.N\.4X@b.....N.N\..P._2......N.N\.<..b.....N.N\..\.0.0....0W.W\.T0.@bU0.0....0W.W\...n0.V.0\Omi....0W.W\.t^-NL..N....0W.W\.f[!h..J0.^....0W.W\.]0n0.N....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample????????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):316
                                                      Entropy (8bit):4.4234740826279575
                                                      Encrypted:false
                                                      SSDEEP:6:Q1m/8FXZl6g4/uu6/66cYSE4mYlNl1LM/8otSAeKelYG:Q1m0FpF4mu666cNEmlL+4aeWG
                                                      MD5:8C553CC351803558CEAB1AFC7265209D
                                                      SHA1:607E312E825D28B75D477EC38FB56BD5A3A0571B
                                                      SHA-256:7DE85B67C463753D648F0FCCAE99B972DF799ABA6F576882B7C3BEAE47490A50
                                                      SHA-512:66866A337C78CBABAE2937AAE228F90826977E4D10F944C0B07B1354CAE3A0CC3FB89C1F09F0152A52B721C75785457A691C9262FD0009F2847E5E58839E56D7
                                                      Malicious:false
                                                      Preview:.././..g.k0J0.lk0eQ.0....0.1._.B.e.s.t....././..g.h0o0..H0j0D0.0n0n0.0M0c0h0~0_0Q..Y0.0.0.0.0....0.2._.B.e.t.t.e.r....././.JRd.Y0.0k0o0.0c0_0D0j0D0.0~0_0._.eQ..Y0.0K0.0h0D0F0.0.0.0....0.3._.G.o.o.d....././..0F0..j0D0K0.0W0.0j0D0h0D0F0.0.0.0....0.4._.B.a.d....././.4x.h.0.i..Y0.0.0.0.0....0.5._.W.o.r.s.t.........

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sample?QC????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):154
                                                      Entropy (8bit):4.540390883059104
                                                      Encrypted:false
                                                      SSDEEP:3:Q+L292WzwJo1MflG2rLV+zVH7ml9QgK2i51JflRMK28eZSwn7un:QiY15ON72mIgK2i5UK23LS
                                                      MD5:A0459E75AD43C8760CF84D922AB46DF5
                                                      SHA1:F6B16299D2D9511129A135EC2017FD814FE40B72
                                                      SHA-256:9723123788DC9F32988CDCAEA7B3E8797A6A5A3C02979609ED8D6BFC73A0BC5E
                                                      SHA-512:97C2DF1944FC26DFE54F93D9ABB4F0F2C4BFA14C7A5BBB262E443BF62FB773E609A568A68B40DF74A3C44BBFB40AF856882CF56ECD8EC4907EE881F00AAFD379
                                                      Malicious:false
                                                      Preview:..1. .#....V.l .....2. ....T.V.l....3. ..|q}.V.l....4. ..0.0.0.0.0.0.0.0.0.l....5. ..0.0.0.0.0.0.V.l....6. ..0.0.0.0.0.0.0.0.0.g.l....7. .P.D.P.C..l....

                                                      \Device\HarddiskVolume3\Users\user\Desktop\Asr\Lang\.ja-JP\MkDir\sampleQC????.txt

                                                      Download File
                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):122
                                                      Entropy (8bit):4.370380935471333
                                                      Encrypted:false
                                                      SSDEEP:3:QXwYlXdC1MlT4oszVixbZCGrl1dRpWM9n:QXwF6MoscQo9D9
                                                      MD5:6E436D8690E75B94AD06BA9CB459DDE7
                                                      SHA1:85E865A092A983729EA2D5A299F07315CFA0997F
                                                      SHA-256:E820DB48A5198B6CB9E32E00E75EB204E10F6E21F6928E005F339BFB8CDA07EB
                                                      SHA-512:C042AADEE48CE4F2B11A4964F47153A074A04FB1401F5449DA4ADEE100AD75755BBCE471D078D128253026C6B91EF75402F276347A4C8D51D0B0033E7F37FB97
                                                      Malicious:false
                                                      Preview:..1. ..0.0.0....2. ..0.0.0.0.0.0....3. ..{.t.V....4. ..0.0.0.0.0.0.0....5. ..0.0.0.0.V....6. .yr'`...V.V....7. .ce.^.V....

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (console) Intel 80386, for MS Windows
                                                      Entropy (8bit):7.98882791873611
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      File size:3'794'785 bytes
                                                      MD5:12cba957e6008442696a276d44fd60f5
                                                      SHA1:7038d228bb77cd86871202249839e0e8baaaacc6
                                                      SHA256:64a40e5ff36383163b44a06e4672084952bd82ef5e10069c9f4c6557cdf57572
                                                      SHA512:a036bb0606ef8c02b919689774e279335b76dac71ead991dfa77e284cb2c6ca73924fc6cfe79492a60c5a16fab4d36e3f1f4598fd713bc06189fcea8d3e56a27
                                                      SSDEEP:98304:slDhaR53hH+v02hDT0OVErjaCdakSZAvSGE:slgRHn6DT0uE37ZEA6GE
                                                      TLSH:480633716EE9C4B7C1471670C8C81FF7B5EA83190F1415C62784AB3EABB1AE5E128739
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../.../.../...0.../..x3.../...0.../...0.../..u'.../.../.../..x'.../......./......./......./....0../..<).../..Rich./.........

                                                      File Icon

                                                      Icon Hash:b8868baba9aba2d8

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x424bc6
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x400000
                                                      Subsystem:windows cui
                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                      DLL Characteristics:NX_COMPAT
                                                      Time Stamp:0x5C6ECB00 [Thu Feb 21 16:00:00 2019 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:4
                                                      OS Version Minor:0
                                                      File Version Major:4
                                                      File Version Minor:0
                                                      Subsystem Version Major:4
                                                      Subsystem Version Minor:0
                                                      Import Hash:48bcb8c8f418f3828fc939bb498f0b51

                                                      Entrypoint Preview

                                                      Instruction
                                                      push ebp
                                                      mov ebp, esp
                                                      push FFFFFFFFh
                                                      push 0042A780h
                                                      push 00424BC0h
                                                      mov eax, dword ptr fs:[00000000h]
                                                      push eax
                                                      mov dword ptr fs:[00000000h], esp
                                                      sub esp, 20h
                                                      push ebx
                                                      push esi
                                                      push edi
                                                      mov dword ptr [ebp-18h], esp
                                                      and dword ptr [ebp-04h], 00000000h
                                                      push 00000001h
                                                      call dword ptr [004280ECh]
                                                      pop ecx
                                                      or dword ptr [00433634h], FFFFFFFFh
                                                      or dword ptr [00433638h], FFFFFFFFh
                                                      call dword ptr [004280F0h]
                                                      mov ecx, dword ptr [004315FCh]
                                                      mov dword ptr [eax], ecx
                                                      call dword ptr [004280F4h]
                                                      mov ecx, dword ptr [004315F8h]
                                                      mov dword ptr [eax], ecx
                                                      mov eax, dword ptr [004280F8h]
                                                      mov eax, dword ptr [eax]
                                                      mov dword ptr [00433630h], eax
                                                      call 00007FE93CB04AEAh
                                                      cmp dword ptr [0042F220h], 00000000h
                                                      jne 00007FE93CB04A1Eh
                                                      push 00424D06h
                                                      call dword ptr [004280FCh]
                                                      pop ecx
                                                      call 00007FE93CB04ABBh
                                                      push 0042F05Ch
                                                      push 0042F058h
                                                      call 00007FE93CB04AA6h
                                                      mov eax, dword ptr [004315F4h]
                                                      mov dword ptr [ebp-28h], eax
                                                      lea eax, dword ptr [ebp-28h]
                                                      push eax
                                                      push dword ptr [004315F0h]
                                                      lea eax, dword ptr [ebp-20h]
                                                      push eax
                                                      lea eax, dword ptr [ebp-2Ch]
                                                      push eax
                                                      lea eax, dword ptr [ebp-1Ch]
                                                      push eax
                                                      call dword ptr [00428104h]
                                                      push 0042F054h
                                                      push 0042F000h
                                                      call 00007FE93CB04A73h

                                                      Rich Headers

                                                      Programming Language:
                                                      • [C++] VS98 (6.0) SP6 build 8804
                                                      • [ C ] VS98 (6.0) SP6 build 8804
                                                      • [ C ] VS2010 SP1 build 40219
                                                      • [ASM] VS2010 SP1 build 40219
                                                      • [EXP] VC++ 6.0 SP5 build 8804

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x2da6c0x64.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x350000x818.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x280000x1a0.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x260350x26200b339cea717ebd142b551e6866a41b0f6False0.5814805327868853data6.676049121913505IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x280000x62b60x64008be3c8f5c1dabdeca75afe03c37ae72cFalse0.3590234375data4.67295411075301IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0x2f0000x463c0x400eb56f8d60fc5d4ce8febe6465417e3d0False0.30078125data3.034060091049995IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .sxdata0x340000x40x20035925cfdc1176bd9ffc634a58b40ec17False0.02734375data0.020393135236084953IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .rsrc0x350000x8180xa0044cff95140fa308b9aa82bd13650b9b1False0.246875data2.2433260247204205IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_ICON0x353e00x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.16532258064516128
                                                      RT_ICON0x356c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishUnited States0.32094594594594594
                                                      RT_GROUP_ICON0x357f00x22dataEnglishUnited States1.0
                                                      RT_VERSION0x351200x2c0dataEnglishUnited States0.49573863636363635

                                                      Imports

                                                      DLLImport
                                                      OLEAUT32.dllSysAllocStringLen, SysAllocString, SysFreeString, SysStringLen, VariantClear
                                                      USER32.dllCharUpperW
                                                      MSVCRT.dll_controlfp, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, __p___initenv, exit, _XcptFilter, _exit, _onexit, __dllonexit, ?terminate@@YAXXZ, ??1type_info@@UAE@XZ, _except_handler3, _beginthreadex, memset, strlen, fputc, fflush, fgetc, fclose, _iob, free, malloc, wcscmp, wcsstr, strcmp, memcpy, memmove, _purecall, memcmp, __CxxFrameHandler, _CxxThrowException, fputs
                                                      KERNEL32.dllFormatMessageW, InitializeCriticalSection, ResetEvent, SetEvent, CreateEventW, WaitForSingleObject, lstrlenW, lstrcatW, VirtualFree, VirtualAlloc, SetConsoleMode, GetConsoleMode, GetVersionExW, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetConsoleCtrlHandler, WaitForMultipleObjects, GetFileInformationByHandle, GetStdHandle, GlobalMemoryStatus, GetSystemInfo, GetCurrentProcess, GetProcessAffinityMask, FileTimeToLocalFileTime, FileTimeToSystemTime, SetEndOfFile, WriteFile, ReadFile, SetFilePointer, GetFileSize, GetFileAttributesW, GetModuleHandleA, FindFirstFileW, FindClose, GetTickCount, GetCurrentDirectoryW, SetLastError, DeleteFileW, CreateDirectoryW, GetModuleHandleW, GetCommandLineW, SetFileApisToOEM, GetLastError, MultiByteToWideChar, WideCharToMultiByte, LoadLibraryExW, GetModuleFileNameW, LocalFree, GetSystemDirectoryW, CloseHandle, SetFileTime, CreateFileW, SetFileAttributesW, RemoveDirectoryW, MoveFileW, GetProcAddress

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishUnited States

                                                      Network Behavior

                                                      ⊘No network behavior found

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:05:20:57
                                                      Start date:29/03/2024
                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.PUA.Bundler.iStartSurf.29803.17991.exe"
                                                      Imagebase:0x400000
                                                      File size:3'794'785 bytes
                                                      MD5 hash:12CBA957E6008442696A276D44FD60F5
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:1
                                                      Start time:05:20:57
                                                      Start date:29/03/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Executed Functions

                                                        Function 00413723 Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 922COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00413728
                                                          • Part of subcall function 00416AE7: _CxxThrowException.MSVCRT(?,0042AD80), ref: 00416B30
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionH_prologThrow
                                                        • String ID:
                                                        • API String ID: 461045715-3916222277
                                                        • Opcode ID: ec43b14fb32f1a9813f6c75427493efd4a23d317101debb04430102f6e4ce041
                                                        • Instruction ID: e267a16ea96b5983e2dac8a64fdb5db2144f82c028db871638ff9e57debdad40
                                                        • Opcode Fuzzy Hash: ec43b14fb32f1a9813f6c75427493efd4a23d317101debb04430102f6e4ce041
                                                        • Instruction Fuzzy Hash: 9B82AF70900259DFDB14DFA8C884BEEBBB1BF48315F14809EE815AB391DB389E85CB54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040D6E0 Relevance: 6.6, APIs: 4, Instructions: 648COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1423 40d6e0-40d743 call 424810 1426 40d745-40d74c 1423->1426 1427 40d74e-40d754 1423->1427 1428 40d757-40d75c 1426->1428 1427->1428 1429 40d762-40d78c call 40566f call 4030bc 1428->1429 1430 40d7f6-40d7fc 1428->1430 1447 40d7b9-40d7f0 call 409b6e call 4037ca 1429->1447 1448 40d78e-40d79e call 4056a1 1429->1448 1431 40d813-40d81a 1430->1431 1432 40d7fe-40d804 1430->1432 1437 40d832-40d846 call 4037a3 1431->1437 1438 40d81c-40d830 1431->1438 1434 40d806 1432->1434 1435 40d809-40d810 call 4037a3 1432->1435 1434->1435 1435->1431 1445 40d848-40d851 call 40ad45 1437->1445 1446 40d87d 1437->1446 1438->1437 1452 40d87f-40d88d 1445->1452 1446->1452 1447->1429 1447->1430 1453 40d7a3-40d7a5 1448->1453 1456 40d895-40d8fa 1452->1456 1457 40d88f-40d891 1452->1457 1458 40d853-40d863 _CxxThrowException 1453->1458 1459 40d7ab-40d7b3 1453->1459 1461 40d928-40d93a 1456->1461 1462 40d8fc-40d910 1456->1462 1457->1456 1463 40d868-40d878 _CxxThrowException 1458->1463 1459->1447 1459->1463 1464 40d940-40d947 1461->1464 1465 40dcf4-40dcf8 1461->1465 1462->1461 1472 40d912-40d918 1462->1472 1463->1446 1467 40dce4-40dcee 1464->1467 1468 40d94d-40d979 call 40566f call 4030bc 1464->1468 1469 40dd04-40dd18 1465->1469 1470 40dcfa-40dcfe 1465->1470 1467->1464 1467->1465 1493 40d97b-40d98a 1468->1493 1494 40d98c-40d997 call 4056a1 1468->1494 1484 40dec4-40ded6 1469->1484 1485 40dd1e-40dd24 1469->1485 1470->1469 1474 40df02-40df7f 1470->1474 1475 40d920-40d923 1472->1475 1476 40d91a-40d91c 1472->1476 1477 40df81-40df83 1474->1477 1478 40df87-40df9a call 4037ca * 2 1474->1478 1481 40dee9-40defd call 4037ca * 2 1475->1481 1476->1475 1477->1478 1502 40df9b-40dfa9 1478->1502 1481->1502 1484->1474 1497 40ded8-40dede 1484->1497 1489 40dd26-40dd28 1485->1489 1490 40dd2c-40dd2f 1485->1490 1489->1490 1490->1481 1498 40d9b2-40d9c6 1493->1498 1505 40d99c-40d99e 1494->1505 1503 40dee0-40dee2 1497->1503 1504 40dee6 1497->1504 1638 40d9c7 call 403990 1498->1638 1639 40d9c7 call 411ace 1498->1639 1503->1504 1504->1481 1507 40d9a4-40d9ac 1505->1507 1508 40deaf-40debf _CxxThrowException 1505->1508 1506 40d9ca-40d9cf 1509 40dd34-40dd43 call 4037ca 1506->1509 1510 40d9d5-40da5a call 40e040 call 40e64b call 40dfac call 40325f call 410a2a 1506->1510 1507->1498 1507->1508 1508->1484 1515 40dd45-40dd47 1509->1515 1516 40dd4b-40dd4e 1509->1516 1525 40da6b-40da72 1510->1525 1526 40da5c-40da62 1510->1526 1515->1516 1516->1481 1527 40dd53-40dd89 call 4037ca call 401f09 call 40e0ec call 4037ca 1525->1527 1528 40da78-40da8d 1525->1528 1526->1528 1529 40da64 1526->1529 1568 40dd91-40dd96 1527->1568 1569 40dd8b-40dd8d 1527->1569 1636 40da90 call 403990 1528->1636 1637 40da90 call 411da3 1528->1637 1529->1525 1531 40da93-40da98 1533 40dd9b-40ddd1 call 4037ca call 401f09 call 40e0ec call 4037ca 1531->1533 1534 40da9e-40daa1 1531->1534 1598 40ddd3-40ddd5 1533->1598 1599 40ddd9-40dddc 1533->1599 1537 40db12-40db19 1534->1537 1538 40daa3-40daae 1534->1538 1540 40dbc5-40dbdc 1537->1540 1541 40db1f-40db25 1537->1541 1543 40dcb0-40dcd2 call 4037ca call 401f09 call 40e0ec 1538->1543 1544 40dab4-40dae0 call 40566f call 4030bc call 4056a1 1538->1544 1548 40dbe9 1540->1548 1549 40dbde-40dbe2 1540->1549 1541->1540 1547 40db2b-40db40 1541->1547 1587 40dcd7-40dce3 call 4037ca 1543->1587 1600 40db01-40db0d call 4037ca 1544->1600 1601 40dae2-40daed 1544->1601 1554 40db42-40db58 call 40d697 1547->1554 1555 40db8d-40db91 1547->1555 1557 40dbeb-40dc3b call 40e142 1548->1557 1549->1548 1556 40dbe4-40dbe7 1549->1556 1578 40db79-40db85 1554->1578 1579 40db5a-40db5d 1554->1579 1555->1540 1567 40db93-40db9b 1555->1567 1556->1557 1572 40dc40-40dc45 1557->1572 1575 40dba7-40dbbf 1567->1575 1576 40db9d 1567->1576 1568->1481 1569->1568 1580 40de27-40de5d call 4037ca call 401f09 call 40e0ec call 4037ca 1572->1580 1581 40dc4b-40dc52 1572->1581 1575->1540 1595 40dde1-40de17 call 4037ca call 401f09 call 40e0ec call 4037ca 1575->1595 1584 40dba3-40dba5 1576->1584 1585 40db9f-40dba1 1576->1585 1578->1554 1589 40db87-40db8a 1578->1589 1579->1578 1588 40db5f-40db76 1579->1588 1625 40de65-40de68 1580->1625 1626 40de5f-40de61 1580->1626 1590 40dc74-40dc77 1581->1590 1591 40dc54-40dc72 1581->1591 1584->1575 1585->1575 1585->1584 1587->1467 1588->1578 1589->1555 1597 40dc7a-40dcaa 1590->1597 1591->1597 1632 40de19-40de1b 1595->1632 1633 40de1f-40de22 1595->1633 1597->1543 1607 40de6a-40dea0 call 4037ca call 401f09 call 40e0ec call 4037ca 1597->1607 1598->1599 1599->1481 1600->1543 1601->1600 1606 40daef-40dafe 1601->1606 1606->1600 1634 40dea2-40dea4 1607->1634 1635 40dea8-40dead 1607->1635 1625->1481 1626->1625 1632->1633 1633->1481 1634->1635 1635->1481 1636->1531 1637->1531 1638->1506 1639->1506
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040D6E5
                                                        • _CxxThrowException.MSVCRT(?,0042A898), ref: 0040D863
                                                        • _CxxThrowException.MSVCRT(?,0042A898), ref: 0040DEBF
                                                        • _CxxThrowException.MSVCRT(00428F10,0042A898), ref: 0040D878
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                          • Part of subcall function 0040E0EC: __EH_prolog.LIBCMT ref: 0040E0F1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrow$H_prolog$free
                                                        • String ID:
                                                        • API String ID: 1223536468-0
                                                        • Opcode ID: 3c5fc911acf73a21484f41f7b9617dbc7ebdbf7f19951bc6f1b7ec145d6ac4d2
                                                        • Instruction ID: 27547a212bcd5e2fea21ca34142f8c5f016c2783210579c73da83f5cea769d69
                                                        • Opcode Fuzzy Hash: 3c5fc911acf73a21484f41f7b9617dbc7ebdbf7f19951bc6f1b7ec145d6ac4d2
                                                        • Instruction Fuzzy Hash: BC522870D00258CFCB15DFA9C985ADDBBF5AF58304F1440AAE849B7292C7789E84CF99
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00417BF6 Relevance: 3.5, APIs: 2, Instructions: 484COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00417BFB
                                                          • Part of subcall function 004163AB: _CxxThrowException.MSVCRT(?,0042D470), ref: 004163BE
                                                          • Part of subcall function 00416417: memcpy.MSVCRT ref: 0041643D
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00418066
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrow$H_prologmemcpy
                                                        • String ID:
                                                        • API String ID: 3273695820-0
                                                        • Opcode ID: 6a113a96758072f61e64e2f77dec8456ff1bce88e13ee9cf1edac242776f405a
                                                        • Instruction ID: 4bfb1a84d49870a868b7d23f04fde8ca2ccd5915b90cc7b13d6cf33c8fb0a63d
                                                        • Opcode Fuzzy Hash: 6a113a96758072f61e64e2f77dec8456ff1bce88e13ee9cf1edac242776f405a
                                                        • Instruction Fuzzy Hash: E0227F70904249DFCF14DFA5C980BEEBBB5BF04304F14806EE41AA7252DB78AA95CF95
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040546D Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0040544D: FindClose.KERNELBASE(00000000,000000FF,0040547E), ref: 00405458
                                                        • FindFirstFileW.KERNELBASE(?,?), ref: 0040548C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirst
                                                        • String ID:
                                                        • API String ID: 2295610775-0
                                                        • Opcode ID: 820ba026bae873dbfdf14b46c24275c8a1dda097cead2465ee6d1537b4fb92a3
                                                        • Instruction ID: 29c221b88e2f7e22f806aaa311252bd5ac39d7fd159cbc175be0ad32eccdc4e8
                                                        • Opcode Fuzzy Hash: 820ba026bae873dbfdf14b46c24275c8a1dda097cead2465ee6d1537b4fb92a3
                                                        • Instruction Fuzzy Hash: 05E0D83040090857CF20EF24DC856EB336DEF5131AF00417AA861B72D0E63C9DCA8F98
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040110F Relevance: 39.0, APIs: 16, Strings: 6, Instructions: 546COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 40110f-4011aa call 424810 call 41d600 SetFileApisToOEM fputs call 4147b9 GetCommandLineW call 4030ff call 40225e call 4037ca call 4030bc * 2 call 405017 call 4053fe 21 4011d1-4011e1 call 4037ca 0->21 22 4011ac-4011cc fputs call 4037ca * 2 0->22 28 4011e3-4011e7 call 401e4e 21->28 29 4011ec-401213 call 40231a call 40258c 21->29 34 401850-40185c call 401e19 22->34 28->29 39 401293-4012a2 29->39 40 401215-401281 fputs call 403990 fputs call 403990 call 4039a3 call 403990 call 402362 call 4037ca call 401e19 29->40 41 40185e-40185f 34->41 42 401876-40189f call 40105d call 402362 call 4037ca call 401e19 39->42 43 4012a8-4012ab 39->43 40->41 45 4018a1-4018af 41->45 42->45 43->42 46 4012b1-4012b9 43->46 49 4012c4-4012d8 call 401000 46->49 50 4012bb-4012c2 46->50 62 401312-401314 49->62 63 4012da-40130d fputs call 403990 call 4039a3 call 403990 49->63 53 401315-401343 call 401053 call 4147b9 * 2 50->53 81 401345-401379 call 403142 call 401072 call 4037ca 53->81 82 40137a 53->82 62->53 90 401723-401749 call 402362 call 4037ca call 401e19 63->90 81->82 85 4013a1-4013c5 call 4030bc 82->85 86 40137c-401388 82->86 104 4013c7-4013d8 call 40325f 85->104 105 4013dd-4013e0 call 405a57 85->105 92 40138a-40139f call 401072 86->92 93 4013ff-401415 _CxxThrowException 86->93 90->45 92->85 92->86 101 40141a-40142f call 4030bc 93->101 113 401431-401441 call 40325f call 405dfd 101->113 114 401446-40149c call 404749 call 401dd2 * 2 call 4037a3 101->114 104->105 116 4013e5-4013e7 105->116 113->114 132 4014ac-4014af 114->132 133 40149e-4014aa call 4018b0 114->133 116->101 121 4013e9-4013fa _CxxThrowException 116->121 121->93 134 4014b1-4014bd 132->134 133->134 137 4014c5-4014d2 call 40d38f 134->137 138 4014bf-4014c1 134->138 141 4014d4-4014e0 _CxxThrowException 137->141 142 4014e5-4014e9 137->142 138->137 141->142 143 401861-401871 _CxxThrowException 142->143 144 4014ef-401503 call 4037a3 142->144 143->42 147 401510 144->147 148 401505-40150e call 4019b3 144->148 149 401512-40151e 147->149 148->149 151 401520-401522 149->151 152 401526-401600 call 401c87 call 40325f call 40191f call 40325f call 4030bc call 40d6e0 149->152 151->152 165 401605-401627 call 401f09 call 4037ca 152->165 170 401629-401652 call 403990 fputs call 4039a3 165->170 171 40165b-40166b 165->171 170->171 194 401654 170->194 173 401671-401680 171->173 174 40174e-401750 171->174 173->174 176 401686-40168b 173->176 177 401752-401770 call 403990 fputs call 403990 174->177 178 401775-401781 174->178 182 4016a4-4016bf call 4037ca * 2 176->182 183 40168d-40169f _CxxThrowException 176->183 177->178 179 401783-4017b4 call 403990 fputs call 403bd3 call 403990 178->179 180 4017b9-4017d4 call 4037ca * 2 178->180 179->180 204 4017d6-4017d8 180->204 205 4017dc-4017e5 180->205 201 4016c1-4016c3 182->201 202 4016c7-4016d0 182->202 183->182 194->171 201->202 208 4016d2-4016d4 202->208 209 4016d8-40171e call 401e19 * 2 call 4037ca * 2 call 401e19 call 401e7d 202->209 204->205 206 4017e7-4017e9 205->206 207 4017ed-40184f call 401e19 * 2 call 4037ca * 2 call 401e19 call 401e7d call 402362 call 4037ca 205->207 206->207 207->34 208->209 209->90
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00401114
                                                          • Part of subcall function 0041D600: GetVersionExW.KERNEL32 ref: 0041D615
                                                          • Part of subcall function 0041D600: GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0041D638
                                                          • Part of subcall function 0041D600: GetProcAddress.KERNEL32(00000000), ref: 0041D63F
                                                          • Part of subcall function 0041D600: GetSystemDirectoryW.KERNEL32(?,00000106), ref: 0041D665
                                                          • Part of subcall function 0041D600: lstrlenW.KERNEL32(?), ref: 0041D686
                                                          • Part of subcall function 0041D600: lstrcatW.KERNEL32(?,.dll), ref: 0041D6F7
                                                          • Part of subcall function 0041D600: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0041D705
                                                        • SetFileApisToOEM.KERNEL32 ref: 0040112A
                                                        • fputs.MSVCRT ref: 00401142
                                                        • GetCommandLineW.KERNEL32 ref: 00401153
                                                          • Part of subcall function 0040225E: __EH_prolog.LIBCMT ref: 00402263
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                          • Part of subcall function 00405017: GetModuleFileNameW.KERNEL32(00000000,00000000,00000105), ref: 00405047
                                                        • fputs.MSVCRT ref: 004011B7
                                                        • fputs.MSVCRT ref: 00401220
                                                        • fputs.MSVCRT ref: 0040123C
                                                        • _CxxThrowException.MSVCRT(?,0042A888), ref: 00401871
                                                          • Part of subcall function 0040105D: fputs.MSVCRT ref: 00401069
                                                          • Part of subcall function 00402362: __EH_prolog.LIBCMT ref: 00402367
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$H_prolog$FileModule$AddressApisCommandDirectoryExceptionHandleLibraryLineLoadNameProcSystemThrowVersionfreelstrcatlstrlen
                                                        • String ID: Archive Errors$Command line error:$ERROR: Unknown command:$Error: $GetFullPathName Error$Sub items Errors:
                                                        • API String ID: 56233179-1413639172
                                                        • Opcode ID: 94916e765d0e1a86033b5428647388c74df5adf2dc7d8a543460dceea8f6cbff
                                                        • Instruction ID: 9d703ef942381820de0dbe0b684e53fc48ac38d077777954c7a6ffd3a2b1e545
                                                        • Opcode Fuzzy Hash: 94916e765d0e1a86033b5428647388c74df5adf2dc7d8a543460dceea8f6cbff
                                                        • Instruction Fuzzy Hash: 45228B71900258DEDF11EFA5D845ADDBBB4AF14308F1080BFE449772E2DB781A89CB69
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004123E8 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 240COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 237 4123e8-412408 call 424810 240 41266a 237->240 241 41240e-412442 fputs call 412726 237->241 242 41266c-41267a 240->242 245 4124a1-4124a9 241->245 246 412444-41244a 241->246 247 4124b2-4124bb 245->247 248 4124ab-4124b0 245->248 249 412464-412466 246->249 250 41244c-412462 fputs call 403990 246->250 253 4124be-4124c8 call 412726 247->253 248->253 251 412468-41246d 249->251 252 41246f-412478 249->252 250->245 256 41247b-4124a0 call 4030ff call 4129ab call 4037ca 251->256 252->256 258 4124cd-4124f2 call 412a07 253->258 256->245 264 412500-412511 call 41294a 258->264 265 4124f4-4124fb call 412704 258->265 264->242 272 412517-412521 264->272 265->264 273 412523-41252a call 4126a0 272->273 274 41252f-41253d 272->274 273->274 274->242 277 412543-412546 274->277 278 412598-4125a2 277->278 279 412548-412568 277->279 280 4125a8-4125c3 fputs 278->280 281 41265b-412664 278->281 283 41267d-412682 279->283 284 41256e-41257f call 41294a 279->284 280->281 287 4125c9-4125e0 280->287 281->240 281->241 288 412696-41269e SysFreeString 283->288 284->283 292 412585-412596 SysFreeString 284->292 290 4125e2-412604 287->290 291 412658 287->291 288->242 294 412684-412686 290->294 295 412606-41262a 290->295 291->281 292->278 292->279 296 412693 294->296 298 412688-412690 call 406748 295->298 299 41262c-412656 call 41288c call 406748 SysFreeString 295->299 296->288 298->296 299->290 299->291
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 004123ED
                                                        • fputs.MSVCRT ref: 00412423
                                                          • Part of subcall function 00412726: __EH_prolog.LIBCMT ref: 0041272B
                                                          • Part of subcall function 00412726: fputs.MSVCRT ref: 00412740
                                                          • Part of subcall function 00412726: fputs.MSVCRT ref: 00412749
                                                        • fputs.MSVCRT ref: 00412453
                                                          • Part of subcall function 00403990: fputc.MSVCRT ref: 00403997
                                                        • SysFreeString.OLEAUT32(00000000), ref: 0041258C
                                                        • fputs.MSVCRT ref: 004125AF
                                                        • SysFreeString.OLEAUT32(00000000), ref: 0041264C
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00412696
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$FreeString$H_prolog$fputc
                                                        • String ID: --$----$Path$Type$Warning: The archive is open with offset
                                                        • API String ID: 2047134881-3797937567
                                                        • Opcode ID: 69c3ca63ac9fd9f37300b76198856f082f4507ea5e0ea4c672396949b566efb7
                                                        • Instruction ID: 957fc6214829947c78b62da53c88e2602f200d731b82796f5ad25045d639bd93
                                                        • Opcode Fuzzy Hash: 69c3ca63ac9fd9f37300b76198856f082f4507ea5e0ea4c672396949b566efb7
                                                        • Instruction Fuzzy Hash: C6918E71A00215EFCB14DFA4DA85AEEB7B5FF48314F10412EE416E7290DB78AD92CB58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00424BC6 Relevance: 15.1, APIs: 10, Instructions: 74COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: _initterm$FilterXcpt__getmainargs__p___initenv__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                        • String ID:
                                                        • API String ID: 167530163-0
                                                        • Opcode ID: 08e8d53d3d6f83da02f11a61052df14ae455f22d3303dbec78a6ea079e23a063
                                                        • Instruction ID: 177e38515696b200a0e13809d1239373bc5f7af1b49b6428b00fef51bc48b5be
                                                        • Opcode Fuzzy Hash: 08e8d53d3d6f83da02f11a61052df14ae455f22d3303dbec78a6ea079e23a063
                                                        • Instruction Fuzzy Hash: DE318F75A01214EFCB249FA4EC46EAD7B78FB48320F90412EF812A32A1DB785505CB6C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00411DA3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 252COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 315 411da3-411dbd call 424810 318 411de8-411df8 call 411476 315->318 319 411dbf-411dcf call 413010 315->319 324 412037-41203a 318->324 325 411dfe-411e16 318->325 319->318 326 411dd1-411de5 319->326 329 41206d-412085 324->329 330 41203c-412044 324->330 327 411e18 325->327 328 411e1b-411e1d 325->328 326->318 327->328 333 411e28-411e30 328->333 334 411e1f-411e22 328->334 331 412087 call 403981 329->331 332 41208c-412094 329->332 335 412133 call 411135 330->335 336 41204a-412050 call 4123e8 330->336 331->332 332->335 339 41209a-4120d8 fputs call 403b15 call 403990 call 412a6a 332->339 340 411e32-411e3b call 403990 333->340 341 411e5a-411e5c 333->341 334->333 338 411efa-411f05 call 412149 334->338 347 412138-412146 335->347 350 412055-412057 336->350 361 411f10-411f18 338->361 362 411f07-411f0a 338->362 339->347 404 4120da-4120e0 339->404 340->341 366 411e3d-411e55 call 403b07 call 403990 340->366 348 411e8b-411e8f 341->348 349 411e5e-411e66 341->349 355 411e91-411e99 348->355 356 411ee0-411ee8 348->356 351 411e73-411e87 349->351 352 411e68-411e6e call 411b7b 349->352 350->347 353 41205d-412068 call 403990 350->353 351->348 352->351 353->335 363 411ec8-411edc 355->363 364 411e9b-411ec3 fputs call 403990 call 4039a3 call 403990 355->364 356->338 367 411eea-411ef5 call 403990 call 403981 356->367 370 411f42-411f44 361->370 371 411f1a-411f23 call 403990 361->371 362->361 369 411feb-411fef 362->369 363->356 364->363 366->341 367->338 376 411ff1-411fff 369->376 377 412023-41202f 369->377 382 411f73-411f77 370->382 383 411f46-411f4e 370->383 371->370 401 411f25-411f3d call 403b07 call 403990 371->401 386 412001-412013 call 411cc6 376->386 387 41201c 376->387 377->325 392 412035 377->392 388 411f79-411f81 382->388 389 411fc8-411fd0 382->389 395 411f50-411f56 call 411b7b 383->395 396 411f5b-411f6f 383->396 386->387 414 412015-412017 call 403981 386->414 387->377 399 411fb0-411fc4 388->399 400 411f83-411fab fputs call 403990 call 4039a3 call 403990 388->400 389->369 403 411fd2-411fde call 403990 389->403 392->324 395->396 396->382 399->389 400->399 401->370 403->369 424 411fe0-411fe6 call 403981 403->424 410 4120e2-4120e8 404->410 411 412128-41212e call 403981 404->411 412 4120ea-4120fa fputs 410->412 413 4120fc-412117 call 40506f call 4039a3 call 4037ca 410->413 411->335 419 41211c-412123 call 403990 412->419 413->419 414->387 419->411 424->369
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00411DA8
                                                        • fputs.MSVCRT ref: 00411EA8
                                                          • Part of subcall function 00413010: fputs.MSVCRT ref: 00413079
                                                        • fputs.MSVCRT ref: 00411F90
                                                        • fputs.MSVCRT ref: 004120A8
                                                        • fputs.MSVCRT ref: 004120F7
                                                          • Part of subcall function 00403981: fflush.MSVCRT ref: 00403983
                                                          • Part of subcall function 0040506F: __EH_prolog.LIBCMT ref: 00405074
                                                          • Part of subcall function 004039A3: __EH_prolog.LIBCMT ref: 004039A8
                                                          • Part of subcall function 004039A3: fputs.MSVCRT ref: 00403A1B
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$H_prolog$fflushfree
                                                        • String ID: Can't allocate required memory$ERRORS:$WARNINGS:
                                                        • API String ID: 1750297421-1898165966
                                                        • Opcode ID: 35c66210eda1244270c27e98dc22ecfae7b70f668ade43088f0614293e3c8c2c
                                                        • Instruction ID: 776d8e91751a596d08f6c65e98ab45432958da1ec75080bd01857f36ec99b8d1
                                                        • Opcode Fuzzy Hash: 35c66210eda1244270c27e98dc22ecfae7b70f668ade43088f0614293e3c8c2c
                                                        • Instruction Fuzzy Hash: 7FB19E70601701DFEB24DF65C895BEABBB1BF44309F00452FEA5A573A1CB78A984CB58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004121AC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 135COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 433 4121ac-4121d8 call 424810 EnterCriticalSection 436 4121f5-4121fd 433->436 437 4121da-4121df call 413010 433->437 438 412204-412209 436->438 439 4121ff call 403981 436->439 444 4121e4-4121f2 437->444 442 4122d8-4122ee 438->442 443 41220f-41221b 438->443 439->438 447 412384 442->447 448 4122f4-4122f7 442->448 445 41225d-412275 443->445 446 41221d-412223 443->446 444->436 451 412277-412288 call 403990 445->451 452 4122b9-4122c1 445->452 446->445 449 412225-412231 446->449 453 412386-41239d LeaveCriticalSection 447->453 448->447 450 4122fd-412305 448->450 456 412233 449->456 457 412239-412247 449->457 455 412376-412382 call 411135 450->455 458 412307-412329 call 403990 fputs 450->458 451->452 469 41228a-4122b2 fputs call 403bd3 451->469 454 4122c7-4122cd 452->454 452->455 454->455 460 4122d3 454->460 455->453 456->457 457->452 462 412249-41225b fputs 457->462 472 41232b-41233c fputs 458->472 473 41233e-41235a call 40506f call 4039a3 call 4037ca 458->473 465 412371 call 403981 460->465 467 4122b4 call 403990 462->467 465->455 467->452 469->467 475 41235f-41236b call 403990 472->475 473->475 475->465
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 004121B1
                                                        • EnterCriticalSection.KERNEL32(0042F4A8), ref: 004121C7
                                                        • fputs.MSVCRT ref: 00412251
                                                        • LeaveCriticalSection.KERNEL32(0042F4A8), ref: 00412387
                                                          • Part of subcall function 00413010: fputs.MSVCRT ref: 00413079
                                                        • fputs.MSVCRT ref: 00412297
                                                          • Part of subcall function 00403BD3: fputs.MSVCRT ref: 00403BF0
                                                        • fputs.MSVCRT ref: 0041231C
                                                        • fputs.MSVCRT ref: 00412339
                                                          • Part of subcall function 00403990: fputc.MSVCRT ref: 00403997
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$CriticalSection$EnterH_prologLeavefputc
                                                        • String ID: Sub items Errors:
                                                        • API String ID: 2670240366-2637271492
                                                        • Opcode ID: e15251fb888c57f3250d05285207c485ca14e18597dd54aa7b011b06837dd5d4
                                                        • Instruction ID: 829305ad70fca02d161131d71a8e1de08fd64fe9ff9d6de860b41190c631b63a
                                                        • Opcode Fuzzy Hash: e15251fb888c57f3250d05285207c485ca14e18597dd54aa7b011b06837dd5d4
                                                        • Instruction Fuzzy Hash: 7C51D8312016048FDB249F60C990AEEBBE1FF44314F50842FE4AA872A1CBB96895CB18
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00406A7F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 47libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 484 406a7f-406ab2 GetModuleHandleW GetProcAddress 485 406ab4-406abc GlobalMemoryStatusEx 484->485 486 406adf-406af6 GlobalMemoryStatus 484->486 485->486 487 406abe-406ac7 485->487 488 406af8 486->488 489 406afb-406afd 486->489 490 406ad5 487->490 491 406ac9 487->491 488->489 492 406b01-406b05 489->492 495 406ad8-406add 490->495 493 406ad0-406ad3 491->493 494 406acb-406ace 491->494 493->495 494->490 494->493 495->492
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 00406AA3
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00406AAA
                                                        • GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 00406AB8
                                                        • GlobalMemoryStatus.KERNEL32(?), ref: 00406AEA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: GlobalMemoryStatus$AddressHandleModuleProc
                                                        • String ID: $@$GlobalMemoryStatusEx$kernel32.dll
                                                        • API String ID: 180289352-802862622
                                                        • Opcode ID: 13e1cd49150074515b9dfa21ff8845741ca2ef2203a470c87ff70892479f230b
                                                        • Instruction ID: 15bd393caf28a245961fdfda610ea60307b4e37528d707c880fa6bd56ccddecf
                                                        • Opcode Fuzzy Hash: 13e1cd49150074515b9dfa21ff8845741ca2ef2203a470c87ff70892479f230b
                                                        • Instruction Fuzzy Hash: 44112A70A012199FDB14EF94D849BAEBBF5FB05301F51842DD443B7280DBB8A844CF58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00401291 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 320COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 496 401291-4012a2 498 401876-40189f call 40105d call 402362 call 4037ca call 401e19 496->498 499 4012a8-4012ab 496->499 524 4018a1-4018af 498->524 499->498 500 4012b1-4012b9 499->500 502 4012c4-4012d8 call 401000 500->502 503 4012bb-4012c2 500->503 512 401312-401314 502->512 513 4012da-40130d fputs call 403990 call 4039a3 call 403990 502->513 505 401315-401343 call 401053 call 4147b9 * 2 503->505 527 401345-401379 call 403142 call 401072 call 4037ca 505->527 528 40137a 505->528 512->505 534 401723-401749 call 402362 call 4037ca call 401e19 513->534 527->528 530 4013a1-4013c5 call 4030bc 528->530 531 40137c-401388 528->531 546 4013c7-4013d8 call 40325f 530->546 547 4013dd-4013e0 call 405a57 530->547 535 40138a-40139f call 401072 531->535 536 4013ff-401415 _CxxThrowException 531->536 534->524 535->530 535->531 543 40141a-40142f call 4030bc 536->543 555 401431-401441 call 40325f call 405dfd 543->555 556 401446-40149c call 404749 call 401dd2 * 2 call 4037a3 543->556 546->547 558 4013e5-4013e7 547->558 555->556 574 4014ac-4014af 556->574 575 40149e-4014aa call 4018b0 556->575 558->543 563 4013e9-4013fa _CxxThrowException 558->563 563->536 576 4014b1-4014bd 574->576 575->576 579 4014c5-4014d2 call 40d38f 576->579 580 4014bf-4014c1 576->580 583 4014d4-4014e0 _CxxThrowException 579->583 584 4014e5-4014e9 579->584 580->579 583->584 585 401861-401871 _CxxThrowException 584->585 586 4014ef-401503 call 4037a3 584->586 585->498 589 401510 586->589 590 401505-40150e call 4019b3 586->590 591 401512-40151e 589->591 590->591 593 401520-401522 591->593 594 401526-4015a7 call 401c87 call 40325f call 40191f call 40325f call 4030bc 591->594 593->594 605 4015ac-401600 call 40d6e0 594->605 607 401605-401627 call 401f09 call 4037ca 605->607 612 401629-401652 call 403990 fputs call 4039a3 607->612 613 40165b-40166b 607->613 612->613 636 401654 612->636 615 401671-401680 613->615 616 40174e-401750 613->616 615->616 618 401686-40168b 615->618 619 401752-401770 call 403990 fputs call 403990 616->619 620 401775-401781 616->620 624 4016a4-4016bf call 4037ca * 2 618->624 625 40168d-40169f _CxxThrowException 618->625 619->620 621 401783-4017b4 call 403990 fputs call 403bd3 call 403990 620->621 622 4017b9-4017d4 call 4037ca * 2 620->622 621->622 646 4017d6-4017d8 622->646 647 4017dc-4017e5 622->647 643 4016c1-4016c3 624->643 644 4016c7-4016d0 624->644 625->624 636->613 643->644 650 4016d2-4016d4 644->650 651 4016d8-40171e call 401e19 * 2 call 4037ca * 2 call 401e19 call 401e7d 644->651 646->647 648 4017e7-4017e9 647->648 649 4017ed-40185f call 401e19 * 2 call 4037ca * 2 call 401e19 call 401e7d call 402362 call 4037ca call 401e19 647->649 648->649 649->524 650->651 651->534
                                                        APIs
                                                        • fputs.MSVCRT ref: 004012E7
                                                        • _CxxThrowException.MSVCRT(?,0042A8A8), ref: 004013FA
                                                        • _CxxThrowException.MSVCRT(?,0042A898), ref: 00401415
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrow$fputsfree
                                                        • String ID: Error:
                                                        • API String ID: 3322102733-1682980639
                                                        • Opcode ID: 13ef859f3e38daafb77f3262417a0a3645c102e1365a25cddb190540f178d5b0
                                                        • Instruction ID: 9bb94317ed8601d8ca1dde783bf2123f11a88a0c2bf9130dead20c96e26ceb6b
                                                        • Opcode Fuzzy Hash: 13ef859f3e38daafb77f3262417a0a3645c102e1365a25cddb190540f178d5b0
                                                        • Instruction Fuzzy Hash: 98D16D71900298DFDF11EFA5C881ADDBBB4AF15304F1480AFE449B7292DB385A89CF55
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041157E Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1010 41157e-4115b9 call 424810 EnterCriticalSection call 4031fb 1015 4115bb-4115bc 1010->1015 1016 4115de 1010->1016 1018 4115d7-4115dc 1015->1018 1019 4115be-4115bf 1015->1019 1017 4115e3 1016->1017 1022 4115e6-4115ec 1017->1022 1018->1017 1020 4115c1 1019->1020 1021 4115cd-4115d5 1019->1021 1023 4115c8-4115cb 1020->1023 1021->1023 1024 4115f2-4115f8 1022->1024 1025 411744-411748 1022->1025 1023->1022 1024->1025 1026 4115fe-41161c call 41174d call 402c4f 1024->1026 1027 4116c9-4116cf 1025->1027 1043 411625-41164c fputs 1026->1043 1044 41161e-411620 call 402cfd 1026->1044 1028 4116d1-4116d8 1027->1028 1029 41171f-411741 call 411135 LeaveCriticalSection 1027->1029 1031 411717-41171a call 41313f 1028->1031 1032 4116da-4116f8 1028->1032 1031->1029 1035 411700-41170b call 402c4f 1032->1035 1036 4116fa-4116fe 1032->1036 1035->1031 1047 41170d-411712 call 4031fb 1035->1047 1036->1031 1036->1035 1045 411664-41167b call 403a69 1043->1045 1046 41164e-41165f call 4031fb call 403ac2 1043->1046 1044->1043 1055 4116a8-4116ba call 403990 1045->1055 1056 41167d-4116a7 fputs call 403bd3 fputs 1045->1056 1046->1045 1047->1031 1061 4116c7 1055->1061 1062 4116bc-4116c2 call 403981 1055->1062 1056->1055 1061->1027 1062->1061
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$CriticalSection$EnterH_prologLeave
                                                        • String ID:
                                                        • API String ID: 1850570545-0
                                                        • Opcode ID: 2ec1ef4cc69dc18eb2c0c1b45a6191601109b41ce2321b9860ac2e1ba99951f6
                                                        • Instruction ID: 4a95aca5b9e1b5b23a9fe116e922132906d6d4e9dc0678c79a00429f83e9b911
                                                        • Opcode Fuzzy Hash: 2ec1ef4cc69dc18eb2c0c1b45a6191601109b41ce2321b9860ac2e1ba99951f6
                                                        • Instruction Fuzzy Hash: 7951DF31204641EFCB24DF64D880BEABBA2FF45304F44842FE55A973A1CB78A985CB19
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040FBB4 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 260COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1064 40fbb4-40fbde call 424810 1067 40fbe0-40fbea call 4037a3 1064->1067 1068 40fc0d-40fc10 1064->1068 1075 40fbf7 1067->1075 1076 40fbec-40fbf5 1067->1076 1069 40fc16-40fc27 call 4037a3 1068->1069 1070 40fca8-40fcab call 40f93d 1068->1070 1080 40fc35 1069->1080 1081 40fc29-40fc33 call 4070c4 1069->1081 1078 40fcb0-40fcbc 1070->1078 1079 40fbf9-40fc08 call 406cd8 1075->1079 1076->1079 1082 40fe92-40fe9b 1078->1082 1083 40fcc2-40fcc6 1078->1083 1079->1070 1089 40fc38-40fc68 call 406cd8 call 40325f call 405c60 1080->1089 1081->1089 1086 40fea3-40feac 1082->1086 1087 40fe9d-40fe9f 1082->1087 1083->1082 1084 40fccc-40fcd0 1083->1084 1084->1082 1090 40fcd6-40fcda 1084->1090 1092 40feb4 1086->1092 1093 40feae-40feb0 1086->1093 1087->1086 1113 40fc6a-40fc7b GetLastError 1089->1113 1114 40fc9b-40fca1 1089->1114 1096 40fce5-40fcee 1090->1096 1097 40fcdc-40fcdf 1090->1097 1098 40feb6-40fec4 1092->1098 1093->1092 1101 40fe33-40fe3c 1096->1101 1102 40fcf4-40fd10 call 4029a9 1096->1102 1097->1082 1097->1096 1104 40fe44-40fe4d 1101->1104 1105 40fe3e-40fe40 1101->1105 1102->1101 1112 40fd16-40fd39 call 409136 1102->1112 1108 40fe55-40fe58 1104->1108 1109 40fe4f-40fe51 1104->1109 1105->1104 1108->1098 1109->1108 1121 40fe2a-40fe32 call 4037ca 1112->1121 1122 40fd3f-40fd57 call 4029a9 1112->1122 1116 40fc83-40fc8c 1113->1116 1117 40fc7d-40fc7f 1113->1117 1114->1070 1119 40fc94-40fc96 1116->1119 1120 40fc8e-40fc90 1116->1120 1117->1116 1119->1098 1120->1119 1121->1101 1127 40fe19-40fe24 1122->1127 1128 40fd5d-40fdc2 call 40318f call 402230 call 40ff2c call 40343c call 4037ca call 40325f call 403478 call 40ff06 1122->1128 1127->1121 1127->1122 1145 40fdc4-40fddb call 40325f call 40ff06 1128->1145 1146 40fddd-40fdec call 405c60 1128->1146 1145->1146 1152 40fe0c-40fe18 call 4037ca 1145->1152 1146->1152 1153 40fdee-40fe0a call 40efb9 call 40f93d 1146->1153 1152->1127 1153->1152 1161 40fe5a-40fe75 call 4037ca * 2 1153->1161 1166 40fe77-40fe79 1161->1166 1167 40fe7d-40fe86 1161->1167 1166->1167 1168 40fe88-40fe8a 1167->1168 1169 40fe8e-40fe90 1167->1169 1168->1169 1169->1098
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040FBB9
                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000013,?), ref: 0040FC6A
                                                          • Part of subcall function 004037A3: malloc.MSVCRT ref: 004037A9
                                                          • Part of subcall function 004037A3: _CxxThrowException.MSVCRT(?,0042ADB8), ref: 004037C3
                                                          • Part of subcall function 0040F93D: __EH_prolog.LIBCMT ref: 0040F942
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ErrorExceptionLastThrowmalloc
                                                        • String ID: .001$.exe$Split
                                                        • API String ID: 1950902910-1819480430
                                                        • Opcode ID: 4959d1ce15d5891f20a22a64100b58347e33f9573bc92a6177c529123644e25e
                                                        • Instruction ID: 72d0ee3d74f09a2319e785a3fa005b35be436a0f9ad9451116ad4d7cdfe88d17
                                                        • Opcode Fuzzy Hash: 4959d1ce15d5891f20a22a64100b58347e33f9573bc92a6177c529123644e25e
                                                        • Instruction Fuzzy Hash: D1A17270A00209AFDB24DFA4C585AAEBBB4BF05304F14447EE945BB6D2CB399E09CB55
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004043B1 Relevance: 7.7, APIs: 5, Instructions: 226COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1170 4043b1-4043cd call 424810 1173 4043e4-404409 call 403de3 1170->1173 1174 4043cf-4043df _CxxThrowException 1170->1174 1177 404417-404433 call 4030bc 1173->1177 1178 40440b-404412 call 404918 1173->1178 1174->1173 1182 404461-404465 1177->1182 1183 404435-40443d 1177->1183 1178->1177 1185 40452a-40453a call 404349 1182->1185 1186 40446b-404486 call 40468d 1182->1186 1183->1182 1184 40443f-404445 1183->1184 1184->1182 1187 404447-404458 wcscmp 1184->1187 1193 40453c-40458d call 40318f call 40465d call 4049cc call 401f97 call 4037ca 1185->1193 1194 40458e-404592 1185->1194 1195 404496-40449e 1186->1195 1196 404488-40448a 1186->1196 1187->1182 1190 40445a 1187->1190 1190->1182 1193->1194 1199 4045e0 1194->1199 1200 404594-404597 1194->1200 1197 4044a0-4044b4 wcscmp 1195->1197 1198 4044e3-4044e8 1195->1198 1196->1195 1202 40448c-40448e 1196->1202 1203 4044c6 1197->1203 1204 4044b6-4044c4 wcscmp 1197->1204 1208 404528 1198->1208 1209 4044ea-4044f3 1198->1209 1205 4045e3-404626 call 40484c call 404157 1199->1205 1206 4045a9-4045de call 4026b3 call 403142 call 401dd2 call 4037ca 1200->1206 1207 404599-40459d 1200->1207 1202->1195 1211 404490-404493 1202->1211 1212 4044c9-4044cf 1203->1212 1204->1203 1204->1212 1234 40462b-40465a call 401e19 call 4037ca call 401e19 1205->1234 1206->1205 1207->1199 1214 40459f-4045a7 1207->1214 1208->1185 1216 404505-404526 call 40343c call 402230 call 401e4e 1209->1216 1217 4044f5-4044f8 1209->1217 1211->1195 1212->1197 1219 4044d1-4044d5 1212->1219 1214->1199 1214->1206 1216->1208 1216->1209 1217->1216 1222 4044fa-404503 call 403fa1 1217->1222 1219->1198 1226 4044d7-4044dd 1219->1226 1222->1208 1222->1216 1232 4044e0 1226->1232 1233 4044df 1226->1233 1232->1198 1233->1232
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: wcscmp$ExceptionH_prologThrow
                                                        • String ID:
                                                        • API String ID: 2750596395-0
                                                        • Opcode ID: 81e909a69df59f2b14b393075e91665b4f6164400a511e5a87e5474d4666dee4
                                                        • Instruction ID: 4f015d067afee3ab9d1db86f274e45d49ad1b725fb492a765f151fa9296be904
                                                        • Opcode Fuzzy Hash: 81e909a69df59f2b14b393075e91665b4f6164400a511e5a87e5474d4666dee4
                                                        • Instruction Fuzzy Hash: 6D91AEB0D0020ADFCF14EFA5C581AEEBBB0AF55318F54406EE605B72D1DB385A45CBA8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004056A1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 295COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1255 4056a1-4056c1 call 424810 call 4060d9 1260 405875-40588b call 406053 1255->1260 1261 4056c7-4056cd 1255->1261 1267 405890-40589d call 405e1f 1260->1267 1268 40588d-40588f 1260->1268 1261->1260 1262 4056d3-4056f3 call 4030ff * 2 1261->1262 1275 405700-405706 1262->1275 1276 4056f5-4056fb 1262->1276 1273 4058f2-4058f9 1267->1273 1274 40589f-4058a5 1267->1274 1268->1267 1280 405905-40590c 1273->1280 1281 4058fb-4058ff 1273->1281 1274->1273 1277 4058a7-4058b3 call 405692 1274->1277 1278 405708-40571b call 4029a9 1275->1278 1279 40571d-405725 call 403478 1275->1279 1276->1275 1282 4059e3-4059e8 call 40546d 1277->1282 1297 4058b9-4058bc 1277->1297 1278->1279 1290 40572a-405737 call 40602a 1278->1290 1279->1290 1283 40593e-405945 call 405fcd 1280->1283 1284 40590e-405918 call 405692 1280->1284 1281->1280 1281->1282 1296 4059ed 1282->1296 1283->1282 1303 40594b-405956 1283->1303 1284->1282 1299 40591e-405921 1284->1299 1305 405739-40573c 1290->1305 1306 40576f-405779 call 4056a1 1290->1306 1301 4059ef-4059f2 call 40544d 1296->1301 1297->1282 1302 4058c2-4058df call 40566f call 4031fb 1297->1302 1299->1282 1304 405927-40593c call 40566f 1299->1304 1314 4059f7 1301->1314 1326 4058eb-4058ed 1302->1326 1334 4058e1-4058e6 1302->1334 1303->1282 1309 40595c-405963 call 405dd7 1303->1309 1304->1326 1312 40574a-405762 call 40566f 1305->1312 1313 40573e-405741 1305->1313 1324 405863-405874 call 4037ca * 2 1306->1324 1325 40577f 1306->1325 1309->1282 1329 405965-405998 call 4030ff call 402230 * 2 call 40546d 1309->1329 1331 405781-4057a7 call 40318f call 4030bc 1312->1331 1333 405764-40576d call 40325f 1312->1333 1313->1306 1319 405743-405748 1313->1319 1320 4059f9-405a07 1314->1320 1319->1306 1319->1312 1324->1260 1325->1331 1326->1301 1356 40599a-4059b0 wcscmp 1329->1356 1357 4059bd-4059ca call 405692 1329->1357 1347 4057ac-4057c2 call 40562f 1331->1347 1333->1331 1334->1326 1353 4057c4-4057c8 1347->1353 1354 4057f8-4057fa 1347->1354 1358 4057f0-4057f2 SetLastError 1353->1358 1359 4057ca-4057d7 call 4028eb 1353->1359 1355 405832-40585e call 4037ca * 2 call 40544d call 4037ca * 2 1354->1355 1355->1314 1360 4059b2-4059b7 1356->1360 1361 4059b9 1356->1361 1371 405a0a-405a14 call 40566f 1357->1371 1372 4059cc-4059cf 1357->1372 1358->1354 1373 4057d9-4057ee call 4037ca call 4030bc 1359->1373 1374 4057fc-405802 1359->1374 1365 405a28-405a40 call 4031fb call 4037ca call 40544d 1360->1365 1361->1357 1365->1320 1395 405a16-405a19 1371->1395 1396 405a1b 1371->1396 1380 4059d1-4059d4 1372->1380 1381 4059d6-4059e2 call 4037ca 1372->1381 1373->1347 1376 405804-405809 1374->1376 1377 405815-405830 call 40343c 1374->1377 1376->1377 1387 40580b-405811 1376->1387 1377->1355 1380->1371 1380->1381 1381->1282 1387->1377 1400 405a22-405a25 1395->1400 1396->1400 1400->1365
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 004056A6
                                                        • SetLastError.KERNEL32(00000002,?,?,0000FBEF,:$DATA,?,00000000,00000000,?,00000000), ref: 004057F2
                                                        • wcscmp.MSVCRT ref: 004059A6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ErrorH_prologLastwcscmp
                                                        • String ID: :$DATA
                                                        • API String ID: 161073058-2587938151
                                                        • Opcode ID: 966746ec1e2f590d8a96445ff2b2680b5676536dacfbb94c3eaf20ad52103fd3
                                                        • Instruction ID: 5a8d20fd89ea61cf62b8e3e45c1586708e35534e9b70fdd4c5d9363e10410ecb
                                                        • Opcode Fuzzy Hash: 966746ec1e2f590d8a96445ff2b2680b5676536dacfbb94c3eaf20ad52103fd3
                                                        • Instruction Fuzzy Hash: F3B1CB71900A09DADB10EFA5D8816EFBBB4EF14318F10852FE846772E2DB395A45CF19
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00412726 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1405 412726-412752 call 424810 fputs * 2 1408 412760-41277f call 4030ff call 403ac2 call 4039a3 1405->1408 1409 412754-41275e call 4127a4 1405->1409 1418 412784-412793 call 403990 call 4037ca 1408->1418 1414 412794-4127a1 1409->1414 1418->1414
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0041272B
                                                        • fputs.MSVCRT ref: 00412740
                                                        • fputs.MSVCRT ref: 00412749
                                                          • Part of subcall function 004127A4: __EH_prolog.LIBCMT ref: 004127A9
                                                          • Part of subcall function 004127A4: fputs.MSVCRT ref: 004127E6
                                                          • Part of subcall function 004127A4: fputs.MSVCRT ref: 0041281C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$H_prolog
                                                        • String ID: =
                                                        • API String ID: 2614055831-2525689732
                                                        • Opcode ID: 24c0e0cf09e1debc2198061a48fdb61f62e6d232e33ef21b6f0c50aa6b676143
                                                        • Instruction ID: d9301a19ed73ae1a2514b866cbc2408bfb5154f99e535b9c7f465323593f6144
                                                        • Opcode Fuzzy Hash: 24c0e0cf09e1debc2198061a48fdb61f62e6d232e33ef21b6f0c50aa6b676143
                                                        • Instruction Fuzzy Hash: F3018471610118ABCF05BF65D802AEE7F69EF84718F00402FF445621D1CB7D4A55CB99
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040B695 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 964COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040B69A
                                                          • Part of subcall function 0040B444: __EH_prolog.LIBCMT ref: 0040B449
                                                          • Part of subcall function 0040E923: __EH_prolog.LIBCMT ref: 0040E928
                                                          • Part of subcall function 0040E923: wcscmp.MSVCRT ref: 0040E97D
                                                          • Part of subcall function 0040EAAC: __EH_prolog.LIBCMT ref: 0040EAB1
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                          • Part of subcall function 00406FAD: __EH_prolog.LIBCMT ref: 00406FB2
                                                          • Part of subcall function 0040B4F6: __EH_prolog.LIBCMT ref: 0040B4FB
                                                        Strings
                                                        • Can not seek to begin of file, xrefs: 0040C1B3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$freewcscmp
                                                        • String ID: Can not seek to begin of file
                                                        • API String ID: 197229272-1513257940
                                                        • Opcode ID: 8fcc135045aa690b81772f20f18d0dfdc96da886cedf26a5095f4af3e1b88cb7
                                                        • Instruction ID: b2465f06bb8c539651a05bffa4e800c06b0385202124ca6a841f0e07f028f811
                                                        • Opcode Fuzzy Hash: 8fcc135045aa690b81772f20f18d0dfdc96da886cedf26a5095f4af3e1b88cb7
                                                        • Instruction Fuzzy Hash: 2C82AD71900249DFDB20EFA5C890AAEBBB5EF04304F14847FE446B7291DB38AE45DB59
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004165F6 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 2077 4165f6-416619 call 424810 call 408801 2082 416777-416785 2077->2082 2083 41661f-416628 call 416788 2077->2083 2086 416631-416636 2083->2086 2087 41662a-41662c 2083->2087 2088 416647-41666b call 4037a3 memcpy 2086->2088 2089 416638-41663d 2086->2089 2087->2082 2093 41666f-416676 2088->2093 2089->2088 2090 41663f-416642 2089->2090 2090->2082 2094 416696-4166b2 call 407259 2093->2094 2095 416678-416686 2093->2095 2099 4166b8-4166bd 2094->2099 2100 41676a 2094->2100 2095->2094 2096 416688-41668a 2095->2096 2096->2094 2098 41668c-416690 2096->2098 2098->2094 2101 41672e-416731 2098->2101 2099->2101 2102 4166bf-4166cb 2099->2102 2103 41676c-416775 call 4037ca 2100->2103 2101->2103 2104 416710-416729 memmove 2102->2104 2105 4166cd-4166d0 2102->2105 2103->2082 2104->2093 2107 4166d2-4166d6 2105->2107 2108 4166f7-4166f9 2105->2108 2110 4166d8-4166dc 2107->2110 2111 4166ed-4166ee 2107->2111 2108->2104 2112 4166fb-416709 call 416788 2108->2112 2113 4166f0-4166f2 2110->2113 2114 4166de-4166e2 2110->2114 2111->2108 2119 416733-416767 memcpy call 407337 2112->2119 2120 41670b-41670e 2112->2120 2113->2108 2117 4166f4 2114->2117 2118 4166e4-4166e9 2114->2118 2117->2108 2118->2105 2121 4166eb 2118->2121 2119->2100 2120->2102 2121->2108
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: e9570489b2e6482130ff7758cc92c8c82613413c66b5c73d370e71c19a2df81f
                                                        • Instruction ID: 08e5523af074f91430f2b9b5922ea6425ede4d3c249a7b5b9d64a56560e7f240
                                                        • Opcode Fuzzy Hash: e9570489b2e6482130ff7758cc92c8c82613413c66b5c73d370e71c19a2df81f
                                                        • Instruction Fuzzy Hash: 8351DFB5A002059BEB24DF64C884BFFB7B5EB84348F16442EE815A7281D778EC85CB58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040E142 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 352COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 2124 40e142-40e1bc call 424810 call 4147b9 call 40318f * 2 2133 40e1f6-40e25f call 40e77a call 403142 call 4036c9 call 4037ca * 2 call 4030bc call 40318f 2124->2133 2134 40e1be-40e1e2 call 4029a9 2124->2134 2153 40e261-40e265 2133->2153 2154 40e2ca-40e2db call 4040e3 2133->2154 2134->2133 2140 40e1e4-40e1f1 call 40325f 2134->2140 2140->2133 2153->2154 2155 40e267-40e287 call 4030bc call 403e85 2153->2155 2160 40e2e1-40e2ed 2154->2160 2161 40e3f4-40e3f7 2154->2161 2170 40e289-40e295 2155->2170 2171 40e2bd-40e2c9 call 4037ca 2155->2171 2172 40e2f6-40e314 call 4030bc call 4147b9 2160->2172 2173 40e2ef-40e2f1 2160->2173 2163 40e405-40e408 2161->2163 2164 40e3f9-40e400 call 401dd2 2161->2164 2168 40e45a-40e464 call 405203 2163->2168 2169 40e40a-40e412 call 40335d 2163->2169 2164->2163 2180 40e417-40e44e call 40b067 2168->2180 2188 40e466-40e470 GetLastError 2168->2188 2169->2180 2176 40e297-40e29b 2170->2176 2177 40e29d-40e2a1 2170->2177 2171->2154 2205 40e3a2-40e3a5 2172->2205 2206 40e31a-40e31d 2172->2206 2178 40e529-40e576 call 4037ca * 4 call 401e19 call 4037ca 2173->2178 2176->2177 2184 40e2a5-40e2a8 2176->2184 2177->2184 2199 40e450-40e453 2180->2199 2200 40e495 2180->2200 2184->2171 2192 40e2aa-40e2b9 call 40325f 2184->2192 2189 40e472 2188->2189 2190 40e477-40e490 call 40335d call 40343c 2188->2190 2189->2190 2190->2178 2192->2171 2199->2200 2207 40e455-40e458 2199->2207 2203 40e497-40e4a8 2200->2203 2212 40e4aa-40e4d0 2203->2212 2213 40e4eb-40e4f1 2203->2213 2208 40e3a7-40e3b9 2205->2208 2209 40e3db-40e3f3 call 401e19 call 4037ca 2205->2209 2214 40e324-40e335 call 40edc6 2206->2214 2215 40e31f-40e322 2206->2215 2207->2203 2242 40e3bd-40e3d0 call 401e19 call 4037ca 2208->2242 2209->2161 2250 40e4d2-40e4d8 call 40e579 2212->2250 2251 40e4dd-40e4e9 call 406748 2212->2251 2273 40e4f2 call 414be7 2213->2273 2274 40e4f2 call 414c56 2213->2274 2275 40e4f2 call 414dc8 2213->2275 2232 40e3d5-40e3d9 2214->2232 2233 40e33b-40e33e 2214->2233 2215->2214 2218 40e388-40e38e call 40214a 2215->2218 2230 40e393-40e39c 2218->2230 2222 40e4f5 2228 40e4f7-40e4fe 2222->2228 2238 40e500-40e505 call 40c94b 2228->2238 2239 40e508-40e50a 2228->2239 2230->2205 2230->2206 2232->2242 2235 40e340-40e34d call 403db7 2233->2235 2236 40e374-40e377 2233->2236 2260 40e371 2235->2260 2261 40e34f-40e35c 2235->2261 2236->2218 2246 40e379-40e386 call 40b67f 2236->2246 2238->2239 2247 40e50c 2239->2247 2248 40e50e-40e512 2239->2248 2242->2178 2246->2218 2246->2230 2247->2248 2276 40e514 call 403990 2248->2276 2277 40e514 call 4121ac 2248->2277 2250->2251 2251->2228 2260->2236 2266 40e365-40e369 2261->2266 2267 40e35e-40e361 2261->2267 2265 40e517-40e522 2265->2178 2269 40e524 call 40c94b 2265->2269 2266->2236 2271 40e36b-40e36f 2266->2271 2267->2236 2270 40e363 2267->2270 2269->2178 2270->2260 2271->2236 2271->2260 2273->2222 2274->2222 2275->2222 2276->2265 2277->2265
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040E147
                                                        • GetLastError.KERNEL32(?,00000000,00000000,00428370,?,0000000D,00000000,00000000,?), ref: 0040E466
                                                        Strings
                                                        • Can not create output directory: , xrefs: 0040E47A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ErrorH_prologLast
                                                        • String ID: Can not create output directory:
                                                        • API String ID: 1057991267-3123869724
                                                        • Opcode ID: 545d1d56cb548353f34a09eff8e62630e711b459f1b2591e06e6a311b80fc328
                                                        • Instruction ID: 6b3b7256464de5f1d6c3bdc007a884b9e6889a54eb1e0fab75d01c995e830194
                                                        • Opcode Fuzzy Hash: 545d1d56cb548353f34a09eff8e62630e711b459f1b2591e06e6a311b80fc328
                                                        • Instruction Fuzzy Hash: B1E1AF70900249EFCF10EFA5C884AEEBBB5BF18308F1444AEE84577292DB389E55CB55
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041313F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CountTickfputs
                                                        • String ID: .
                                                        • API String ID: 290905099-4150638102
                                                        • Opcode ID: f9cc4b4013665b71159da58eff6a8980c39580281d914f744d8736f6a5401f4e
                                                        • Instruction ID: 5e71bfd10a56a5e5b63b1d227b8a6c7e749698e4b11838c812b21891e0b572e9
                                                        • Opcode Fuzzy Hash: f9cc4b4013665b71159da58eff6a8980c39580281d914f744d8736f6a5401f4e
                                                        • Instruction Fuzzy Hash: 03715E306007049BCB25EF65C584BAFB7F5BF81309F40486EE49797691DBB8BA85CB18
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00412AE2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00412AE7
                                                          • Part of subcall function 00412DBB: GetVersionExW.KERNEL32(?), ref: 00412DD5
                                                        • fputs.MSVCRT ref: 00412B1E
                                                        Strings
                                                        • Unsupported Windows version, xrefs: 00412B19
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prologVersionfputs
                                                        • String ID: Unsupported Windows version
                                                        • API String ID: 1051792753-2397968907
                                                        • Opcode ID: 2a22abeb2ea1176b1e56b470f775d174c962f781733d669cba86f07add0276f2
                                                        • Instruction ID: 3b67886603d7dc6d4aae8d9f09a67f505e3d6447adba07b89a6c9e89ba5628a7
                                                        • Opcode Fuzzy Hash: 2a22abeb2ea1176b1e56b470f775d174c962f781733d669cba86f07add0276f2
                                                        • Instruction Fuzzy Hash: 91019271A01214DFDB10EF98F9067EDB7B0EF15728FA0417FE001A71A1D7B91A468769
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041366E Relevance: 4.6, APIs: 3, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00413673
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00413688
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 0041370B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterH_prologLeave
                                                        • String ID:
                                                        • API String ID: 367238759-0
                                                        • Opcode ID: 5e993e151d0ec5ec397838a201fb18a052dd767c9fb10285ac565174288fc8d6
                                                        • Instruction ID: e9ca7b77fe6afa62ffee5b8492ee494ebc1aa1f9cde9de0131d26c5a36833ffa
                                                        • Opcode Fuzzy Hash: 5e993e151d0ec5ec397838a201fb18a052dd767c9fb10285ac565174288fc8d6
                                                        • Instruction Fuzzy Hash: 3B213575200700EFCB28CF54D884A6ABBF9FF88715F10895EE8568B761C374E945CBA4
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040516F Relevance: 4.5, APIs: 3, Instructions: 30filetimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,00000000,?,00000000,0040C88E,?,?,?,0040C920,?), ref: 00405187
                                                        • SetFileTime.KERNELBASE(00000000,?,0040C920,0040C920,?,0040C920,?,00000000,?,00000000,?,?,0040E529), ref: 0040519E
                                                        • CloseHandle.KERNEL32(00000000,?,0040C920,?,00000000,?,00000000,?,?,0040E529), ref: 004051AA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: File$CloseCreateHandleTime
                                                        • String ID:
                                                        • API String ID: 3397143404-0
                                                        • Opcode ID: 594ffa959ecf8d98058e19cb5071bf3013fe7d5960cfb52c67d67f4dac439c3a
                                                        • Instruction ID: c781142bfce38c1e2c4ad27494238dc73a2c2deec9e839b908d88456039059fc
                                                        • Opcode Fuzzy Hash: 594ffa959ecf8d98058e19cb5071bf3013fe7d5960cfb52c67d67f4dac439c3a
                                                        • Instruction Fuzzy Hash: 94E09A322422207EF2201E64AC88FAB665CEF85B65F010229F560A61E0C6258C1A9678
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00411255 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0041125A
                                                        • EnterCriticalSection.KERNEL32(0042F4A8), ref: 0041126B
                                                        • LeaveCriticalSection.KERNEL32(0042F4A8), ref: 0041129D
                                                          • Part of subcall function 0041313F: GetTickCount.KERNEL32 ref: 00413154
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$CountEnterH_prologLeaveTick
                                                        • String ID:
                                                        • API String ID: 2547919631-0
                                                        • Opcode ID: af63fc66d38c7040901f374488eea58192aa7e6b0a0032e46a0a928cbcfe74c4
                                                        • Instruction ID: c78c4969fbf36cb1bff8e496c029ec3ca6c1734b3766a214ef4e6dd782684a87
                                                        • Opcode Fuzzy Hash: af63fc66d38c7040901f374488eea58192aa7e6b0a0032e46a0a928cbcfe74c4
                                                        • Instruction Fuzzy Hash: C4F06D75611220AFC704AF18E908F9DB7B4EF98311F01807FE40597351CB788948CA68
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040F422 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 418COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID: Split
                                                        • API String ID: 3519838083-1882502421
                                                        • Opcode ID: 412c42dd572bc01af0749c1cdea511f3463362269edee7b0998c527c7dea6bb2
                                                        • Instruction ID: ae8d89585f8feb570c342c7cb425aa3eae869cd40a6b33a46c6c0a917372f74c
                                                        • Opcode Fuzzy Hash: 412c42dd572bc01af0749c1cdea511f3463362269edee7b0998c527c7dea6bb2
                                                        • Instruction Fuzzy Hash: 40022C70900249EFCF24DFA4C8849AEBBB5BF48304F24847EE546AB791C739AD49CB55
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00413010 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • fputs.MSVCRT ref: 00413079
                                                          • Part of subcall function 00402B5E: _CxxThrowException.MSVCRT(FFFFFFFF,0042AD80), ref: 00402B80
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrowfputs
                                                        • String ID:
                                                        • API String ID: 1334390793-399585960
                                                        • Opcode ID: c201b065025efbaeed10002841408ae524053122bf742175bcba41f7cd9c5c95
                                                        • Instruction ID: 98b802e71faf1c2b9e1fded426e8cc6c4d2944ad5decca1adf073acc8c379f13
                                                        • Opcode Fuzzy Hash: c201b065025efbaeed10002841408ae524053122bf742175bcba41f7cd9c5c95
                                                        • Instruction Fuzzy Hash: 0B11C1716047409FDB25CF59C8C5BAAFBE6EF89304F0440AEE1869B290C7B6BD44CB64
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00411ACE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs
                                                        • String ID: Open
                                                        • API String ID: 1795875747-71445658
                                                        • Opcode ID: dad78ee70be241b06eb8cb32566892b1d16bd3d7439a0a701ce423bbe0a7d876
                                                        • Instruction ID: 3eb09240fe1fd09296793f474f58ffaeaf8378007a198b004a2f0d33e82ff21e
                                                        • Opcode Fuzzy Hash: dad78ee70be241b06eb8cb32566892b1d16bd3d7439a0a701ce423bbe0a7d876
                                                        • Instruction Fuzzy Hash: 0A11AC312097049FD764EF35D881ADABBA4AF14314F40843FE5AA832A1DB79B884CB18
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004178FD Relevance: 3.2, APIs: 2, Instructions: 203COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00417902
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00417B34
                                                          • Part of subcall function 004037A3: malloc.MSVCRT ref: 004037A9
                                                          • Part of subcall function 004037A3: _CxxThrowException.MSVCRT(?,0042ADB8), ref: 004037C3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrow$H_prologmalloc
                                                        • String ID:
                                                        • API String ID: 3044594480-0
                                                        • Opcode ID: c5e5cf0cdb82bfb4c85e60ca47619a615d7d95a9f63fd523716112fb24ca8e2f
                                                        • Instruction ID: cdbf4a41c1808ef28a858ba7862f7184d3b46185e099037a7efb1050aee5d72f
                                                        • Opcode Fuzzy Hash: c5e5cf0cdb82bfb4c85e60ca47619a615d7d95a9f63fd523716112fb24ca8e2f
                                                        • Instruction Fuzzy Hash: CD816CB0D04259DFCB21DFA9C881AEEBBB5BF49304F14809EE455A7252C7386E84CF65
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00410923 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00410928
                                                          • Part of subcall function 004056A1: __EH_prolog.LIBCMT ref: 004056A6
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        • _CxxThrowException.MSVCRT(?,0042AD80), ref: 00410987
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ExceptionThrowfree
                                                        • String ID:
                                                        • API String ID: 1371406966-0
                                                        • Opcode ID: 5c51e6c28adbd41064f696d91a0dc36b6a56d0afe0d4ec351f80d8476ff10d38
                                                        • Instruction ID: e6c4627d217cd6700fbda2e30eaac9fc29c9db4c4314600712172d005ef692a3
                                                        • Opcode Fuzzy Hash: 5c51e6c28adbd41064f696d91a0dc36b6a56d0afe0d4ec351f80d8476ff10d38
                                                        • Instruction Fuzzy Hash: E8014475600644AECB25EF21D441BDEBBE5EF81318F10851FE882A32A1CB785648CF54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004039A3 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prologfputs
                                                        • String ID:
                                                        • API String ID: 1798449854-0
                                                        • Opcode ID: 8da54ea3a65fb9c434e1a97adfeb2d737a2a5f7acd120e7933e9e204a2c5758b
                                                        • Instruction ID: 7a59d5ab6f592b97654148d8611031fa6636409462887f580bfe43257f36e473
                                                        • Opcode Fuzzy Hash: 8da54ea3a65fb9c434e1a97adfeb2d737a2a5f7acd120e7933e9e204a2c5758b
                                                        • Instruction Fuzzy Hash: 3211ACB29000099ACF00EFA4DD42AECBB79AF50319F10807EE401321D2DB7A1F45DAA8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004185EB Relevance: 3.0, APIs: 2, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 004185F0
                                                          • Part of subcall function 00418319: __EH_prolog.LIBCMT ref: 0041831E
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041863B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ExceptionThrow
                                                        • String ID:
                                                        • API String ID: 2366012087-0
                                                        • Opcode ID: 31345c119c41f62dbd1a86d73f6ed6340d592e703c90b8ed1b5669b948da4c02
                                                        • Instruction ID: a64484d7241db46b4bd73aac724e51da628453ccee67bcd172ffac8956c3379b
                                                        • Opcode Fuzzy Hash: 31345c119c41f62dbd1a86d73f6ed6340d592e703c90b8ed1b5669b948da4c02
                                                        • Instruction Fuzzy Hash: 8B01DF36A00288AEDF119F54D805BEE7BB4EB41314F04405FF4045A211C7BAA9908BA5
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405B9D Relevance: 3.0, APIs: 2, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointer.KERNELBASE(?,00000000,00000000,0040C954,?,?,?,00405C0C,0040C954,0040C954,00000000,00000000,00405DB3,00000000,00000000,00000000), ref: 00405BB9
                                                        • GetLastError.KERNEL32(?,00405C0C,0040C954,0040C954,00000000,00000000,00405DB3,00000000,00000000,00000000,?,?,?,?,0040C595,80004004), ref: 00405BC6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID:
                                                        • API String ID: 2976181284-0
                                                        • Opcode ID: ce0e88725cdfef31cdd1363a5a2d5421a7f488e7e60e9d66433ba39f8a9c5975
                                                        • Instruction ID: aec26ae7905eafc46f8ee37214467f7e01adca7faf5131c91252f2a4cc5637cf
                                                        • Opcode Fuzzy Hash: ce0e88725cdfef31cdd1363a5a2d5421a7f488e7e60e9d66433ba39f8a9c5975
                                                        • Instruction Fuzzy Hash: 7FF04971600204AFCF10DF69EC05BDF3BE5EB45310F118169F915EB2A0EA75A911AB64
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00423630 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast_beginthreadex
                                                        • String ID:
                                                        • API String ID: 4034172046-0
                                                        • Opcode ID: 5bf4b0acdd058f80da119a294836a7989b208050f4759e3ad17651ebe6cfdfc9
                                                        • Instruction ID: 3ac634f9eeed7df842374f72e1957812e923edc40c6adb1153e557cc936d6ad3
                                                        • Opcode Fuzzy Hash: 5bf4b0acdd058f80da119a294836a7989b208050f4759e3ad17651ebe6cfdfc9
                                                        • Instruction Fuzzy Hash: CDE086713052116FF3208F64AC05F6B76ECEBA0B41F80843DF644D6280EA649910C779
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00406A3D Relevance: 3.0, APIs: 2, Instructions: 7COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(?,?,00406A5E), ref: 00406A42
                                                        • GetProcessAffinityMask.KERNEL32(00000000), ref: 00406A49
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: Process$AffinityCurrentMask
                                                        • String ID:
                                                        • API String ID: 1231390398-0
                                                        • Opcode ID: 22136e4da022f372c43c50c800891f944e964f15465b0bfe80cfea79c29d2b8e
                                                        • Instruction ID: 1084c397ea0c33c7069ee706d075b68a4fd739f103e1925da4c5e91aa769fdaf
                                                        • Opcode Fuzzy Hash: 22136e4da022f372c43c50c800891f944e964f15465b0bfe80cfea79c29d2b8e
                                                        • Instruction Fuzzy Hash: 29B092B1501100ABDE209BA09D0C81A3B2CBB062413418868B506C1010CA3AD00A8B38
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004037A3 Relevance: 2.5, APIs: 2, Instructions: 15COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrowmalloc
                                                        • String ID:
                                                        • API String ID: 2436765578-0
                                                        • Opcode ID: 3085265e268443d4750656de113f4c174e5ba7228994ab261585b53c21cbb6aa
                                                        • Instruction ID: 3f986b5d8816f9706c84ffe5647a1e13afcf96ae59860cf0afae9b017e9437d1
                                                        • Opcode Fuzzy Hash: 3085265e268443d4750656de113f4c174e5ba7228994ab261585b53c21cbb6aa
                                                        • Instruction Fuzzy Hash: 2DD0A73521424C7ACF006FE1B80459E3F5C9D02A61790942BF8189F241D534D3514759
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00414DC8 Relevance: 2.1, APIs: 1, Instructions: 603COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: e2f8de63276632807fbdb031d1b5cfd02cc4645d16fc558b2d916ec3bc7dd8f9
                                                        • Instruction ID: efaa5074abb76eaced0842d8e0d5175d41766d52dfb7ff21df250c976906fb36
                                                        • Opcode Fuzzy Hash: e2f8de63276632807fbdb031d1b5cfd02cc4645d16fc558b2d916ec3bc7dd8f9
                                                        • Instruction Fuzzy Hash: 3C427170900649DFDF15CFA8C584BDEBBB5AF89304F28809AE805AB391D7799E81CB15
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040FF7F Relevance: 2.0, APIs: 1, Instructions: 486COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: 10486e265e1369bd9439085ec8b35cae6ca09f7fb86154774fb891038d9ffbd1
                                                        • Instruction ID: 2092778039080db5bfd3b963afb1aebe4d1c90dc57dfaedd65aa6c20308e3ff4
                                                        • Opcode Fuzzy Hash: 10486e265e1369bd9439085ec8b35cae6ca09f7fb86154774fb891038d9ffbd1
                                                        • Instruction Fuzzy Hash: 7A129D70900209DFCF14DFA4C984AEEBBB5AF49314F24859AE449FB291D778AE81CF54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00418319 Relevance: 1.7, APIs: 1, Instructions: 222COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: df6028b1cf33c9896d6596f1b34e1add74ac901b5b11af2d10cd08c6d82ae063
                                                        • Instruction ID: 34c4c1ae9a27b4e09f4d3f585592bceeb7760c740752b30a76c27bcd68c9d41e
                                                        • Opcode Fuzzy Hash: df6028b1cf33c9896d6596f1b34e1add74ac901b5b11af2d10cd08c6d82ae063
                                                        • Instruction Fuzzy Hash: 52915C70A0064AEFCF25DFA9C4806EEFBB1BF19304F14452EE459A3311DB39A994CB95
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040F93D Relevance: 1.7, APIs: 1, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040F942
                                                          • Part of subcall function 0040F422: __EH_prolog.LIBCMT ref: 0040F427
                                                          • Part of subcall function 0040D069: __EH_prolog.LIBCMT ref: 0040D06E
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$free
                                                        • String ID:
                                                        • API String ID: 2654054672-0
                                                        • Opcode ID: f5c050f24be312494f445793bcfd4a8fb1ff3b7289d1ad95b147f7e7bdb34fa5
                                                        • Instruction ID: e441be9f4f386819ccfbca45c33dba30ff0e1c1ada294362ac64299d887e2de3
                                                        • Opcode Fuzzy Hash: f5c050f24be312494f445793bcfd4a8fb1ff3b7289d1ad95b147f7e7bdb34fa5
                                                        • Instruction Fuzzy Hash: 98619F706002099FDB20EFA1C891EAEBBB8AF54308F10447FE545B76D1DB78BA49CB54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00415EFE Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00415F03
                                                          • Part of subcall function 004185EB: __EH_prolog.LIBCMT ref: 004185F0
                                                          • Part of subcall function 004185EB: _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041863B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ExceptionThrow
                                                        • String ID:
                                                        • API String ID: 2366012087-0
                                                        • Opcode ID: e70893dbc2791860fdb2a2ff2b207be93f1f3658ef46f0f28ce7575006bc1a0b
                                                        • Instruction ID: 0349e78a4a6cbd19bab9ad3eea4fd47ab146067aab0cd46c829df0c4c72dc65b
                                                        • Opcode Fuzzy Hash: e70893dbc2791860fdb2a2ff2b207be93f1f3658ef46f0f28ce7575006bc1a0b
                                                        • Instruction Fuzzy Hash: 12512971500289EFCB11CFA8C988AEEBBB4AF49304F14449EE44A97241DB79DE85DB21
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041061C Relevance: 1.6, APIs: 1, Instructions: 132COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00410621
                                                          • Part of subcall function 004037A3: malloc.MSVCRT ref: 004037A9
                                                          • Part of subcall function 004037A3: _CxxThrowException.MSVCRT(?,0042ADB8), ref: 004037C3
                                                          • Part of subcall function 00410796: __EH_prolog.LIBCMT ref: 0041079B
                                                          • Part of subcall function 00401DD2: __EH_prolog.LIBCMT ref: 00401DD7
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ExceptionThrowfreemalloc
                                                        • String ID:
                                                        • API String ID: 2423332413-0
                                                        • Opcode ID: a954613b3d82cc8fb033a94acd9185855f41ce90ca8c53a386909de7527f66b2
                                                        • Instruction ID: 3b85c881d203977bc69432458ac5d98bf955e34f014c91172da33c47e33f2659
                                                        • Opcode Fuzzy Hash: a954613b3d82cc8fb033a94acd9185855f41ce90ca8c53a386909de7527f66b2
                                                        • Instruction Fuzzy Hash: E351C171900609DFDB10DFA5C484ADEBBB8FF04315F10856FE456A72A2CB78AA85CF94
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00414AA5 Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: 99712cbd33e31dac05251f74d319676c4e6390baf0a638770ff44b059c96101c
                                                        • Instruction ID: 552029b4768d972a129906a9c8c64a52ac1431164f9904389389ee61ef1d6d5c
                                                        • Opcode Fuzzy Hash: 99712cbd33e31dac05251f74d319676c4e6390baf0a638770ff44b059c96101c
                                                        • Instruction Fuzzy Hash: A8418C70A04245AFEB20CF54C484BAABBA0FF85354F1486AED4969B691D378FD81CB54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040C5F4 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: c08b20e7013d555ba87f8dd116745fd9f910892a6859f7b4d2d23fa9783b2bca
                                                        • Instruction ID: 583904894774956d4b3fb5c1082ff7eb5cbd37fd893ca73bede4da148d4cc618
                                                        • Opcode Fuzzy Hash: c08b20e7013d555ba87f8dd116745fd9f910892a6859f7b4d2d23fa9783b2bca
                                                        • Instruction Fuzzy Hash: 72218871A00B40DFD761DB348890AABBBA5BB44304F048E6FD0AA6B282D735A944CB58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040C444 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: d3377af9d3c3fd67c49305d5533f86dc5b3394d3bf07c208935e24b076201996
                                                        • Instruction ID: 8910e94f36f7f360606469f8d309af14774a7814c0f3447fb17b91f22564c557
                                                        • Opcode Fuzzy Hash: d3377af9d3c3fd67c49305d5533f86dc5b3394d3bf07c208935e24b076201996
                                                        • Instruction Fuzzy Hash: F6019EB1604254EFC705CFA9D890FAA7BA4FF96304F0982FAE0496F262C2799944CB50
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004148BE Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 004148C3
                                                          • Part of subcall function 004149D5: __EH_prolog.LIBCMT ref: 004149DA
                                                          • Part of subcall function 004147C6: __EH_prolog.LIBCMT ref: 004147CB
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                          • Part of subcall function 00414937: __EH_prolog.LIBCMT ref: 0041493C
                                                          • Part of subcall function 00414984: __EH_prolog.LIBCMT ref: 00414989
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$free
                                                        • String ID:
                                                        • API String ID: 2654054672-0
                                                        • Opcode ID: 263e201a91fa76b5a0e1653c40016715158c3681ca6aba287c1386b4be609558
                                                        • Instruction ID: a86b9e1bc3c87a4bb55966123adaa204e30c6fe5cdf6cc9eb33efd3d06c6dfdb
                                                        • Opcode Fuzzy Hash: 263e201a91fa76b5a0e1653c40016715158c3681ca6aba287c1386b4be609558
                                                        • Instruction Fuzzy Hash: AFF0D1B19206A4DADB19EB79D41239DBBA4AF41B18F10825FE052632C2CBBC1A00864C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041486D Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00414872
                                                          • Part of subcall function 004148BE: __EH_prolog.LIBCMT ref: 004148C3
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$free
                                                        • String ID:
                                                        • API String ID: 2654054672-0
                                                        • Opcode ID: 560d90fffe04fb0e41501aaeb1e596c59b374e68e23b40a2ff40d5f5a0ad24ba
                                                        • Instruction ID: 640201e87e403c72db8ee8d9d373b1e86c6ba4b561dce202e90f1f949cd7d07d
                                                        • Opcode Fuzzy Hash: 560d90fffe04fb0e41501aaeb1e596c59b374e68e23b40a2ff40d5f5a0ad24ba
                                                        • Instruction Fuzzy Hash: DAF0E9B6A102619BD714AF59D4817AAF3ACFF90B25F11403FE40567242CBB89C408558
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040B1A3 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: 331d043189ed6e7d5a4b77868b5dd12d7a22647f8b8c35adbc4e032a6f64c502
                                                        • Instruction ID: eef95feff7e0a15cdb7b0eb2280b2dde8bbce5866954a2f9a7a228cabdde798e
                                                        • Opcode Fuzzy Hash: 331d043189ed6e7d5a4b77868b5dd12d7a22647f8b8c35adbc4e032a6f64c502
                                                        • Instruction Fuzzy Hash: 9CF04F716142549FD704CF19D884FAB7BE8EB54350F0484BAE04AAB251C3B8A840CA68
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041564C Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: b8ce447a91c8edd073d56174d22c594b78d981abf7c7fee2743ab23fbd63ce55
                                                        • Instruction ID: 973fd701788d3982dfcb4fb81bedd3e4f422a6f886da1d1c429cd4fce3440abd
                                                        • Opcode Fuzzy Hash: b8ce447a91c8edd073d56174d22c594b78d981abf7c7fee2743ab23fbd63ce55
                                                        • Instruction Fuzzy Hash: 910128B1601BA1DBD725DFA9D4402CAFBE4FF14304F40885FD19A53741DBB86A08CB59
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405A57 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00405A5C
                                                          • Part of subcall function 004056A1: __EH_prolog.LIBCMT ref: 004056A6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: e2ce946864241e933434e75c2a9c82e3adc8e36edda23259430789be11d52733
                                                        • Instruction ID: bea9acdf35f8ed89d2a09b169b9f7f9a9ef7e565ee9cd4ce93c67f9308339309
                                                        • Opcode Fuzzy Hash: e2ce946864241e933434e75c2a9c82e3adc8e36edda23259430789be11d52733
                                                        • Instruction Fuzzy Hash: 9CF08272E514189ACB04EBA4E9527EEB375EF15349F54407FE802736D28B3A5E09CD18
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00414376 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0041437B
                                                          • Part of subcall function 0041486D: __EH_prolog.LIBCMT ref: 00414872
                                                          • Part of subcall function 0041481C: __EH_prolog.LIBCMT ref: 00414821
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: 012d5d640fd34816f8ec729aeb557c304faf0a31aacca742f697626f17f8e66e
                                                        • Instruction ID: c71081862bceb9289604e05ff88be2f6dc9be7f0b0684c79c0b4f30dada3a32f
                                                        • Opcode Fuzzy Hash: 012d5d640fd34816f8ec729aeb557c304faf0a31aacca742f697626f17f8e66e
                                                        • Instruction Fuzzy Hash: D2E0E531A00674CADB08FB69D4127DCB7A0DB44718F00475FA453632C1CBB81B40C684
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040F3D8 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: 3f84947364b3822f357f045ab1ee2a01a42a473cd84541aeee4fd20a5d104de8
                                                        • Instruction ID: 0924cd558ecb30be24fcd80a6b331db3d8b8c0fe1e897b5d971c31a6a50c5c53
                                                        • Opcode Fuzzy Hash: 3f84947364b3822f357f045ab1ee2a01a42a473cd84541aeee4fd20a5d104de8
                                                        • Instruction Fuzzy Hash: 57E06D35610164EFC700EF99E845F9AB7A8FF89314F11846EF40AA7241C7399A04CA68
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405AF9 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00405B32: FindCloseChangeNotification.KERNELBASE(00000013,00000014,00405B04,?,?,00405C3C,?,80000000,?,?,?,00405C5D,?,00000013,00000003,00000080), ref: 00405B3D
                                                        • CreateFileW.KERNELBASE(00000013,00000000,?,00000000,?,00000000,00000000,?,?,00405C3C,?,80000000,?,?,?,00405C5D), ref: 00405B1B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ChangeCloseCreateFileFindNotification
                                                        • String ID:
                                                        • API String ID: 727422849-0
                                                        • Opcode ID: 47320d605cd493d5f5696428e4f0454e2f46eb8b10b702834ca663083b246dd4
                                                        • Instruction ID: 7a33ec77a31c0888ec1bbd3e9306d402cbafb71dc62475442aefeab12b703c14
                                                        • Opcode Fuzzy Hash: 47320d605cd493d5f5696428e4f0454e2f46eb8b10b702834ca663083b246dd4
                                                        • Instruction Fuzzy Hash: FEE04F361402196BCF215F649C01FCF3B65EF09360F10012ABA15A61E0D672A861AB94
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405D0E Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405D31
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: FileWrite
                                                        • String ID:
                                                        • API String ID: 3934441357-0
                                                        • Opcode ID: b35605b5eb99d490dabe0951a4e70f72aea9156251606c9da61d16c27f9b9441
                                                        • Instruction ID: 3cbff045ab3ae3dfdff2a4da720bf6dcdb4848beae4d804ea6b6d897d6e2e849
                                                        • Opcode Fuzzy Hash: b35605b5eb99d490dabe0951a4e70f72aea9156251606c9da61d16c27f9b9441
                                                        • Instruction Fuzzy Hash: DAE06535600209FFCB10CF90C800B8E7BBAFB08314F20C02AF905AA260D739AA10DF18
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040A142 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040A147
                                                          • Part of subcall function 0040A181: __EH_prolog.LIBCMT ref: 0040A186
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID:
                                                        • API String ID: 3519838083-0
                                                        • Opcode ID: 8c6038902c255dfce833410c1ea372356eeb0781d5f73c67241a97a22f61f393
                                                        • Instruction ID: 2d40040240f100dee4f7d08491a9aa4de5b8ce178a9e1cdd34a241228dc0f570
                                                        • Opcode Fuzzy Hash: 8c6038902c255dfce833410c1ea372356eeb0781d5f73c67241a97a22f61f393
                                                        • Instruction Fuzzy Hash: 94D012B2F10214BBDB14AB49EC02B9EBB78EB81768F10452FF00176141C3B9590086A9
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405C6E Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00405C84
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: FileRead
                                                        • String ID:
                                                        • API String ID: 2738559852-0
                                                        • Opcode ID: 66fc8842ed788ecf39fef3a48f3bfcfbc988cecad42562cfd4adb6cd2054c710
                                                        • Instruction ID: eda9f1991e2ae2cd78296b86b99d56661c3f704055f6fc89ae9d9614d9ba1fef
                                                        • Opcode Fuzzy Hash: 66fc8842ed788ecf39fef3a48f3bfcfbc988cecad42562cfd4adb6cd2054c710
                                                        • Instruction Fuzzy Hash: 56E0EC75201208FBCB11CF90CC01F8E7BB9BB49754F208158E90596160C775AA15EB54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00418914 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00418919
                                                          • Part of subcall function 004037A3: malloc.MSVCRT ref: 004037A9
                                                          • Part of subcall function 004037A3: _CxxThrowException.MSVCRT(?,0042ADB8), ref: 004037C3
                                                          • Part of subcall function 0041564C: __EH_prolog.LIBCMT ref: 00415651
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ExceptionThrowmalloc
                                                        • String ID:
                                                        • API String ID: 3744649731-0
                                                        • Opcode ID: 9531d3ad05695158bf563937411df1a1a3ce316b502b06b9e7c3ba6fc224af45
                                                        • Instruction ID: b93d1dfec4622c6e2e489b7ee69963419343414ef63c905b960d06a1b8165fbe
                                                        • Opcode Fuzzy Hash: 9531d3ad05695158bf563937411df1a1a3ce316b502b06b9e7c3ba6fc224af45
                                                        • Instruction Fuzzy Hash: 11D017B9B105149ADB08AFB4A4523AD76A1AB84744F00843FA017E3B81DA784A408659
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040544D Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindClose.KERNELBASE(00000000,000000FF,0040547E), ref: 00405458
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CloseFind
                                                        • String ID:
                                                        • API String ID: 1863332320-0
                                                        • Opcode ID: 9691e53fe62326e4d8b3f0e7878d4c5958bbc3fba514a931d386f7da3c2c173f
                                                        • Instruction ID: ef5ea88625efcb4a6e2951744291c8ac3f570f271e47a5fbf37e6a96db5255ab
                                                        • Opcode Fuzzy Hash: 9691e53fe62326e4d8b3f0e7878d4c5958bbc3fba514a931d386f7da3c2c173f
                                                        • Instruction Fuzzy Hash: CAD0123110452146CA741E3CB844BC733D89A0233133A176AF4B4D32E0D7748CC75E98
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405B32 Relevance: 1.5, APIs: 1, Instructions: 16COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • FindCloseChangeNotification.KERNELBASE(00000013,00000014,00405B04,?,?,00405C3C,?,80000000,?,?,?,00405C5D,?,00000013,00000003,00000080), ref: 00405B3D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ChangeCloseFindNotification
                                                        • String ID:
                                                        • API String ID: 2591292051-0
                                                        • Opcode ID: bfdd660b3c656b15607db8ad926c72ca5ca00ff343a28ec43da57889e235151b
                                                        • Instruction ID: bd8da352974901f173512346cfd9ee4978e30e2640c012cf7db2b689a4a530ea
                                                        • Opcode Fuzzy Hash: bfdd660b3c656b15607db8ad926c72ca5ca00ff343a28ec43da57889e235151b
                                                        • Instruction Fuzzy Hash: 77D0C93110552146CA741E2C7C849C773A9AA12330325076AF1B5D32E0D674ECC75E58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00403A69 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs
                                                        • String ID:
                                                        • API String ID: 1795875747-0
                                                        • Opcode ID: 80af52d9b7bc06dcbbf54002b495038b83526ba4efccdcca95fb14c2298c52b3
                                                        • Instruction ID: 4ef36e03e7c24543542b0e2a19482b590eb381394620c21a189235e2a17dea60
                                                        • Opcode Fuzzy Hash: 80af52d9b7bc06dcbbf54002b495038b83526ba4efccdcca95fb14c2298c52b3
                                                        • Instruction Fuzzy Hash: 1AD0C73720C2109F92159F15E40589AFBA6EFD8331725442FF494532548F325856DA59
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00403990 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputc
                                                        • String ID:
                                                        • API String ID: 1992160199-0
                                                        • Opcode ID: 919f314c244d74bf91d926378c210586fdfaefdbe287bf64d2f5c4a624fd14c5
                                                        • Instruction ID: 8f84940b5316b51de09035f59959b7fd1ed1311a4fdcb2b7393ebea7a57267f4
                                                        • Opcode Fuzzy Hash: 919f314c244d74bf91d926378c210586fdfaefdbe287bf64d2f5c4a624fd14c5
                                                        • Instruction Fuzzy Hash: 98B092323092209BE6282B98BC0AAD4A794DB09772F21006FF584C21D09EA11C924A99
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405CF1 Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFileTime.KERNELBASE(?,00000000,00000000,00000000,0040C55E,00000000,00000000,00000000,00000000,00000000,?,?,?,0040C954,00000000,00000000), ref: 00405CFF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: FileTime
                                                        • String ID:
                                                        • API String ID: 1425588814-0
                                                        • Opcode ID: ad15994553f636a57397f2772e72b246ce1f55ca67e9f8333a608a443d19ad00
                                                        • Instruction ID: 797baa581f363386b64679bc46b5a71cf98aea6e6ed85f8cb939c9026e6a52a1
                                                        • Opcode Fuzzy Hash: ad15994553f636a57397f2772e72b246ce1f55ca67e9f8333a608a443d19ad00
                                                        • Instruction Fuzzy Hash: C0C04C36159106FF8F120F70CC04D1EBBA2AFA9311F10C91CB155C5070CB328024EB12
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004051F4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDirectoryW.KERNELBASE(?,00000000,00405319,00000000,?,?,?,00000001,00000000,?,?,?,0000000D,00000000,00000000,?), ref: 004051F7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectory
                                                        • String ID:
                                                        • API String ID: 4241100979-0
                                                        • Opcode ID: ca9d31b4e81423394ab8fb0c8ededbec758e2d1328d4f76fb7431a4a20fadbef
                                                        • Instruction ID: 672cd8c3e92edbca73a0de458e820969bc04331a9ccb1a21800036c319b823d5
                                                        • Opcode Fuzzy Hash: ca9d31b4e81423394ab8fb0c8ededbec758e2d1328d4f76fb7431a4a20fadbef
                                                        • Instruction Fuzzy Hash: 74A02230322300E3F2300B320E0AB0E200C2F00EC0F02802C3300C80E0CE28C020002C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004051B8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFileAttributesW.KERNELBASE ref: 004051BA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: AttributesFile
                                                        • String ID:
                                                        • API String ID: 3188754299-0
                                                        • Opcode ID: 87e48d17e8028f54008306098babb28c0f07281a65b557a8fc91215762601718
                                                        • Instruction ID: cf82eb47be69c849c71cc3919e9830514f645475ccb9f95a7f9f02b7ac50135c
                                                        • Opcode Fuzzy Hash: 87e48d17e8028f54008306098babb28c0f07281a65b557a8fc91215762601718
                                                        • Instruction Fuzzy Hash: 39A002A03126019BA6781B315F09A2F256DDDC1AD1746C56C7505C4060DE39C8555625
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405D8D Relevance: 1.5, APIs: 1, Instructions: 6fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetEndOfFile.KERNELBASE(?,00405DD2,00000000,00000000,00000000,?,?,?,?,0040C595,80004004,00000001,00000000,00000000,00000000,00000000), ref: 00405D8F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: File
                                                        • String ID:
                                                        • API String ID: 749574446-0
                                                        • Opcode ID: c488013f482738590fcb2581bc2d18853de299119ef46d00e9fca2f1526807ab
                                                        • Instruction ID: 9e5a9e50282ad54de402e3452a0dc437b9cb23ccf462931a75163dd88d6d7dfa
                                                        • Opcode Fuzzy Hash: c488013f482738590fcb2581bc2d18853de299119ef46d00e9fca2f1526807ab
                                                        • Instruction Fuzzy Hash: 89A001702A602A8A8E211B34D8098283AA2AB5260676116A8A006D94B4DE22445DAA09
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00407259 Relevance: 1.3, APIs: 1, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast
                                                        • String ID:
                                                        • API String ID: 1452528299-0
                                                        • Opcode ID: 0427bb7ba515d61b319b9d1fda8f8769c76a34243bdd147a4afbed953bbd53c6
                                                        • Instruction ID: 988c16da220169e6ef6f105b5deb58d9c47ed015f77633d9b2d2a43b63361427
                                                        • Opcode Fuzzy Hash: 0427bb7ba515d61b319b9d1fda8f8769c76a34243bdd147a4afbed953bbd53c6
                                                        • Instruction Fuzzy Hash: D9F08C31A092069BDB209F50DC409BB7768AF04300B1045BEBC06EA292C339F8119B6A
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00409BD8 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcpy
                                                        • String ID:
                                                        • API String ID: 3510742995-0
                                                        • Opcode ID: 4189fb6c018cee73b5d995e30f046d09d4a0d8b60a45362c8243bf2566f70bd5
                                                        • Instruction ID: 44b25b059e4b918a6ba6be5211d5158262b744de0a3db75889235b7b279e358f
                                                        • Opcode Fuzzy Hash: 4189fb6c018cee73b5d995e30f046d09d4a0d8b60a45362c8243bf2566f70bd5
                                                        • Instruction Fuzzy Hash: E4F089B66041119BE730AE59F880827F7DCEF80754310863FF495D3791E675DD458A54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00410D6E Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcpy
                                                        • String ID:
                                                        • API String ID: 3510742995-0
                                                        • Opcode ID: 502b162ccdbb0c16ed3e6f3dacb0343cd3964a309e176c7b2fcefcaeb568b282
                                                        • Instruction ID: 166af0f62a022340e536af8ea6a1ff39d19254eb8bf336e0e96ca5ff1f198d5b
                                                        • Opcode Fuzzy Hash: 502b162ccdbb0c16ed3e6f3dacb0343cd3964a309e176c7b2fcefcaeb568b282
                                                        • Instruction Fuzzy Hash: 71F0E2B66042008BE7306E69B881867B7DCEF80754320863FF499C3380EAB5AC818654
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C950 Relevance: 1.3, APIs: 1, Instructions: 17COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: malloc
                                                        • String ID:
                                                        • API String ID: 2803490479-0
                                                        • Opcode ID: de118f09b847e1562027d5a6c6ee29e18cde693c1f3f69c28c930e3c0f6e9393
                                                        • Instruction ID: 1b6f6f345e7d777cae290c70a65ccf08866d38c0f0e51a89c0271aadf068bf3c
                                                        • Opcode Fuzzy Hash: de118f09b847e1562027d5a6c6ee29e18cde693c1f3f69c28c930e3c0f6e9393
                                                        • Instruction Fuzzy Hash: B0D05BB125220247CF4446208D897A67A947B40302F58457BE417C6390EF1CD455868C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C8A0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00406F1D), ref: 0041C8B1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: AllocVirtual
                                                        • String ID:
                                                        • API String ID: 4275171209-0
                                                        • Opcode ID: 7ece892b87ce7ba128e9d8e23a74326773917f524fe2b8181408713723d4f042
                                                        • Instruction ID: ff301a00fdb0ef7a2e95589baa8368531e2e9b3f5d6872d8d1c9427e5accfeb5
                                                        • Opcode Fuzzy Hash: 7ece892b87ce7ba128e9d8e23a74326773917f524fe2b8181408713723d4f042
                                                        • Instruction Fuzzy Hash: AAB012F07D224035FEBC23214D8BFBB10415B84B47F40406CB70AD80C8EFD09440601C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C913 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualAlloc.KERNELBASE(00000000), ref: 0041C921
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: AllocVirtual
                                                        • String ID:
                                                        • API String ID: 4275171209-0
                                                        • Opcode ID: bbfbbfa757631c99b468015ddb0804069d774c2109e2a60e70e87cb72d48f1f5
                                                        • Instruction ID: bea2e34cf4fbd1632facdd870084ba49b18d91edda11e5af1d23cd4ae9814b92
                                                        • Opcode Fuzzy Hash: bbfbbfa757631c99b468015ddb0804069d774c2109e2a60e70e87cb72d48f1f5
                                                        • Instruction Fuzzy Hash: C5C08CE1A4E2809FDF0213108C407203B208B87300F4A00C5E8045B092C9400809C722
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C870 Relevance: 1.3, APIs: 1, Instructions: 8COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: malloc
                                                        • String ID:
                                                        • API String ID: 2803490479-0
                                                        • Opcode ID: f36ca31968bba1ec8462e0c5a02d8335bc8ab462facbfa9638c878268d5c7aa1
                                                        • Instruction ID: 1b52ae7ec21b4f38f92a42eef8f70826022ac020e78495fea42e145ea3dd2145
                                                        • Opcode Fuzzy Hash: f36ca31968bba1ec8462e0c5a02d8335bc8ab462facbfa9638c878268d5c7aa1
                                                        • Instruction Fuzzy Hash: 90B012F025210002EE2C23352C8816B31003A401077C0087CB402C0220FB1DC025900D
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C8E0 Relevance: 1.3, APIs: 1, Instructions: 8COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: malloc
                                                        • String ID:
                                                        • API String ID: 2803490479-0
                                                        • Opcode ID: 02c97b24239c525070a71bc9763d2ecdf7110bcdb093f8ef51b0ff7b80236f61
                                                        • Instruction ID: 168465cadd84184ed0dab8e5bbacbb6af7a90d5ae84f8facdd412a25438d04b5
                                                        • Opcode Fuzzy Hash: 02c97b24239c525070a71bc9763d2ecdf7110bcdb093f8ef51b0ff7b80236f61
                                                        • Instruction Fuzzy Hash: A6B012E8B0100042DA1423342CC816732227AD05077C4C878E402C0214FF2CC025700D
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C8C0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualFree.KERNELBASE(?,00000000,00008000,00406EF6), ref: 0041C8CC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: FreeVirtual
                                                        • String ID:
                                                        • API String ID: 1263568516-0
                                                        • Opcode ID: 8beb94d7b11f3665eb5093f61cb4e86fe6ed31662de4ba38aa8c6fc6cc30d8b8
                                                        • Instruction ID: 77b6e020dfde498b9d58c9d6ee674e3bea10fe2e60acb41d9255345eff955281
                                                        • Opcode Fuzzy Hash: 8beb94d7b11f3665eb5093f61cb4e86fe6ed31662de4ba38aa8c6fc6cc30d8b8
                                                        • Instruction Fuzzy Hash: 15B01130BC230022EE3823200C8AF3A20002B08B02FA0802C3202A88C88EA8A8088B0C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C980 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: free
                                                        • String ID:
                                                        • API String ID: 1294909896-0
                                                        • Opcode ID: b14154d528851836dd704736fa0892dda2df28aaf84b986ebf985d7eb90cb511
                                                        • Instruction ID: 5ce2d7a3655260e8d0dc5c122ea69923f9369c8508530d4ee43df0e66d35210f
                                                        • Opcode Fuzzy Hash: b14154d528851836dd704736fa0892dda2df28aaf84b986ebf985d7eb90cb511
                                                        • Instruction Fuzzy Hash: 03B012F5641001879A145B64984C46EF726A684301324C159B10287140CF3584514B14
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C933 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0041C93C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: FreeVirtual
                                                        • String ID:
                                                        • API String ID: 1263568516-0
                                                        • Opcode ID: 3be6ccdfc243d9c151825c65976e8df49aef1351f39b962692dd30251de9aca2
                                                        • Instruction ID: 2bacd54b90e801a1440af2ee64dd34e8f21f0b4c5e31a1f96f944f61c4eb892f
                                                        • Opcode Fuzzy Hash: 3be6ccdfc243d9c151825c65976e8df49aef1351f39b962692dd30251de9aca2
                                                        • Instruction Fuzzy Hash: E7A00278B8170076ED7067306D4FF6935247788F01F7185587241690D89DE460499A1C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004037CA Relevance: 1.3, APIs: 1, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: free
                                                        • String ID:
                                                        • API String ID: 1294909896-0
                                                        • Opcode ID: c52fd7ebed17e314a623280767b15e882d75057eca69dfd12fa51f7edd87a23e
                                                        • Instruction ID: 61ac0184b4dba91bdbd3926f5c8c3d56a66113ac57764540b0b6af1088dfde8a
                                                        • Opcode Fuzzy Hash: c52fd7ebed17e314a623280767b15e882d75057eca69dfd12fa51f7edd87a23e
                                                        • Instruction Fuzzy Hash: 44A00271106100DBDA151F10ED0945DBB61EB85612B60846DF047404B18F314832BA15
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C890 Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • free.MSVCRT(?,?,?,0041A9C8), ref: 0041C891
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: free
                                                        • String ID:
                                                        • API String ID: 1294909896-0
                                                        • Opcode ID: f9ee1422cb9ff64c29d5666f6da833b388a3b2cb0cf0192b39407cbcbe79167d
                                                        • Instruction ID: 82128f51c5469587e9fbb3258c3cf5459065f030af55c7ba8b1c1c50e55dd869
                                                        • Opcode Fuzzy Hash: f9ee1422cb9ff64c29d5666f6da833b388a3b2cb0cf0192b39407cbcbe79167d
                                                        • Instruction Fuzzy Hash:
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C900 Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: free
                                                        • String ID:
                                                        • API String ID: 1294909896-0
                                                        • Opcode ID: 1d1ee943331003fa219ffea8324907fd1f753d5f8bbfbce7251538b03f405fb6
                                                        • Instruction ID: 3c21b5ca0ff005351cb9410293f1a8187151abefd97148e970539c85d4e84344
                                                        • Opcode Fuzzy Hash: 1d1ee943331003fa219ffea8324907fd1f753d5f8bbfbce7251538b03f405fb6
                                                        • Instruction Fuzzy Hash:
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Non-executed Functions

                                                        Function 004067A8 Relevance: 4.7, APIs: 3, Instructions: 183timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004067B9
                                                        • FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 004067CB
                                                        • __aullrem.LIBCMT ref: 00406929
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: Time$File$LocalSystem__aullrem
                                                        • String ID:
                                                        • API String ID: 2417234408-0
                                                        • Opcode ID: 5dea30db2f2b3dd1b75a5f5dd8d3a25acdbbf405fcd486a770b1f257d388ec6a
                                                        • Instruction ID: e998ee2274747ede5f96b40a48939ace82dfa4ca0b1df681a011f804c1e1455c
                                                        • Opcode Fuzzy Hash: 5dea30db2f2b3dd1b75a5f5dd8d3a25acdbbf405fcd486a770b1f257d388ec6a
                                                        • Instruction Fuzzy Hash: 2751DAB2E05355DBD710CF5E94C02EEFBF6EF79214F25805AE884A3282D17A4D5AC720
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00423280 Relevance: 4.0, APIs: 3, Instructions: 230COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcpy
                                                        • String ID:
                                                        • API String ID: 3510742995-0
                                                        • Opcode ID: ef66daca7a5fa0140d94e17584f2fe67e7b8ff62176e69e7717a5f80e4dda4ac
                                                        • Instruction ID: e9d7844995b50d83a4ab56a57e2c3ff57a681ad2e87812d18023c2d431c6b09a
                                                        • Opcode Fuzzy Hash: ef66daca7a5fa0140d94e17584f2fe67e7b8ff62176e69e7717a5f80e4dda4ac
                                                        • Instruction Fuzzy Hash: 83916BB2A043108FC318DF59E48454BB7E1FFC8314F168A6EE9488B315E775EA55CB86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041D480 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: Version
                                                        • String ID:
                                                        • API String ID: 1889659487-0
                                                        • Opcode ID: 0bd751f6d801643199883313c6c072508cfe8a193922d58fbd472040f7f42777
                                                        • Instruction ID: 856834d0372d5a0ca8ee22ae81f3ad461db36e067057a64b331f9b754327c944
                                                        • Opcode Fuzzy Hash: 0bd751f6d801643199883313c6c072508cfe8a193922d58fbd472040f7f42777
                                                        • Instruction Fuzzy Hash: 1DE0D8B29111414BDB20EB15C9017EA73F4BF50748F84097DD499C1140F63DE74CC60A
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00406A50 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00406A3D: GetCurrentProcess.KERNEL32(?,?,00406A5E), ref: 00406A42
                                                          • Part of subcall function 00406A3D: GetProcessAffinityMask.KERNEL32(00000000), ref: 00406A49
                                                        • GetSystemInfo.KERNEL32(?), ref: 00406A74
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: Process$AffinityCurrentInfoMaskSystem
                                                        • String ID:
                                                        • API String ID: 3251479945-0
                                                        • Opcode ID: 0f05fe357f0bdd49d0acccb78e61c6935a99e115a698a10a41c170b2db7325b6
                                                        • Instruction ID: bb3d7a0456f2e95a14d1767d8127dcb3eef2e66dc54343a6ce1e6789a7131b1c
                                                        • Opcode Fuzzy Hash: 0f05fe357f0bdd49d0acccb78e61c6935a99e115a698a10a41c170b2db7325b6
                                                        • Instruction Fuzzy Hash: 29D01270B0010997CF04FBA9D846D9E77B86E45248F05807DD503B21D0DA78D9598A54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004210E0 Relevance: .7, Instructions: 744COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterEventLeaveObjectSingleWait
                                                        • String ID:
                                                        • API String ID: 4060455350-0
                                                        • Opcode ID: 9760a33737c7d4a2264723312696b484cd7224082d8e3c960d6dad2f0df48a90
                                                        • Instruction ID: e5fff7b26c712b1fc43e66f2e3d8864a70ad782d09e28810483009e41834b2ac
                                                        • Opcode Fuzzy Hash: 9760a33737c7d4a2264723312696b484cd7224082d8e3c960d6dad2f0df48a90
                                                        • Instruction Fuzzy Hash: 1A6225B1A083548FCB24DF19D48062BBBE6BFE8300F944A6EE88997325D774D845CB46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041F756 Relevance: .5, Instructions: 516COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5e2a2f0d0f42b76f4f6b833c13a8ac4c9f948a915a86b73f9f3c18f8ea78656a
                                                        • Instruction ID: 08449cf11c31f1e24529a0f2330ba3d3c1def4d7ff40bd6ee155746aabe4615d
                                                        • Opcode Fuzzy Hash: 5e2a2f0d0f42b76f4f6b833c13a8ac4c9f948a915a86b73f9f3c18f8ea78656a
                                                        • Instruction Fuzzy Hash: 33020B73A0835147D714CE1ACD80269B7E3FBD1390F6A453FE89647384EBB4998AC789
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041FE90 Relevance: .5, Instructions: 480COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b5ab2d6071ba4f626031de446fa0850a734d69f202f19f46ab4dd51ed20a1283
                                                        • Instruction ID: 259261935ec077bf66ad7b749915d1d1834027e6e476f2c271cab9a1397889a7
                                                        • Opcode Fuzzy Hash: b5ab2d6071ba4f626031de446fa0850a734d69f202f19f46ab4dd51ed20a1283
                                                        • Instruction Fuzzy Hash: FC023C32B043218BD708CE28D58027DBBE2FBC5354F150A3FE89697695D778D889CB99
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00423960 Relevance: .3, Instructions: 298COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b8ae21fe19404f09b553bfcb81c8815050cbb5fbc60d721e018f90cd84ddfe6b
                                                        • Instruction ID: 7e89a8ef22cba2eca4b95bab1f669e89f32143bc248b6ad91ca80d04779b5aae
                                                        • Opcode Fuzzy Hash: b8ae21fe19404f09b553bfcb81c8815050cbb5fbc60d721e018f90cd84ddfe6b
                                                        • Instruction Fuzzy Hash: B3D1E53594436A4FE364EF4DEC80636B762AB98310FDA8238CE500B367DA747617D794
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00423E50 Relevance: .3, Instructions: 297COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4cdef12e5df257d6af740b3d1cbed8d8f55a905a355b62c3fa52cece28b650c5
                                                        • Instruction ID: f56b4f165b7013a334677357bae30f900fcbcf1020f00894b717df4ac43542d2
                                                        • Opcode Fuzzy Hash: 4cdef12e5df257d6af740b3d1cbed8d8f55a905a355b62c3fa52cece28b650c5
                                                        • Instruction Fuzzy Hash: F6D1BD378846A74FE358DF58EC80225B7A3ABD8300F5F5278CA5417362C634BA12DBD4
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00423070 Relevance: .2, Instructions: 174COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7e0d127709ee668109e51070201b8e695745d1fe8b4e81e202ba05253f976c90
                                                        • Instruction ID: 313f2ba4c7f6edcb4ee020aa9c9ce980c5b5e59824f43539e9bb5f97d99ce2af
                                                        • Opcode Fuzzy Hash: 7e0d127709ee668109e51070201b8e695745d1fe8b4e81e202ba05253f976c90
                                                        • Instruction Fuzzy Hash: 5E717CB1A083158FC348DF49E48895AF3E1FFC8318F198A6DE9888B311D771E955CB86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041CFE0 Relevance: .1, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b31d452cf4fc038398579975b7917bb1ff375609163340ad82824380036c8528
                                                        • Instruction ID: df4581f2cc3d61296ceb472eed4aea0abc9bcc631b06dc3ed900bbadf355b0b0
                                                        • Opcode Fuzzy Hash: b31d452cf4fc038398579975b7917bb1ff375609163340ad82824380036c8528
                                                        • Instruction Fuzzy Hash: 974138B3E042254BC714CD2889942BAFFD1ABD9318F09876FC59647342D225998AC7D5
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041C5C0 Relevance: .1, Instructions: 141COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2b06a8d549a831c4b5a41d0c087bda45bf86eae81219ec44899320217db4703f
                                                        • Instruction ID: 21f679d12ce7e890aa5e025f99e6199fb5301d10792486d579a8076aa4bf3c49
                                                        • Opcode Fuzzy Hash: 2b06a8d549a831c4b5a41d0c087bda45bf86eae81219ec44899320217db4703f
                                                        • Instruction Fuzzy Hash: BF41D371B50A300AB30CCF36AC851663BD3D7C939AB85D33DC565CA6D8DABDC01786A8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004026E4 Relevance: .1, Instructions: 97COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e0e7f00835656da3a91f54ad77faf7c3cbb403921593c70d372a380c1a5b659a
                                                        • Instruction ID: d894eec15eb7715a2c0a206a960b6cb533621c2cf28211687da2276db8ed9247
                                                        • Opcode Fuzzy Hash: e0e7f00835656da3a91f54ad77faf7c3cbb403921593c70d372a380c1a5b659a
                                                        • Instruction Fuzzy Hash: 38314136AA0D264BD74C8A28EC33AB96290E745345F89527EE95BCB3D1DB6C8801C64C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004237A0 Relevance: .1, Instructions: 95COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d360edd5cc82e7167ffb446b2969223921e0c0d74698a4b4a91943d25bece7ec
                                                        • Instruction ID: b1876963a80642ae86d6cf0ecc097951b95bd2f8b449035e4dd502daa8eb715a
                                                        • Opcode Fuzzy Hash: d360edd5cc82e7167ffb446b2969223921e0c0d74698a4b4a91943d25bece7ec
                                                        • Instruction Fuzzy Hash: 08316EB1F047B607E3109E1E8C40122BBE3EFC5216F9CC67AD8D44B74ADE39D5528695
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00424EC3 Relevance: .1, Instructions: 92COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
                                                        • Instruction ID: adfa0b6a13fea12c79c5cd38da9badc93b4d012fd43d1322d57e6ca577e156fc
                                                        • Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
                                                        • Instruction Fuzzy Hash: E641F360814F9653EB234F7CD842272B320BFAB204F01D71AFCC179922FB3265406265
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00425051 Relevance: .1, Instructions: 70COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
                                                        • Instruction ID: 5ddf9fd4100cef2ea561338a210d18db8467d2116c8d928f0b6d9544e0276e26
                                                        • Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
                                                        • Instruction Fuzzy Hash: 6321B332D00A354BCB12CE6EF4846A7F391FBC436AF574627ED8467291C639A85486E0
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0042512B Relevance: .1, Instructions: 70COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
                                                        • Instruction ID: a248e0037d324c10f0fe2a7e4b559d3e9c5598172f6c7f12a45381970357e155
                                                        • Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
                                                        • Instruction Fuzzy Hash: BF21F572A148358BC711DE1DF488777B3E1FFD4319FA78A2AD9818B180C638D855D6A0
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00416D53 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 452COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 00416D58
                                                          • Part of subcall function 00416582: _CxxThrowException.MSVCRT(?,0042D4B0), ref: 004165A5
                                                        • memcpy.MSVCRT ref: 0041714A
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 004171E6
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 004171FA
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041720E
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00417222
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00417236
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041724A
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041725E
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00417272
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00417286
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041729A
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 004172AE
                                                          • Part of subcall function 004163AB: _CxxThrowException.MSVCRT(?,0042D470), ref: 004163BE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrow$H_prologmemcpy
                                                        • String ID: $!$@
                                                        • API String ID: 3273695820-2517134481
                                                        • Opcode ID: b168f2d5cff06a6e4020442f29f5bd43d5f3262e47cc5ccad2db342413ffe99f
                                                        • Instruction ID: 982a508303cc7e68f555d01ca972226438054dc2197d77ad60deb649b4d44127
                                                        • Opcode Fuzzy Hash: b168f2d5cff06a6e4020442f29f5bd43d5f3262e47cc5ccad2db342413ffe99f
                                                        • Instruction Fuzzy Hash: 07124B74E05259AFCF14DFA5D580AEEBBB1BF49304F14845EE405AB352CB38E981CB68
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041D600 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 81librarystringloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetVersionExW.KERNEL32 ref: 0041D615
                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0041D638
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041D63F
                                                        • GetSystemDirectoryW.KERNEL32(?,00000106), ref: 0041D665
                                                        • lstrlenW.KERNEL32(?), ref: 0041D686
                                                        • lstrcatW.KERNEL32(?,.dll), ref: 0041D6F7
                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0041D705
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersionlstrcatlstrlen
                                                        • String ID: .dll$SetDefaultDllDirectories$\$\$kernel32.dll
                                                        • API String ID: 532070074-471922092
                                                        • Opcode ID: 5aae9bf2d87ec6153b52b47cf3a7de87e4fc068abfbd4439466db804991f2d54
                                                        • Instruction ID: 2acc77b02dc6d3b1add6d778d2b90f74a2b068aa6e92e666a1559a7a6a4131f8
                                                        • Opcode Fuzzy Hash: 5aae9bf2d87ec6153b52b47cf3a7de87e4fc068abfbd4439466db804991f2d54
                                                        • Instruction Fuzzy Hash: C821F671A453445BD730AF60EC04BDB77E8AF59300F40482ED6C5D32D0DA78D589CB6A
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041149D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$H_prolog$fputcfree
                                                        • String ID: Modified: $Path: $Size:
                                                        • API String ID: 2632947726-3207571042
                                                        • Opcode ID: a68092769a9aae788842e78e3d40260a5c543b463235b95a4164e9598615cf38
                                                        • Instruction ID: a170b6dede9aeab9aa7e0196e0c7bdc5338789f720a8344cd416b229052e587b
                                                        • Opcode Fuzzy Hash: a68092769a9aae788842e78e3d40260a5c543b463235b95a4164e9598615cf38
                                                        • Instruction Fuzzy Hash: 5521C430A00115ABCF01AFA6DCC6AAEBF76EF84314F84402BF505662A1DB3949A1DF84
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00407809 Relevance: 16.4, APIs: 13, Instructions: 196COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcmp
                                                        • String ID:
                                                        • API String ID: 1475443563-0
                                                        • Opcode ID: 13acb86bedb7d98b84cf4a622ee7d9bd4c6d320b3c9453161771159e9262c885
                                                        • Instruction ID: 5ea991012d41a97fcabccdc0425b69d01392a864a5755d2c472601d2d69bb899
                                                        • Opcode Fuzzy Hash: 13acb86bedb7d98b84cf4a622ee7d9bd4c6d320b3c9453161771159e9262c885
                                                        • Instruction Fuzzy Hash: 9251C9F6F14625ABE7106A11EC41E67739CDF25748B10442AFC46B7285F738FE01CA9A
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004129AB Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs
                                                        • String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
                                                        • API String ID: 1795875747-2741933734
                                                        • Opcode ID: f45ef5cfbbe5b1c34989e875e34ea7361584a85d0d04d92986c8f4d9d3cd7caa
                                                        • Instruction ID: 0d035b3d201cb159c9fa90c12b93efeae36084e799b8ba686e148e9abda419b8
                                                        • Opcode Fuzzy Hash: f45ef5cfbbe5b1c34989e875e34ea7361584a85d0d04d92986c8f4d9d3cd7caa
                                                        • Instruction Fuzzy Hash: 37F02771B042243BDA10676ABC81E2EBF99DFC43A4F60006FF50453281EF790C208ABC
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00411324 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Would you like to replace the existing file:, xrefs: 00411378
                                                        • with the file from archive:, xrefs: 0041139D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CriticalSectionfputs$EnterH_prologLeave
                                                        • String ID: Would you like to replace the existing file:$with the file from archive:
                                                        • API String ID: 3914623533-686978020
                                                        • Opcode ID: 022747d2890da1c971f644c6f974187fc771ba8c41f592b5c2c75c058c2881f8
                                                        • Instruction ID: e9bbce6047421b7a885fec7600417f6539489d9e96e0dc542c041fe8e8413ac9
                                                        • Opcode Fuzzy Hash: 022747d2890da1c971f644c6f974187fc771ba8c41f592b5c2c75c058c2881f8
                                                        • Instruction Fuzzy Hash: 3131AF752002049BDB11EF15E840BEE77A1EF48715F11416FEA2A673A1CB38AC82CF1D
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405514 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 0040553A
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00405543
                                                        • GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 00405550
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00405553
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: AddressHandleModuleProc
                                                        • String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
                                                        • API String ID: 1646373207-4044117955
                                                        • Opcode ID: 18b086e5d7dbce3f229567c9880b779331ac8d10aa986f9641f721ecd79f2975
                                                        • Instruction ID: 97fc79b8a015cf7f5701211520a6c278ebf5be7a5064a128bf2dc8bdf3965dc9
                                                        • Opcode Fuzzy Hash: 18b086e5d7dbce3f229567c9880b779331ac8d10aa986f9641f721ecd79f2975
                                                        • Instruction Fuzzy Hash: B1E04872B4222CB7C61477AA7C44D2BBB6DE5863913D5057FB501E3150CEBD58054B7C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00402405 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 134COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
                                                        • API String ID: 3519838083-2104980125
                                                        • Opcode ID: 32b6315ffbdd9e23fd7de7b29fc442ee96aad140783d429d970ed5510e5a9a6d
                                                        • Instruction ID: 7e5caefeaf811d065eb2ee40189154a27ad38de1a0446f663f62ddfe259787c7
                                                        • Opcode Fuzzy Hash: 32b6315ffbdd9e23fd7de7b29fc442ee96aad140783d429d970ed5510e5a9a6d
                                                        • Instruction Fuzzy Hash: 1651C130600256DBCF24CF14CA98AAEBBA1BF51308F54806FE4557B2D2C7B8EA41CB59
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004118F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CriticalSectionfputs$EnterH_prologLeave
                                                        • String ID: :
                                                        • API String ID: 3914623533-3653984579
                                                        • Opcode ID: b1c77f9935d18bf6c50d2145cc413cf0e09ebe0a9c3936c39dd3590dab713079
                                                        • Instruction ID: 182099874497cdaabf3c9a145962085029a2e670fcd4c946abf5231c6aab9aef
                                                        • Opcode Fuzzy Hash: b1c77f9935d18bf6c50d2145cc413cf0e09ebe0a9c3936c39dd3590dab713079
                                                        • Instruction Fuzzy Hash: BF31BA71A01205CFD710EF65D890EDABBB4FF44318F50816FE56A97262CB38A845CF18
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00411CC6 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prologfputs
                                                        • String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
                                                        • API String ID: 1798449854-3393983761
                                                        • Opcode ID: 3db57e95f6a6d4eb1cf3a7eea71424bbd4e4418033fbc9a3a06f687746c7355b
                                                        • Instruction ID: 0a8cdd271b0aae80c8454c45dc21b1e598a1239f22e138a64498e5d9c9a46a49
                                                        • Opcode Fuzzy Hash: 3db57e95f6a6d4eb1cf3a7eea71424bbd4e4418033fbc9a3a06f687746c7355b
                                                        • Instruction Fuzzy Hash: 3A21A4317006109FCB04EF65E482AEEB7B8EF44315F40402FE206A7291DB38AD428B99
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00413552 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • fputs.MSVCRT ref: 0041356D
                                                          • Part of subcall function 00403981: fflush.MSVCRT ref: 00403983
                                                        • GetStdHandle.KERNEL32(000000F6), ref: 0041357F
                                                        • GetConsoleMode.KERNEL32(00000000,00000000), ref: 004135A1
                                                        • SetConsoleMode.KERNEL32(00000000,00000000), ref: 004135B2
                                                        • SetConsoleMode.KERNEL32(00000000,00000000), ref: 004135D2
                                                        Strings
                                                        • Enter password (will not be echoed):, xrefs: 00413568
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ConsoleMode$Handlefflushfputs
                                                        • String ID: Enter password (will not be echoed):
                                                        • API String ID: 108775803-3720017889
                                                        • Opcode ID: c80ffebf4eac9e82c2aa5e0df8741d70502cbc7093927eb2050bf57b1910f6d5
                                                        • Instruction ID: f789a8b6cd9f824140e925c4c4f529cc38a2776624a553cfd3a7fdab2821e802
                                                        • Opcode Fuzzy Hash: c80ffebf4eac9e82c2aa5e0df8741d70502cbc7093927eb2050bf57b1910f6d5
                                                        • Instruction Fuzzy Hash: CD110432E00114BBCB11AFA598006EEBFB99F40B25F4441AFE810A22D0CF384A468B6C
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041D5A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetVersionExW.KERNEL32 ref: 0041D5BA
                                                        • GetVersionExW.KERNEL32(?), ref: 0041D5C1
                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0041D5E1
                                                        • GetProcAddress.KERNEL32(00000000), ref: 0041D5E8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: Version$AddressHandleModuleProc
                                                        • String ID: SetDefaultDllDirectories$kernel32.dll
                                                        • API String ID: 2268189529-2102062458
                                                        • Opcode ID: 02086f7657dbf715527f55e583ce4244473b76f0a9a913735fd833cb517044ca
                                                        • Instruction ID: c5185c692c3b6c800dc5d7f5b059f8d2957cc9700fc20b98ad92f6daba44a2a9
                                                        • Opcode Fuzzy Hash: 02086f7657dbf715527f55e583ce4244473b76f0a9a913735fd833cb517044ca
                                                        • Instruction Fuzzy Hash: C4F08271A05215BBDB24ABA0DC05FDF77E86B44B44F84442EB605C2140DF78C548CB76
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00416871 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 226COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00416582: _CxxThrowException.MSVCRT(?,0042D4B0), ref: 004165A5
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 0041689E
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 004169FA
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00416A0E
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00416A4F
                                                        • _CxxThrowException.MSVCRT(?,0042D4B0), ref: 00416AB7
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ExceptionThrow$free
                                                        • String ID:
                                                        • API String ID: 3129652135-3916222277
                                                        • Opcode ID: a5b2185e69632106be79dd85b1901c8dc657d14d4a9e56ceee76de9c985fb3ef
                                                        • Instruction ID: 4827aa2554ea340318f766630c021437a3cff2601665bf6aabb0a408a75b93fe
                                                        • Opcode Fuzzy Hash: a5b2185e69632106be79dd85b1901c8dc657d14d4a9e56ceee76de9c985fb3ef
                                                        • Instruction Fuzzy Hash: 6A919075E002189FCF10EFA9C4915EEBBB5AF49354F11845FE855AB341C738EA81CBA8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00403CB4 Relevance: 7.6, APIs: 5, Instructions: 98COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WideCharToMultiByte.KERNEL32(0042F240,00000000,FFFFFFFF,?,00000000,00000000,00000000,00000000,?,FFFFFFFF,00000000,FFFFFFFF,?,0042F240,00000000), ref: 00403CEC
                                                        • GetLastError.KERNEL32(?,FFFFFFFF,00000000,FFFFFFFF,?,0042F240,00000000), ref: 00403CF5
                                                        • _CxxThrowException.MSVCRT(0042F240,0042AD80), ref: 00403D13
                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,FFFFFFFF,?,?,?,00000001,00000001,?,FFFFFFFF,00000000,FFFFFFFF,?), ref: 00403D7A
                                                        • _CxxThrowException.MSVCRT(0000FDE9,0042AD80), ref: 00403DA2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                        • String ID:
                                                        • API String ID: 2296236218-0
                                                        • Opcode ID: 59ef10335b2cafab2ef163a7fdd8a65ac65dab946b7332ef5c9d889983856b79
                                                        • Instruction ID: c2e235e430b18c6157505500583a35a0e5e6c15d9d2ee19b9475b9c6a88e8161
                                                        • Opcode Fuzzy Hash: 59ef10335b2cafab2ef163a7fdd8a65ac65dab946b7332ef5c9d889983856b79
                                                        • Instruction Fuzzy Hash: 0D31CE71604245BFDB11CFA5CC40BAEBFB9EF45305F10816AE444E7280D778AE45CBA5
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004095B3 Relevance: 7.6, APIs: 6, Instructions: 83COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcmp
                                                        • String ID:
                                                        • API String ID: 1475443563-0
                                                        • Opcode ID: 82323b94b8b76ce3ffa154315a7c081165ebb7c2b74050140655e2745615ca35
                                                        • Instruction ID: e0be3be53ab99926b449432c735983b507af0aaf990496e6ae4a75f3e5b52bf0
                                                        • Opcode Fuzzy Hash: 82323b94b8b76ce3ffa154315a7c081165ebb7c2b74050140655e2745615ca35
                                                        • Instruction Fuzzy Hash: 5C21C2767502056BD7046A21FC81F7B77ACDBA1398F14443EFC45AA287FA39DD008AA9
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041288C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs$H_prolog
                                                        • String ID: =
                                                        • API String ID: 2614055831-2525689732
                                                        • Opcode ID: d4aa81a4540378bda5fb0e6db3a567b671c3e2b53b2fe8214b6d5343e0e23783
                                                        • Instruction ID: 3fc716c4a004be6427406230b4e8211a1ae2c233ce92a94ff372b7e86cee40ef
                                                        • Opcode Fuzzy Hash: d4aa81a4540378bda5fb0e6db3a567b671c3e2b53b2fe8214b6d5343e0e23783
                                                        • Instruction Fuzzy Hash: B121C272910018EBDF05EBA5E9828EEBBB9EF48714F10402FF00572191DB791E51CA99
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00407109 Relevance: 6.3, APIs: 5, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcmp
                                                        • String ID:
                                                        • API String ID: 1475443563-0
                                                        • Opcode ID: c997fda2a64a1d72c5c2ee896d0ab429abf44bebcfdb446b6d02990195c7eb68
                                                        • Instruction ID: 0e05757d2f5ee22ae1aedb9e114e3a873e8da87e8b1e5457ebb50485b2af4e20
                                                        • Opcode Fuzzy Hash: c997fda2a64a1d72c5c2ee896d0ab429abf44bebcfdb446b6d02990195c7eb68
                                                        • Instruction Fuzzy Hash: 0C112231B54304B7C7109A10EC02FAA73A4ABA5744F14443EFC85AE3C6F6BCF9518A8E
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00403BFF Relevance: 6.3, APIs: 5, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 00403C2B
                                                        • GetLastError.KERNEL32(?,?,00000000,00000000), ref: 00403C34
                                                        • _CxxThrowException.MSVCRT(?,0042AD80), ref: 00403C4E
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00403C73
                                                        • _CxxThrowException.MSVCRT(?,0042AD80), ref: 00403C89
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                        • String ID:
                                                        • API String ID: 2296236218-0
                                                        • Opcode ID: 954a9d79a0d59bf87bed4278bae6c613e6559ba2f4b1f7c0440f0483baaeed45
                                                        • Instruction ID: 26d10ca535ba0e5b46467bea644d72690ab0903e9feb13d63257aaf45388c0f6
                                                        • Opcode Fuzzy Hash: 954a9d79a0d59bf87bed4278bae6c613e6559ba2f4b1f7c0440f0483baaeed45
                                                        • Instruction Fuzzy Hash: CF114FB5200205BFE710DF55DC85E6BBBEDFF84384750812AE949E7240DB74AE418BA8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0041176A Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0041176F
                                                        • EnterCriticalSection.KERNEL32(0042F4A8), ref: 00411781
                                                        • fputs.MSVCRT ref: 004117D1
                                                          • Part of subcall function 004039A3: __EH_prolog.LIBCMT ref: 004039A8
                                                          • Part of subcall function 004039A3: fputs.MSVCRT ref: 00403A1B
                                                          • Part of subcall function 00403990: fputc.MSVCRT ref: 00403997
                                                          • Part of subcall function 00403981: fflush.MSVCRT ref: 00403983
                                                        • LeaveCriticalSection.KERNEL32(0042F4A8), ref: 004117FD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: CriticalH_prologSectionfputs$EnterLeavefflushfputc
                                                        • String ID:
                                                        • API String ID: 84800229-0
                                                        • Opcode ID: 00dd02711c164c9cbb146e307205d740061475f216acb73489e56aa7139902b2
                                                        • Instruction ID: 8b5d60d48a12ee701a283095cd0ccfb1f8fbfae4b5752995e8df0029ec429919
                                                        • Opcode Fuzzy Hash: 00dd02711c164c9cbb146e307205d740061475f216acb73489e56aa7139902b2
                                                        • Instruction Fuzzy Hash: C811C2716016009FC711AF25DC88AEFF7B5FF84315F40842FE56A93251DB395C458A58
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00405561 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0040544D: FindClose.KERNELBASE(00000000,000000FF,0040547E), ref: 00405458
                                                        • SetLastError.KERNEL32(00000078), ref: 00405581
                                                        • SetLastError.KERNEL32(00000000), ref: 0040558B
                                                        • FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 0040559F
                                                        • GetLastError.KERNEL32 ref: 004055AC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Find$CloseFirstStream
                                                        • String ID:
                                                        • API String ID: 4071060300-0
                                                        • Opcode ID: d211c5179e88532d8a0f821622e92749b9da263950e60b04d78a5c6b09dd684a
                                                        • Instruction ID: 86db30dbc39a0a14c3e4a2bc17df5696e577af755ed5f585bb24003b5a867090
                                                        • Opcode Fuzzy Hash: d211c5179e88532d8a0f821622e92749b9da263950e60b04d78a5c6b09dd684a
                                                        • Instruction Fuzzy Hash: 88F0D130101905EAEB306F209C0D7AF3766DB51325F60027AE651B61E4DAB89D8A8F6D
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040EFE5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID: Unknown error$Unknown warning
                                                        • API String ID: 3519838083-4291957651
                                                        • Opcode ID: 44bbc97f7a0a2fc37b36b03478756f578608b107ab6c7cfac8aae82911c0dd24
                                                        • Instruction ID: 5be20054d16ab211f3882221717299151f2cdcbd96741a014e97c21427024bc4
                                                        • Opcode Fuzzy Hash: 44bbc97f7a0a2fc37b36b03478756f578608b107ab6c7cfac8aae82911c0dd24
                                                        • Instruction Fuzzy Hash: 5C913875900209DBCB24DFA5C980AEEB7F5BF48304F50857EE45AB7680D735AE08CB59
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040468D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: wcscmp
                                                        • String ID: UNC
                                                        • API String ID: 3392835482-337201128
                                                        • Opcode ID: b5aabad713cd02544d88958cd17c5f0eaff086d28500130f9d91b81d27f1d193
                                                        • Instruction ID: daec6cd8be646fe8a847c953e792fde85df3886729e33734560273c8b270eb56
                                                        • Opcode Fuzzy Hash: b5aabad713cd02544d88958cd17c5f0eaff086d28500130f9d91b81d27f1d193
                                                        • Instruction Fuzzy Hash: 5D213DB93012009FC624DE18D994E26B3E1AFC6311765847BEB45AB3E1DB79EC42CB48
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004130A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: __aulldivstrlen
                                                        • String ID: M
                                                        • API String ID: 1892184250-3664761504
                                                        • Opcode ID: 963e01ac7556bda713abe2343c221af4728090dda8ff5e086f36dabb7ee02393
                                                        • Instruction ID: 96ff981e7e136640dff2a5364039f4e3f9a450f7d6477712d90b45256ab904f3
                                                        • Opcode Fuzzy Hash: 963e01ac7556bda713abe2343c221af4728090dda8ff5e086f36dabb7ee02393
                                                        • Instruction Fuzzy Hash: 64113B323003446BDB11DAB5D946FEF7BE9DF88314F24482EF242A71C1C979AD458728
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00411BCB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog
                                                        • String ID: 0$x
                                                        • API String ID: 3519838083-1948001322
                                                        • Opcode ID: 0eff7990574357c7be01d7da26ea37365ff0e76c407358ba64084ac93443aee6
                                                        • Instruction ID: 4dc3ee89cf4e83645d4c87e9fa2f4f3e1759f6c051276bf16c021f5b326d7f71
                                                        • Opcode Fuzzy Hash: 0eff7990574357c7be01d7da26ea37365ff0e76c407358ba64084ac93443aee6
                                                        • Instruction Fuzzy Hash: BF219F32D001299BCF04EB95DA86AEEB7B5EF48304F50042FE50173281DBB95E44CBA8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040B563 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __EH_prolog.LIBCMT ref: 0040B568
                                                        • GetLastError.KERNEL32(00000001,?,?,?,0040C954,00000000,00000000), ref: 0040B574
                                                          • Part of subcall function 0040506F: __EH_prolog.LIBCMT ref: 00405074
                                                          • Part of subcall function 004037CA: free.MSVCRT(?,004026D0,00000000,00000000,759A8E30,?,00402292), ref: 004037CE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: H_prolog$ErrorLastfree
                                                        • String ID: :
                                                        • API String ID: 683690243-3653984579
                                                        • Opcode ID: c108e28d58350fd4567d003565cf25e3759dc129477f083c99efd4e1581673c2
                                                        • Instruction ID: 4fa77bc6a655dcf8369158b5fdd90b862e1992fb4b0fe47aa1d04685ceb99e9e
                                                        • Opcode Fuzzy Hash: c108e28d58350fd4567d003565cf25e3759dc129477f083c99efd4e1581673c2
                                                        • Instruction Fuzzy Hash: 2101E572900108EBCB05EFA4D806ADEBF75AF54319F10806EF401B7292CB388A05CBA4
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00412A6A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • Can not open encrypted archive. Wrong password?, xrefs: 00412A7D
                                                        • Can not open the file as archive, xrefs: 00412AB5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs
                                                        • String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
                                                        • API String ID: 1795875747-2399861261
                                                        • Opcode ID: f3386266902f4bba8867f5498a7db446838a986a95456f9f32c8796b896ebbc8
                                                        • Instruction ID: e32c004ab909db79445e0421d3991b44e12f60c3e5fd9de130ea3bb5054605fe
                                                        • Opcode Fuzzy Hash: f3386266902f4bba8867f5498a7db446838a986a95456f9f32c8796b896ebbc8
                                                        • Instruction Fuzzy Hash: 4701A2313046009BC628EB56C595ABEB7DBAFC8309F58441FE44287681DBF8A8A1CB59
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 004126C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: fputs
                                                        • String ID: =
                                                        • API String ID: 1795875747-2525689732
                                                        • Opcode ID: 742d250424bdcd72d126bec01ec24a05c07ab17161a990ab9714649a05975869
                                                        • Instruction ID: 51659f4adaac74a25377e73e800957444db91cd691f361700eb3cb954c23ede0
                                                        • Opcode Fuzzy Hash: 742d250424bdcd72d126bec01ec24a05c07ab17161a990ab9714649a05975869
                                                        • Instruction Fuzzy Hash: 1DE09231B0011D579F00E7A99D458FF3B29FA80250B900866E510D7280EA75D8628BD8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00410851 Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcmp
                                                        • String ID:
                                                        • API String ID: 1475443563-0
                                                        • Opcode ID: 057d11b95cf4321e8b9916c89345417690c05dec58c530f8207ca5f5fec3dfcc
                                                        • Instruction ID: 586a4b98d1162a05b214739467297328bb86cbb26f8838191b85362c22aae130
                                                        • Opcode Fuzzy Hash: 057d11b95cf4321e8b9916c89345417690c05dec58c530f8207ca5f5fec3dfcc
                                                        • Instruction Fuzzy Hash: EA110431B54304A7C7146A11EC02FFAB3A49B95714F14852FFD45AB282EAFCE9D09ACD
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 0040AE85 Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcmp
                                                        • String ID:
                                                        • API String ID: 1475443563-0
                                                        • Opcode ID: 0c258da87dd527b1cf8f5d9fa2502f9fbfa7d261c7fd82be46f1786a2d6ba632
                                                        • Instruction ID: 115eaa9c911986f1d60138197bae2cbddcd5be613ed6835fd9f5ef0f4071d489
                                                        • Opcode Fuzzy Hash: 0c258da87dd527b1cf8f5d9fa2502f9fbfa7d261c7fd82be46f1786a2d6ba632
                                                        • Instruction Fuzzy Hash: 741104317903016BC7149A11EC02FAA73A49BD5715F04443EFD05AF2C6FABCE9609ADA
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Function 00401BB2 Relevance: 5.1, APIs: 4, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1686131801.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                        • Associated: 00000000.00000002.1686117924.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686153957.0000000000428000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686167874.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1686183062.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                        Similarity
                                                        • API ID: memcmp
                                                        • String ID:
                                                        • API String ID: 1475443563-0
                                                        • Opcode ID: eaa27b0e79d746d40794000e4ef6b8c9027f00387ef63c0e06011a28d210fe27
                                                        • Instruction ID: 963aa47464e5c1028658e469e65334dfe26e6614c9d7c9f4716e2a999f9a9a8d
                                                        • Opcode Fuzzy Hash: eaa27b0e79d746d40794000e4ef6b8c9027f00387ef63c0e06011a28d210fe27
                                                        • Instruction Fuzzy Hash: 3D01443179030467D7145A11AC42FBA73A88BA5B04F04043EFC45EA292F6BCE8109A8D
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%