Edit tour

Windows Analysis Report
CuteWriter.exe

Overview

General Information

Sample name:	CuteWriter.exe
Analysis ID:	1427639
MD5:	4ba5a70c0123a687edd954946156c04f
SHA1:	09536c4652e9af34ef91d675991cddb749dc57ec
SHA256:	72561349751266c51f2d48b6dd42f94148a90f4c678de0f5db9f5ae431e12649
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Compliance

Score:	36
Range:	0 - 100

Signatures

Found direct / indirect Syscall (likely to bypass EDR)

Installs a global event hook (focus changed)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML page contains hidden URLs or javascript code

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

CuteWriter.exe (PID: 6852 cmdline: "C:\Users\user\Desktop\CuteWriter.exe" MD5: 4BA5A70C0123A687EDD954946156C04F)

CuteWriter.tmp (PID: 4632 cmdline: "C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp" /SL5="$20446,5944588,56832,C:\Users\user\Desktop\CuteWriter.exe" MD5: FFCF263A020AA7794015AF0EDEE5DF0B)

Setup.exe (PID: 6500 cmdline: "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe" /inscpw4 -d"C:\Program Files (x86)\CutePDF Writer" MD5: A8EFE2A017079497FE948191F8904A17)

converter.exe (PID: 2416 cmdline: C:\Users\user\AppData\Local\Temp\\converter.exe /auto MD5: BF9F58A65F6954406E6DCD29BB458A19)

unInstcpw64.exe (PID: 2652 cmdline: unInstcpw64.exe /copy MD5: 7B17AE1C9AED3C8C89FF6CDEF68F9FD5)

splwow64.exe (PID: 6904 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

chrome.exe (PID: 5224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.cutepdf-editor.com/support/writer.asp MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1640,i,13590044467732800076,8352524087445346693,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

OperaSetup.exe (PID: 2520 cmdline: "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --silent --allusers=0 MD5: 3C51B6EED283BBE7D10772DDE9BFFFB7)

OperaSetup.exe (PID: 7228 cmdline: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c1821c8,0x6c1821d4,0x6c1821e0 MD5: 3C51B6EED283BBE7D10772DDE9BFFFB7)

OperaSetup.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version MD5: 3C51B6EED283BBE7D10772DDE9BFFFB7)

OperaSetup.exe (PID: 7716 cmdline: "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2520 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240417224118" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000 MD5: 3C51B6EED283BBE7D10772DDE9BFFFB7)

OperaSetup.exe (PID: 7756 cmdline: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x300,0x304,0x308,0x2c8,0x30c,0x6b5d21c8,0x6b5d21d4,0x6b5d21e0 MD5: 3C51B6EED283BBE7D10772DDE9BFFFB7)

installer.exe (PID: 7120 cmdline: "C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe" --backend --initial-pid=2520 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --install-subfolder=109.0.5097.45 MD5: 053ADC8C34F1ECB38BCA1C6832DD27AC)

installer.exe (PID: 6156 cmdline: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x278,0x27c,0x280,0x274,0x250,0x7ffdf9937c80,0x7ffdf9937c8c,0x7ffdf9937c98 MD5: 053ADC8C34F1ECB38BCA1C6832DD27AC)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

assistant_installer.exe (PID: 5828 cmdline: "C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0 MD5: 976BC8E5FE65F9BB56831E20F1747150)

assistant_installer.exe (PID: 5428 cmdline: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x210,0x208,0x234,0x20c,0x238,0x1126038,0x1126044,0x1126050 MD5: 976BC8E5FE65F9BB56831E20F1747150)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 3468 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 4412 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 1740 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 5756 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 5844 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 3808 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 3684 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

assistant_installer.exe (PID: 3748 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0 MD5: 976BC8E5FE65F9BB56831E20F1747150)

assistant_installer.exe (PID: 2032 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x9a6038,0x9a6044,0x9a6050 MD5: 976BC8E5FE65F9BB56831E20F1747150)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 4928 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 3244 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 3568 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WJViQqIQpkJHwwlXNjpzvf.exe (PID: 4108 cmdline: "C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

Assistant_109.0.5097.45_Setup.exe_sfx.exe (PID: 7668 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe" MD5: 15D8C8F36CEF095A67D156969ECDB896)

assistant_installer.exe (PID: 744 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --version MD5: 976BC8E5FE65F9BB56831E20F1747150)

assistant_installer.exe (PID: 5284 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x9a6038,0x9a6044,0x9a6050 MD5: 976BC8E5FE65F9BB56831E20F1747150)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe, ProcessId: 3748, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Browser Assistant

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\opera.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe

Phishing

HTML page contains hidden URLs or javascript code

Source: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=600&slotname=8138180617&adk=373269726&adf=126291155&pi=t.ma~as.8138180617&w=160&lmt=1713386480&format=160x600&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479208&bpp=1&bdt=1018&idt=1057&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=867&ady=420&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&f...

HTTP Parser: Base64 decoded: MM0BUB-BYBgBcBshgFGAIiAQA\u0026sigh=C_gINU4rE7s\u0026cid=CAQSTwB7FLtqKM23G5I1wz6Pkbawvciq7zXz_J1cS84W8zSH3oX03n5AlaH3iLKFL2sQyeuRUbG3mpem6x_M7eqs-9YvcmDHeSVx3fwCjmf6xkc",[null,null,null,"https://displayads-formats.googleusercontent.com/ads/preview/content...

Source: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=600&slotname=8138180617&adk=373269726&adf=126291155&pi=t.ma~as.8138180617&w=160&lmt=1713386480&format=160x600&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479208&bpp=1&bdt=1018&idt=1057&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=867&ady=420&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&f...	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=280&slotname=4387574616&adk=1818151991&adf=1925678805&pi=t.ma~as.4387574616&w=336&lmt=1713386480&format=336x280&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479209&bpp=1&bdt=1019&idt=1068&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90%2C160x600&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=464&ady=1814&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&...	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=90&slotname=6092711011&adk=1854165047&adf=3987798746&pi=t.ma~as.6092711011&w=728&lmt=1713386480&format=728x90&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479204&bpp=4&bdt=1014&idt=1034&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&correlator=464567931983&frm=20&pv=2&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=268&ady=144&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0...	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=90&slotname=6092711011&adk=1854165047&adf=3987798746&pi=t.ma~as.6092711011&w=728&lmt=1713386480&format=728x90&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479204&bpp=4&bdt=1014&idt=1034&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&correlator=464567931983&frm=20&pv=2&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=268&ady=144&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0...	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-1-&adk=1812271803&client=ca-pub-6555658820068848&fa=3&ifi=7&uci=a!7&btvi=2	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-2-&adk=1812271804&client=ca-pub-6555658820068848&fa=4&ifi=8&uci=a!8&btvi=3	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-2-&adk=1812271804&client=ca-pub-6555658820068848&fa=4&ifi=8&uci=a!8&btvi=3	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-2-&adk=1812271804&client=ca-pub-6555658820068848&fa=4&ifi=8&uci=a!8&btvi=3	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-0-&adk=1812271808&client=ca-pub-6555658820068848&fa=8&ifi=6&uci=a!6	HTTP Parser: No favicon
Source: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html	HTTP Parser: No favicon
Source: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-3-&adk=1812271801&client=ca-pub-6555658820068848&fa=1&ifi=9&uci=a!9&btvi=4	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon

Bitcoin Miner

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION browser_assistant.exe

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\opera.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	EXE: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe

Uses 32bit PE files

Source: CuteWriter.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CutePDF Writer Copyright by Acro Software Inc. All rights reserved.This license applies to the CutePDF Writer ("The Software"). CutePDF Writer is free software. By using copying transmitting distributing or installing CutePDF Writer you agree to all of the terms of this agreement ("License").Please read the license terms below. If you do not agree to any of the terms of this License then do not use copy transmit distribute or install The Software.Scope of LicenseThis is free software. Subject to the terms below you are hereby licensed by Acro Software Inc. ("ASI") to use The Software on computer or workstation without charge. Free CutePDF Writer is available for volume distribution beyond a single-user installation. Without making any payment to ASI: a) You may give exact copies of The Software personally to anyone. b) Corporations and organizations may distribute exact copies of The Software on a company intranet site or local network. c) Commercial vendors may bundle exact copies of The Software on physical media such as a CD or DVD or on OEM hardware such as computers. d) You may make as many exact copies of The Software as you wish for purposes of distribution as described in (a) (b) and (c) above.You are specifically prohibited from charging advertising or requesting donations for any copies however made and from distributing such copies with other products of any kind commercial or otherwise without prior written permission from ASI. ASI reserves the right to revoke the above distribution rights at any time for any or no reason.Except as otherwise pre-approved by ASI in writing you shall not distribute The Software from a Website other than an ASI Site.No Modification No Reverse Engineering. You shall not modify adapt translate or create derivative works based upon The Software in any way including without limitation removal of the installer program electronic end user license agreement or any copyright or other proprietary notice that appears in The Software. This software and all accompanying files data and materials are distributed "AS IS". ASI does not warrant that the operation of the Software will meet your requirements or operate free from error. ASI DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS EITHER EXPRESS OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. This disclaimer of warranty constitutes an essential part of the agreement. In no event shall ASI or its principals shareholders officers employees affiliates contractors subsidiaries or parent organizations be liable for any incidental consequential or punitive damages whatsoever relating to the use of The Software or your relationship with ASI.This License shall be go
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CutePDF Writer Copyright by Acro Software Inc. All rights reserved.This license applies to the CutePDF Writer ("The Software"). CutePDF Writer is free software. By using copying transmitting distributing or installing CutePDF Writer you agree to all of the terms of this agreement ("License").Please read the license terms below. If you do not agree to any of the terms of this License then do not use copy transmit distribute or install The Software.Scope of LicenseThis is free software. Subject to the terms below you are hereby licensed by Acro Software Inc. ("ASI") to use The Software on computer or workstation without charge. Free CutePDF Writer is available for volume distribution beyond a single-user installation. Without making any payment to ASI: a) You may give exact copies of The Software personally to anyone. b) Corporations and organizations may distribute exact copies of The Software on a company intranet site or local network. c) Commercial vendors may bundle exact copies of The Software on physical media such as a CD or DVD or on OEM hardware such as computers. d) You may make as many exact copies of The Software as you wish for purposes of distribution as described in (a) (b) and (c) above.You are specifically prohibited from charging advertising or requesting donations for any copies however made and from distributing such copies with other products of any kind commercial or otherwise without prior written permission from ASI. ASI reserves the right to revoke the above distribution rights at any time for any or no reason.Except as otherwise pre-approved by ASI in writing you shall not distribute The Software from a Website other than an ASI Site.No Modification No Reverse Engineering. You shall not modify adapt translate or create derivative works based upon The Software in any way including without limitation removal of the installer program electronic end user license agreement or any copyright or other proprietary notice that appears in The Software. This software and all accompanying files data and materials are distributed "AS IS". ASI does not warrant that the operation of the Software will meet your requirements or operate free from error. ASI DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS EITHER EXPRESS OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. This disclaimer of warranty constitutes an essential part of the agreement. In no event shall ASI or its principals shareholders officers employees affiliates contractors subsidiaries or parent organizations be liable for any incidental consequential or punitive damages whatsoever relating to the use of The Software or your relationship with ASI.This License shall be go
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CutePDF Writer Copyright by Acro Software Inc. All rights reserved.This license applies to the CutePDF Writer ("The Software"). CutePDF Writer is free software. By using copying transmitting distributing or installing CutePDF Writer you agree to all of the terms of this agreement ("License").Please read the license terms below. If you do not agree to any of the terms of this License then do not use copy transmit distribute or install The Software.Scope of LicenseThis is free software. Subject to the terms below you are hereby licensed by Acro Software Inc. ("ASI") to use The Software on computer or workstation without charge. Free CutePDF Writer is available for volume distribution beyond a single-user installation. Without making any payment to ASI: a) You may give exact copies of The Software personally to anyone. b) Corporations and organizations may distribute exact copies of The Software on a company intranet site or local network. c) Commercial vendors may bundle exact copies of The Software on physical media such as a CD or DVD or on OEM hardware such as computers. d) You may make as many exact copies of The Software as you wish for purposes of distribution as described in (a) (b) and (c) above.You are specifically prohibited from charging advertising or requesting donations for any copies however made and from distributing such copies with other products of any kind commercial or otherwise without prior written permission from ASI. ASI reserves the right to revoke the above distribution rights at any time for any or no reason.Except as otherwise pre-approved by ASI in writing you shall not distribute The Software from a Website other than an ASI Site.No Modification No Reverse Engineering. You shall not modify adapt translate or create derivative works based upon The Software in any way including without limitation removal of the installer program electronic end user license agreement or any copyright or other proprietary notice that appears in The Software. This software and all accompanying files data and materials are distributed "AS IS". ASI does not warrant that the operation of the Software will meet your requirements or operate free from error. ASI DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS EITHER EXPRESS OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. This disclaimer of warranty constitutes an essential part of the agreement. In no event shall ASI or its principals shareholders officers employees affiliates contractors subsidiaries or parent organizations be liable for any incidental consequential or punitive damages whatsoever relating to the use of The Software or your relationship with ASI.This License shall be go

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CutePDF Writer Installation

Jump to behavior

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224117808.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224119169.log
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224144.log
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224221297.log
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224227.log
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224228.log

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.js.LICENSE.txt

PE / OLE file has a valid certificate

Source: CuteWriter.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: CuteWriter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: ps5ui.pdbH source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _lib.dll.pdb@+ source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000000.2079178927.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000000.2087433669.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000000.2093874178.0000000000917000.00000080.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000000.2099132850.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp
Source:	Binary string: pscript5.pdb source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.00000000006B1000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.0000000000171000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: _lib.dll.pdb source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000000.2079178927.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000000.2087433669.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000000.2093874178.0000000000917000.00000080.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000000.2099132850.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb@+ source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: ps5ui.pdb source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: .pdb.dbg source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: pscript5.pdbH source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: .pdb@ source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000000.2079178927.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000000.2087433669.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000000.2093874178.0000000000917000.00000080.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000000.2099132850.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb@ source: OperaSetup.exe, 0000000A.00000002.2957530474.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.00000000006B1000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.0000000000171000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: dbghelp.pdb source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: \Unknown exceptionbad array new length.pdbSymbols loaded successfully. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp

Spreading

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00452AD4 FindFirstFileA,GetLastError,	1_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00498FDC
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	1_2_00475798
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_00403285 GlobalAlloc,FindFirstFileA,lstrcpyA,FindClose,	6_2_00403285
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_004010A3 FindFirstFileA,FindClose,	6_2_004010A3
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_00403DAF lstrlenA,lstrcpyA,lstrcatA,FindFirstFileA,GetTickCount,lstrcpyA,lstrcatA,RemoveDirectoryA,GetTickCount,GetTickCount,FindNextFileA,FindClose,RemoveDirectoryA,MessageBoxA,	6_2_00403DAF
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Code function: 7_2_00401140 lstrcpyA,strrchr,FindFirstFileA,lstrcpyA,lstrcatA,DeleteFileA,FindNextFileA,FindClose,	7_2_00401140

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\	Jump to behavior

Software Vulnerabilities

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe

Code function: 4x nop then lea rdx, qword ptr [rsp+00000270h]

7_2_00401140

Networking

Source: OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: frame-src https://www.youtube.com https://player.vimeo.com https://vimeo.com; worker-src 'none'; frame-ancestors 'none'; img-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com data: https://secure.gravatar.com https://www.gravatar.com https://i1.wp.com https://i.ytimg.com https://i.vimeocdn.com https://www.google-analytics.com https://forums.opera.com; base-uri 'self'; form-action 'self' https://forums.opera.com; default-src 'none'; script-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com 'report-sample' https://www.google-analytics.com 'nonce-tZczxVGjzT7YCkdhmrwTUg=='; font-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com https://fonts.gstatic.com; block-all-mixed-content; media-src https://addons-media.operacdn.com/media/; connect-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com https://sentry-relay.opera-api.com https://www.google-analytics.com https://www.opera.com https://forums.opera.com; style-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com; report-uri https://sentry-relay.opera-api.com/api/170/security/?sentry_key=8718908c4bc211ed9f0d161f2d7f9658 equals www.youtube.com (Youtube)
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: style-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com; block-all-mixed-content; connect-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com https://sentry-relay.opera-api.com https://www.google-analytics.com https://www.opera.com https://forums.opera.com; media-src https://addons-media.operacdn.com/media/; frame-ancestors 'none'; script-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com 'report-sample' https://www.google-analytics.com; font-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com https://fonts.gstatic.com; frame-src https://www.youtube.com https://player.vimeo.com https://vimeo.com; default-src 'none'; img-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com data: https://secure.gravatar.com https://www.gravatar.com https:// equals www.youtube.com (Youtube)
Source: OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policystyle-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com; block-all-mixed-content; connect-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com https://sentry-relay.opera-api.com https://www.google-analytics.com https://www.opera.com https://forums.opera.com; media-src https://addons-media.operacdn.com/media/; frame-ancestors 'none'; script-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com 'report-sample' https://www.google-analytics.com; font-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com https://fonts.gstatic.com; frame-src https://www.youtube.com https://player.vimeo.com https://vimeo.com; default-src 'none'; img-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com data: https://secure.gravatar.com https://www.gravatar.com https://i1.wp.com https://i.ytimg.com https://i.vimeocdn.com https://www.google-analytics.com https://forums.opera.com; worker-src 'none'; base-uri 'self'; form-action 'self' https://forums.opera.com; report-uri https://sentry-relay.opera-api.com/api/170/security/?sentry_key=8718908c4bc211ed9f0d161f2d7f9658 equals www.youtube.com (Youtube)
Source: OperaSetup.exe	String found in binary or memory: hatsapp.com/legal; and c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/l equals www.facebook.com (Facebook)
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.3021530576.00000C44002C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: onts.gstatic.com; frame-src https://www.youtube.com https://player.vimeo.com https://vimeo.com; default-src 'none'; img-src 'self' https://addons-static.operacdn.com https://addons-media.operacdn.com data: https://secure.gravatar.com https://www.gravatar.cm) equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.3049193326.00000C4401788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: chrome.exe, 00000009.00000002.3016981278.00000C440000C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000009.00000002.3023531674.00000C44003B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498ange
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502c
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901b
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901q
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000009.00000002.3028266221.00000C44007BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375xE
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000009.00000002.3024244660.00000C4400480000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: OperaSetup.exe	String found in binary or memory: http://autoupdate-staging.services.ams.osa/
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1876450342.0000000000546000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341396918.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.000000000131F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.2051296710.0000000000527000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1876450342.0000000000546000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000052A000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331950671.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2341267748.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.000000000131F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1876450342.0000000000546000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341396918.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.000000000131F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe, 00000003.00000003.1876450342.0000000000546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digih
Source: Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: chrome.exe, 00000009.00000002.3019018901.00000C4400134000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3018416414.00000C44000E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5H
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFUTGhWQUViMUVl
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pa
Source: chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx349.1/
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihi
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebndkojlmppeemjh
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocm
Source: chrome.exe, 00000009.00000002.3019622614.00000C440018C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.567854667.14/ob
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/awbwhkldc27ygywhstypg77e7m_8679/hfnkpimlhhgieaddgfemj
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/gonpemdgkjcecd
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/e7xo23p2hym36lpmqsgqlzfmwe_3026/jflookgnkcckhobaglndi
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/fpkk4dndblzegbba53f5uoxbqm_927/efniojlnjndmcbiieegkic
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/kiabhabjdbkjdp
Source: chrome.exe, 00000009.00000002.3043956038.00000C440129C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnf
Source: chrome.exe, 00000009.00000002.3049873467.00000C440180C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: Setup.exe, Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://download.acrosoftware.com/download/converter.asp?V=P1
Source: Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://download.acrosoftware.com/download/converter.asp?V=P1http://download.cutepdf.com/download/con
Source: Setup.exe, Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://download.cutepdf.com/download/converter.asp?V=P1
Source: Setup.exe, Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000003.2051296710.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000050E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.cutepdf.com/download/converter2.asp
Source: Setup.exe, 00000003.00000003.2051296710.0000000000527000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000052A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.cutepdf.com/download/converter2.aspDR
Source: Setup.exe, 00000003.00000003.2051296710.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.cutepdf.com/download/converter2.aspf/
Source: Setup.exe, 00000003.00000002.2051877549.000000000050E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.cutepdf.com/download/converter2.aspz
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.cutepdf.com/download/gplgs.exe
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.cutepdf.com/download/gplgs.exe71
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01u
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/
Source: chrome.exe, 00000009.00000002.3048290210.00000C4401658000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_
Source: chrome.exe, 00000009.00000002.3039431558.00000C4400F8C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebnd
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjk
Source: chrome.exe, 00000009.00000002.3019147771.00000C440014C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.567
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/awbwhkldc27ygywhstypg77e7m_8679/hfnkpimlh
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3025052042.00000C4400520000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/go
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e7xo23p2hym36lpmqsgqlzfmwe_3026/jflookgnk
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fpkk4dndblzegbba53f5uoxbqm_927/efniojlnjn
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbog
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/ki
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.120
Source: chrome.exe, 00000009.00000002.3017425933.00000C440008E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.2051296710.0000000000527000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1876450342.0000000000546000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000052A000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331950671.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2341267748.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.000000000131F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1876450342.0000000000546000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341396918.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.000000000131F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2979424734.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314883688.0000000056B54000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHF
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946
Source: chrome.exe, 00000009.00000002.3048290210.00000C4401658000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000009.00000002.3030946393.00000C4400998000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000009.00000002.3031153629.00000C44009BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000009.00000002.3031153629.00000C44009BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: CuteWriter.tmp, 00000001.00000003.2102555707.0000000002128000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.CutePDF.com
Source: Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.CutePDF.comCutePDF
Source: Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.CutePDF.comInstallLocationDisplayIconPublisherAcro
Source: converter.exe, 00000006.00000002.2140275800.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.artifex.com
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1875230195.0000000002017000.00000004.00000020.00020000.00000000.sdmp, unInstcpw64.exe, 00000007.00000002.2046563842.000000000054B000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFUTGhWQUVi
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-L
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebndkojlmppe
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkk
Source: chrome.exe, 00000009.00000002.3019622614.00000C440018C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.567854667.1
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/awbwhkldc27ygywhstypg77e7m_8679/hfnkpimlhhgieaddg
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/gonpemdgkj
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/e7xo23p2hym36lpmqsgqlzfmwe_3026/jflookgnkcckhobag
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/fpkk4dndblzegbba53f5uoxbqm_927/efniojlnjndmcbiiee
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindgg
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhl
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/kiabhabjdb
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkeh
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: CuteWriter.tmp, CuteWriter.tmp, 00000001.00000000.1652728046.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: CuteWriter.exe, CuteWriter.exe, 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: CuteWriter.exe, 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: OperaSetup.exe, 0000000A.00000003.2372451614.0000000056B64000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2314908527.0000000056B64000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opera.com
Source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2103201578.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2092734124.0000000003998000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.000000000131F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.opera.com0
Source: OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opera.com3
Source: CuteWriter.exe, 00000000.00000003.1652232868.0000000002164000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.exe, 00000000.00000003.1651757759.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, CuteWriter.tmp, 00000001.00000000.1652728046.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: CuteWriter.exe, 00000000.00000003.1652232868.0000000002164000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.exe, 00000000.00000003.1651757759.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000000.1652728046.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: converter.exe, 00000006.00000003.2134893707.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, converter.exe, 00000006.00000003.2134308527.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, converter.exe, 00000006.00000002.2140720937.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winzip.co
Source: converter.exe, 00000006.00000002.2140720937.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winzip.com
Source: converter.exe, 00000006.00000003.2134893707.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, converter.exe, 00000006.00000003.2134308527.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, converter.exe, 00000006.00000002.2140720937.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winzip.comCan
Source: converter.exe, 00000006.00000003.2134893707.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, converter.exe, 00000006.00000003.2134308527.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, converter.exe, 00000006.00000002.2140720937.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winzip.comThis
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000009.00000002.3023531674.00000C44003B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000009.00000002.3016981278.00000C440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000009.00000002.3018041209.00000C44000A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000009.00000002.3018041209.00000C44000A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000009.00000002.3018041209.00000C44000A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000009.00000002.3023531674.00000C44003B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comD
Source: chrome.exe, 00000009.00000002.3050037957.00000C4401824000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ad.oub
Source: OperaSetup.exe, 0000000A.00000003.2857456190.000000000130E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/
Source: OperaSetup.exe, 0000000A.00000003.2857456190.000000000130E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/J
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crx
Source: OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crx.
Source: OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crx2
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crxL
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crxid
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crxt
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crxy
Source: OperaSetup.exe, 0000000A.00000003.2857456190.000000000130E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-media.oper3)
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-media.operacdn.com
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-media.operacdn.com/media/;
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-media.operacdn.com;
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons-static.operacdn.com
Source: OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com
Source: OperaSetup.exe, 0000000A.00000003.2857546430.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com/
Source: OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
Source: OperaSetup.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.com
Source: OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857546430.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f/
Source: OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4fionKeyBackward
Source: OperaSetup.exe, 0000000A.00000002.2991912952.0000000056AEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4ftro.crx=cpdf_so
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com/toupdate=1&ni=1
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000009.00000002.3023531674.00000C44003B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3023531674.00000C44003B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847&
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000009.00000003.2817042856.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857546430.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera&version=108.0.5067.20
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857546430.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera&version=108.0.5067.20g
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/geolocation/
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/geolocation/d
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.geo.opera.com/geolocation/OperaDesktophttps://cr
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/m
Source: OperaSetup.exe, 0000000A.00000003.2341396918.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857546430.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.00000000012E3000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115240271.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64
Source: OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64m
Source: chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000009.00000002.3033023389.00000C4400BA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000009.00000002.3033023389.00000C4400BA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000009.00000002.3032496198.00000C4400B28000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000009.00000002.3017788001.00000C4400098000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000009.00000002.3017788001.00000C4400098000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000009.00000002.3030946393.00000C4400998000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000009.00000002.3016981278.00000C440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000009.00000002.3030653605.00000C4400978000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033023389.00000C4400BA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000009.00000002.3033023389.00000C4400BA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en106243
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreD
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000009.00000002.3067338151.0000136400794000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000009.00000002.3067338151.0000136400794000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(TrustTokenOperationsRequiringOriginTrial#all-operat
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000009.00000002.3016981278.00000C440000C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000009.00000002.3038193857.00000C4400EE8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000009.00000002.3027382750.00000C44006FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3016981278.00000C440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3018287237.00000C44000D0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033023389.00000C4400BA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3027670428.00000C4400752000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000009.00000002.2982827483.0000003CBE7FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxD
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C91000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://convertgetpdf.com
Source: chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://convertgetpdf.com%22
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C91000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://convertwithwave.com
Source: chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://convertwithwave.com%22
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://crashpad.chromium.org/
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: OperaSetup.exe, 0000000D.00000002.2974456633.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000003.2106095274.000000003E4D0000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit
Source: OperaSetup.exe, 00000010.00000002.2921561634.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit--annotation=channel=Stable--annotation=plat=
Source: OperaSetup.exe, 0000000D.00000002.2982947605.000000002E054000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit--monitor-self-annotation=ptype=crashpad-hand
Source: OperaSetup.exe, 0000000D.00000002.2983148512.000000002E05C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit.
Source: OperaSetup.exe, 0000000D.00000002.2982008055.000000002E024000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit0x2e4
Source: OperaSetup.exe, 0000000D.00000002.2982008055.000000002E024000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submitC:
Source: OperaSetup.exe, 0000000D.00000002.2984835399.000000002E0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submithttps://crashstats-collector.opera.com/collec
Source: chrome.exe, 00000009.00000002.3038482090.00000C4400F08000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E40D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E40D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3038482090.00000C4400F08000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1d
Source: chrome.exe, 00000009.00000002.3033684276.00000C4400C18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1tD
Source: chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other
Source: chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/otherCross-Origin-Opener-Policy:
Source: chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/otherr
Source: chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/otherrj
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E40D000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/mysidia
Source: chrome.exe, 00000009.00000002.3027866508.00000C440075C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061776441.00000C4402B64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3048397770.00000C440166C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha/1
Source: chrome.exe, 00000009.00000002.3061776441.00000C4402B64000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha/1D
Source: chrome.exe, 00000009.00000002.3048397770.00000C440166C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha/1L
Source: chrome.exe, 00000009.00000002.3062280169.00000C4402BCC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha/1X-Content-Type-Options:
Source: chrome.exe, 00000009.00000002.3060493740.00000C44028E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3048397770.00000C440166C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha/1e
Source: chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/recaptcha/1eon
Source: chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/other
Source: chrome.exe, 00000009.00000002.3062280169.00000C4402BCC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/recaptcha
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E40D000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059530326.00000C4402754000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/static-on-bigtable
Source: chrome.exe, 00000009.00000002.3044361567.00000C44012E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/static-on-bigtable;
Source: chrome.exe, 00000009.00000002.3062085612.00000C4402BA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/static-on-bigtableoD
Source: chrome.exe, 00000009.00000002.3044056261.00000C44012B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3006803549.000001A620C80000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.com
Source: chrome.exe, 00000009.00000002.3030653605.00000C4400978000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045870949.00000C440150C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050250427.00000C4401850000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3037731272.00000C4400EA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3048884177.00000C4401744000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058302574.00000C44021B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3044361567.00000C44012E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058165434.00000C4402194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3055414776.00000C4401EE4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058227837.00000C44021B0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059452971.00000C4402740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3028266221.00000C44007BC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059712235.00000C4402788000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039327853.00000C4400F7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/.js
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/2
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/2019
Source: chrome.exe, 00000009.00000002.3037731272.00000C4400EA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/h
Source: chrome.exe, 00000009.00000002.3045870949.00000C440150C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3048884177.00000C4401744000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058302574.00000C44021B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058165434.00000C4402194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057597842.00000C44020BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/licy
Source: chrome.exe, 00000009.00000002.3050250427.00000C4401850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/om
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/om/
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/s
Source: chrome.exe, 00000009.00000002.3058227837.00000C44021B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.com/yndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C80000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comh
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://convertgetpdf.com
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://convertgetpdf.comhttps://www.cutepdf-editor.comhttps://www.googlea
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://convertwithwave.com
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://convertwithwave.comhttps://www.cutepdf-editor.comhttps://www.googl
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://geteasypdf.com
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://geteasypdf.comhttps://www.cutepdf-editor.comhttps://www.googleadse
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://pcapp.store
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://pcapp.storehttps://www.cutepdf-editor.comhttps://www.googleadservi
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C8C000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://viewpdf.net
Source: chrome.exe, 00000009.00000002.3051176145.00000C4401A45000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cutepdf-editor.comhttps://viewpdf.nethttps://www.cutepdf-editor.comhttps://www.googleadservi
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/
Source: OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/)c
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/-
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software//
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/1
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/3c4ccf3.crx
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/C
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/L
Source: OperaSetup.exe, 0000000A.00000003.2115240271.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/SysWOW64
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/U
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/W
Source: OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/a
Source: OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/i
Source: OperaSetup.exe, 0000000A.00000003.2382423451.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/l
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/1
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/W
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/i
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/s
Source: OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/staller
Source: OperaSetup.exe, 0000000A.00000003.2341396918.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/ssSignCertificateDecodeExDllFuncName
Source: OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary
Source: OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary0.53-DNA-116018-opera_intro.crx
Source: OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary0.53-DNA-116018-opera_intro.crxWh)3
Source: OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary5
Source: OperaSetup.exe, 0000000A.00000003.2331950671.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryB
Source: OperaSetup.exe, 0000000A.00000003.2390127095.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryC
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryK
Source: OperaSetup.exe, 0000000A.00000003.2245114633.00000000012DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryL
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryO
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryQ
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarya
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarydOIDInfo
Source: OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryemp
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software(
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software20
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwareC
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwarecrx
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwarecrxl
Source: OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryom
Source: OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryom.edgekey.net
Source: OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarys
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryy
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFUTGhWQUViMUV
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_p
Source: chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebndkojlmppeemj
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcoc
Source: chrome.exe, 00000009.00000002.3019622614.00000C440018C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.567854667.14/o
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/awbwhkldc27ygywhstypg77e7m_8679/hfnkpimlhhgieaddgfem
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/gonpemdgkjcec
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/e7xo23p2hym36lpmqsgqlzfmwe_3026/jflookgnkcckhobaglnd
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/fpkk4dndblzegbba53f5uoxbqm_927/efniojlnjndmcbiieegki
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaae
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/kiabhabjdbkjd
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbn
Source: chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021530576.00000C44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021530576.00000C44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021530576.00000C44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.3050923090.00000C4401920000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045870949.00000C440150C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050250427.00000C4401850000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3037731272.00000C4400EA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049873467.00000C440180C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059391260.00000C4402730000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058899250.00000C440256C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047558244.00000C440161C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061653198.00000C4402B18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045456901.00000C440149C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045973971.00000C4401530000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059452971.00000C4402740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057982443.00000C4402134000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060493740.00000C44028E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3044918462.00000C4401428000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061776441.00000C4402B64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045707399.00000C44014DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/
Source: chrome.exe, 00000009.00000002.3045973971.00000C4401530000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3048037287.00000C4401648000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net//
Source: chrome.exe, 00000009.00000002.3039703745.00000C4400FA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/D
Source: chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/click.net/
Source: chrome.exe, 00000009.00000002.3050250427.00000C4401850000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/et
Source: chrome.exe, 00000009.00000002.3047558244.00000C440161C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061653198.00000C4402B18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059452971.00000C4402740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050504862.00000C4401888000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3062023124.00000C4402B9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/et/cys
Source: chrome.exe, 00000009.00000002.3058485011.00000C44021EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/et/cysV
Source: chrome.exe, 00000009.00000002.3050923090.00000C4401920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/et/cyse
Source: chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/etm
Source: chrome.exe, 00000009.00000002.3060187405.00000C440287C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/k.net/
Source: chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/m/
Source: chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/m/g=
Source: chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/me
Source: chrome.exe, 00000009.00000002.3045870949.00000C440150C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049873467.00000C440180C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058899250.00000C440256C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047558244.00000C440161C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061653198.00000C4402B18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045456901.00000C440149C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045973971.00000C4401530000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059452971.00000C4402740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3044918462.00000C4401428000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045707399.00000C44014DC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058485011.00000C44021EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060187405.00000C440287C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050504862.00000C4401888000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059530326.00000C4402754000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061715078.00000C4402B34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3062023124.00000C4402B9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058667559.00000C4402218000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/net/
Source: chrome.exe, 00000009.00000002.3048397770.00000C440166C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/net/cy
Source: chrome.exe, 00000009.00000002.3048397770.00000C440166C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/net/ithm_D
Source: chrome.exe, 00000009.00000002.3059391260.00000C4402730000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045973971.00000C4401530000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060493740.00000C44028E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061776441.00000C4402B64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045809975.00000C44014F8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050504862.00000C4401888000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doubleclick.net/net/y
Source: OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/
Source: OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/311.2.1.40L0
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/C
Source: OperaSetup.exe, 0000000A.00000003.2112391984.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341267748.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244869940.000000000130F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2151832624.0000000056AB8000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65593&autoupdate=1&ni=1&stream=stable&utm_campaign=cpdf_
Source: OperaSetup.exe, 0000000A.00000003.2857456190.000000000130E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115240271.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331950671.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2989151990.0000000056A2B000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2128166843.0000000056ABC000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341267748.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65635&autoupdate=1&ni=1
Source: OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65635&autoupdate=1&ni=1c
Source: OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65635&autoupdate=1&ni=1i
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/y
Source: OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download5.operacdn.com/
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download5.operacdn.com/8:.6
Source: OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download5.operacdn.com/ftp/pub/.assistant/109.0.5097.45/Assistant_109.0.5097.45_Setup.exe
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download5.operacdn.com/ftp/pub/.assistant/109.0.5097.45/Assistant_109.0.5097.45_Setup.exe4
Source: OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download5.operacdn.com/ftp/pub/opera/desktop/109.0.5097.45/win/Opera_109.0.5097.45_Autoupdat
Source: chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3022752757.00000C4400310000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.3033023389.00000C4400BA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000009.00000002.3025052042.00000C4400520000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000009.00000002.3028889069.00000C4400844000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000009.00000002.3028102423.00000C4400790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946
Source: chrome.exe, 00000009.00000002.3048290210.00000C4401658000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000009.00000002.3039431558.00000C4400F8C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebn
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmj
Source: chrome.exe, 00000009.00000002.3019147771.00000C440014C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.56
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/awbwhkldc27ygywhstypg77e7m_8679/hfnkpiml
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.130
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3025052042.00000C4400520000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/g
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e7xo23p2hym36lpmqsgqlzfmwe_3026/jflookgn
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fpkk4dndblzegbba53f5uoxbqm_927/efniojlnj
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/ne
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbo
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/k
Source: chrome.exe, 00000009.00000002.3027222472.00000C44006DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.12
Source: OperaSetup.exe, 0000000A.00000003.2115000891.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244869940.000000000130F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-a
Source: OperaSetup.exe, 0000000A.00000003.2115000891.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244869940.000000000130F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108011233.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com/
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108566837.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com//
Source: OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108566837.0000000001329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com/2
Source: OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108566837.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com/3
Source: OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108566837.0000000001329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com/4
Source: OperaSetup.exe, 0000000A.00000003.2115000891.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244869940.000000000130F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108011233.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com/E:Y1
Source: OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
Source: OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=07e54957-ef59-4f0c-86
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forums.opera.com;
Source: chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/_/ContributorServingWebSwitchboardHttp/cspreport
Source: chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
Source: chrome.exe, 00000009.00000002.3055414776.00000C4401EE4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/f/AGSKWxUaat4ZmABnh7QLqO7P3ZY0DijEZD6iEhWPLB-HN8MmQhTNvnLL
Source: chrome.exe, 00000009.00000002.3059452971.00000C4402740000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/f/AGSKWxUeA9Ul6uAlbRFEtIzEGHoDbCeyoq2uDj9BhIALYcuaEZFrrSO2
Source: chrome.exe, 00000009.00000002.3055414776.00000C4401EE4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/f/AGSKWxWnj6KsijEUs006HYfwbHkfOyYri9DSV8-3DbK2_QGXDICufF27
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/i/ca-pub-6555658820068848?ers=2
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://gamemaker.io
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://gamemaker.io)
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://gamemaker.io/en/education.
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://gamemaker.io/en/get.
Source: OperaSetup.exe, 0000000A.00000003.2382423451.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857546430.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://get.geo.opera.com/
Source: OperaSetup.exe, 0000000A.00000003.2429212125.000000000136D000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115240271.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000136E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978766318.000000000136E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2989151990.0000000056A2B000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390197651.000000000136C000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417757063.000000000136D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crx
Source: OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crxWh)3
Source: OperaSetup.exe, 0000000A.00000003.2390127095.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crxl
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crxxh
Source: OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://get.geo.opera.com/p-netinstaller-sub.osp.opera.software/
Source: chrome.exe, 00000009.00000002.3003937174.000001A61EAFD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3006803549.000001A620C91000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://geteasypdf.com
Source: chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://geteasypdf.com%22
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000009.00000002.3059780274.00000C44027B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000009.00000002.3034144116.00000C4400C73000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3002580869.000001A61E6AD000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/
Source: chrome.exe, 00000009.00000002.3002284616.000001A61E677000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/aclk?nis=4&sa=l&ai=C-dkC8jMgZv_WBrP0xtYPjsWuqA7W6cuTd5TmzfGDEvuK
Source: chrome.exe, 00000009.00000002.3060619820.00000C4402900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/aclk?nis=4&sa=l&ai=CEjUI8jMgZqalBtmPvPIP-4iv4ALc4NmEdr_w0-f4Edmz
Source: chrome.exe, 00000009.00000002.3060619820.00000C4402900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/aclk?nis=4&sa=l&ai=CaaQx8jMgZoWeBvGFvPIP_t69kA6v-rDfdtez---6EsCN
Source: chrome.exe, 00000009.00000002.3051701312.00000C4401A5C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads
Source: chrome.exe, 00000009.00000002.3044056261.00000C44012B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&adk=181227
Source: chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058048369.00000C4402160000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3018631545.00000C44000F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=280&slot
Source: chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058048369.00000C4402160000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=600&slot
Source: chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3003937174.000001A61EAFD000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=90&slotn
Source: chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=C2Vgo8jMgZtWoBuT3xtYPk9qQyAjr7ZiVd-nqkM7eEpy0vf
Source: chrome.exe, 00000009.00000002.3059017604.00000C44026BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=CCumQ8jMgZoWeBvGFvPIP_t69kA6v-rDfdtez---6EsCNtw
Source: chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=CWYbD8jMgZv_WBrP0xtYPjsWuqA7W6cuTd5TmzfGDEvuK9P
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=CoKO48jMgZqalBtmPvPIP-4iv4ALc4NmEdr_w0-f4Edmzl_
Source: chrome.exe, 00000009.00000002.3061464758.00000C4402AB4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=Cpqa88jMgZoLXBrP0xtYPjsWuqA6v-rDfdtez---6EsCNtw
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=CzYd38jMgZoPXBrP0xtYPjsWuqA6xrJLtdqzp28mSEmQQAS
Source: chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058425939.00000C44021DC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057597842.00000C44020BC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057354919.00000C4402078000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Source: chrome.exe, 00000009.00000002.3055137076.00000C4401EB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057354919.00000C4402078000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211.asp$
Source: chrome.exe, 00000009.00000002.3037585117.00000C4400E8C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049498740.00000C44017B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Source: chrome.exe, 00000009.00000002.3050037957.00000C4401824000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA0
Source: chrome.exe, 00000009.00000002.3047456668.00000C440160C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA5
Source: chrome.exe, 00000009.00000002.3045809975.00000C44014F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA6
Source: chrome.exe, 00000009.00000002.3047659794.00000C4401624000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATACache-Control:
Source: chrome.exe, 00000009.00000002.3030545787.00000C4400968000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3052136089.00000C4401A78000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATAJ
Source: chrome.exe, 00000009.00000002.3049193326.00000C4401788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATAa
Source: chrome.exe, 00000009.00000002.3057597842.00000C44020BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATAd
Source: chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATAgWebSwitchboardHttp/cspreportport
Source: chrome.exe, 00000009.00000002.3059263989.00000C4402710000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3053334004.00000C4401AD4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATAor
Source: chrome.exe, 00000009.00000002.3055137076.00000C4401EB4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATAr
Source: chrome.exe, 00000009.00000002.3056079465.00000C4401F50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: chrome.exe, 00000009.00000002.3003937174.000001A61EAF7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3049498740.00000C44017B0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3062457351.00000C4402CBC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html
Source: chrome.exe, 00000009.00000002.3033328987.00000C4400BCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059017604.00000C44026BC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056530111.00000C4401FCC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-0-&adk
Source: chrome.exe, 00000009.00000002.3059080445.00000C44026D4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033328987.00000C4400BCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059017604.00000C44026BC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056530111.00000C4401FCC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-1-&adk
Source: chrome.exe, 00000009.00000002.3056530111.00000C4401FCC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-2-&adk
Source: chrome.exe, 00000009.00000002.3059712235.00000C4402788000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059017604.00000C44026BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-3-&adk
Source: chrome.exe, 00000009.00000002.3062457351.00000C4402CBC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.htmlHost
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.htmltputStream
Source: chrome.exe, 00000009.00000002.3041482531.00000C4401098000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/sn2dp-if-v6exp3-v4.metric.gstatic.com/
Source: chrome.exe, 00000009.00000002.3059712235.00000C4402788000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061319968.00000C4402A9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googlesyndication.com/
Source: chrome.exe, 00000009.00000002.3059712235.00000C4402788000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googlesyndication.com/#
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googlesyndication.com/D
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000009.00000002.3017329330.00000C4400058000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3044524055.00000C4401370000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034487167.00000C4400C8C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3035903928.00000C4400D60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://help.instagram.com/581066165581870;
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://help.opera.com/latest/
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.vimeocdn.com
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.ytimg.com
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i1.wp.com
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104explicitlyCastMediumpFloatTo16Bit
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000009.00000002.3038193857.00000C4400EE8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000009.00000002.3067279276.0000136400780000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000009.00000002.3067279276.0000136400780000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3028266221.00000C44007BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardPi
Source: chrome.exe, 00000009.00000002.3067279276.0000136400780000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://legal.opera.com/eula/computers
Source: OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://legal.opera.com/privacy
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://legal.opera.com/privacy.
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://legal.opera.com/terms
Source: OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://legal.opera.com/terms.
Source: chrome.exe, 00000009.00000002.3067217347.0000136400754000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3067338151.0000136400794000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000009.00000002.3003547949.000001A61E980000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 00000009.00000002.3067338151.0000136400794000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000009.00000002.3067338151.0000136400794000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000009.00000002.3067217347.0000136400754000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000009.00000002.3022933031.00000C4400340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3022752757.00000C4400310000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3018416414.00000C44000E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000009.00000002.3028102423.00000C4400790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000009.00000002.3028102423.00000C4400790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000009.00000002.3028102423.00000C4400790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://opera.com/privacy
Source: chrome.exe, 00000009.00000002.3033180828.00000C4400BB8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032320105.00000C4400AA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000009.00000002.3033589060.00000C4400C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000009.00000002.3032320105.00000C4400AA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000009.00000002.3033180828.00000C4400BB8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033589060.00000C4400C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000009.00000002.3033180828.00000C4400BB8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021645427.00000C44002E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000009.00000002.3033180828.00000C4400BB8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033589060.00000C4400C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000009.00000002.3032320105.00000C4400AA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033589060.00000C4400C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000009.00000002.3033180828.00000C4400BB8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032320105.00000C4400AA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033589060.00000C4400C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033084460.00000C4400BAD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-941299-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif
Source: chrome.exe, 00000009.00000002.3053898066.00000C4401B24000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.co
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/
Source: chrome.exe, 00000009.00000002.3032378072.00000C4400ABC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033684276.00000C4400C18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057791677.00000C44020F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049498740.00000C44017B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033684276.00000C4400C18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3040419479.00000C440101C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049498740.00000C44017B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Source: chrome.exe, 00000009.00000002.3033684276.00000C4400C18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.htmlD
Source: chrome.exe, 00000009.00000002.3045973971.00000C4401530000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060187405.00000C440287C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034487167.00000C4400C8C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/bg/XA1OsVw4vyx5eNLJMTo6Nyl7J8h5Vwaw8D225KUkYG4.js
Source: chrome.exe, 00000009.00000002.3044361567.00000C44012E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/bg/ZFlt5LioZKC9-flDPe9nsMJHLC1Pbiu6fR6Ada7GFdI.js
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3030946393.00000C4400998000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039703745.00000C4400FA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039327853.00000C4400F7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404160101/reactive_library_fy202
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039327853.00000C4400F7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404160101/show_ads_impl_fy2021.j
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true
Source: chrome.exe, 00000009.00000002.3003182838.000001A61E8A7000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?
Source: chrome.exe, 00000009.00000002.3003182838.000001A61E8A7000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240415&jk=1
Source: chrome.exe, 00000009.00000002.3002580869.000001A61E6AD000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240415&jk=116723482
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C91000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://pcapp.store
Source: chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3063429751.00000C44033C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store%22
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://policies.google.com/terms;
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://redir.opera.com/uninstallsurvey/
Source: OperaSetup.exe, 0000000A.00000002.2991692793.0000000056AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.16494
Source: chrome.exe, 00000009.00000002.3048290210.00000C4401658000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win6
Source: chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.c
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sWgic.cVd://wb
Source: chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sentry-relay.opera-api.com
Source: OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sentry-relay.opera-api.com/api/170/securi
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sentry-relay.opera-api.com/api/170/security/?sentry_key=8718908c4bc211ed9f0d161f2d7f9658
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000009.00000002.3028165351.00000C44007A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sourcecode.opera.com
Source: chrome.exe, 00000009.00000003.2817042856.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://telegram.org/tos/
Source: chrome.exe, 00000009.00000002.3047862661.00000C4401640000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/abg_lite_fy2021.js
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/load_preloaded_resource_fy202
Source: chrome.exe, 00000009.00000002.3059593340.00000C440276C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/one_click_handler_one_afm
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/one_click_handler_one_afma_fy
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3050504862.00000C4401888000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/qs_click_protection_fy2021.js
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/window_focus_fy2021.js
Source: chrome.exe, 00000009.00000002.3002284616.000001A61E67D000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/window_focus_fy2021.jsaDb
Source: chrome.exe, 00000009.00000002.3018631545.00000C44000F0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/window_focus_fy2021.jsy2021.j
Source: chrome.exe, 00000009.00000002.3059593340.00000C440276C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/fullscreen_api_ada
Source: chrome.exe, 00000009.00000002.3048037287.00000C4401648000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/fullscreen_api_adapter
Source: chrome.exe, 00000009.00000002.3059593340.00000C440276C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/fullscreen_api_adater_
Source: chrome.exe, 00000009.00000002.3058724835.00000C4402228000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/interstitial_ad_fr
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/interstitial_ad_frame_
Source: chrome.exe, 00000009.00000002.3059780274.00000C44027B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/simgad/1992440682003450767?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTg
Source: chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/sodar/sodar2.js
Source: chrome.exe, 00000009.00000002.3039703745.00000C4400FA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Source: chrome.exe, 00000009.00000002.3002580869.000001A61E6A7000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.htmlB
Source: chrome.exe, 00000009.00000002.3035286233.00000C4400CEC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tpc.googlesyndication.cometjsn2dp-if-v6exp3-v4.metric.gstatic.com
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://twitter.com/en/tos;
Source: chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: chrome.exe, 00000009.00000002.3043956038.00000C440129C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=13:CoJENegcyNQ0L8WXzuJiwlywpUmJ3F_XecYGWc
Source: chrome.exe, 00000009.00000002.3038482090.00000C4400F08000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://viewpdf.net
Source: chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://viewpdf.net%22
Source: chrome.exe, 00000009.00000002.3060619820.00000C4402900000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://viewpdf.net/ext/r1%3Fcid%3D8HsPnD47Xmadr3Lp1d%26kwd%3D%26gclid%3DEAIaIQobChMI_5eEhY7KhQMVM7r
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vimeo.com;
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ww.cute
Source: chrome.exe, 00000009.00000002.3039194874.00000C4400F64000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cuteor.com/suppo
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C83000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://www.cutepdf-editor.com
Source: Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3055644681.00000C4401F0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3031567121.00000C4400A17000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050250427.00000C4401850000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3003182838.000001A61E8A7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039194874.00000C4400F64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047094418.00000C44015E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060252437.00000C44028BC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058165434.00000C4402194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3002284616.000001A61E677000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3002580869.000001A61E6AD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3002284616.000001A61E67D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3032116643.00000C4400A82000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033832405.00000C4400C3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3062836278.00000C4402D54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3062897625.00000C4402D6C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059712235.00000C4402788000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059198278.00000C44026EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/-
Source: Setup.exe, 00000003.00000003.2051296710.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/021
Source: chrome.exe, 00000009.00000002.3046267424.00000C4401558000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/?
Source: chrome.exe, 00000009.00000002.3062836278.00000C4402D54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/B
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3042080164.00000C44010EE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/Images/PDF_Editor.GIF
Source: chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039327853.00000C4400F7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/Images/space.gif
Source: chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/J
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/K
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/b
Source: chrome.exe, 00000009.00000002.3062836278.00000C4402D54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/c
Source: chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033832405.00000C4400C3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059198278.00000C44026EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/g
Source: chrome.exe, 00000009.00000002.3047094418.00000C44015E4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/h
Source: chrome.exe, 00000009.00000002.3032774091.00000C4400B6C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/DocProp.png
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/DocProp.pnggeHandler
Source: chrome.exe, 00000009.00000002.3032774091.00000C4400B6C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/DocProp.pngl/
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/DocProp.pngrD
Source: chrome.exe, 00000009.00000002.3003937174.000001A61EAFD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3036206158.00000C4400DAC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/NEW.GIF
Source: chrome.exe, 00000009.00000002.3031853615.00000C4400A40000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/NEW.GIFpH
Source: chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/Print.gif
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/PrintDialogBox.gif
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/PrintDialogBox.giferD
Source: chrome.exe, 00000009.00000002.3043419289.00000C4401128000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/Save.png
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/Security.png
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/Security.png/
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/Security.pngD
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/background.jpg
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/companybg.jpg
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/companybg.jpgD
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/companybm.gif
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/companybm.gifD
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/companybm.gifHandler
Source: chrome.exe, 00000009.00000002.3003937174.000001A61EAFD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3059530326.00000C4402754000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/favicon.ico
Source: chrome.exe, 00000009.00000002.3057536759.00000C440209C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/favicon.ico5
Source: chrome.exe, 00000009.00000002.3061653198.00000C4402B18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/favicon.icol
Source: chrome.exe, 00000009.00000002.3055137076.00000C4401EB4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/favicon.icol/
Source: chrome.exe, 00000009.00000002.3062085612.00000C4402BA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/favicon.icol/nne
Source: chrome.exe, 00000009.00000002.3045552507.00000C44014B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/favicon.icol/or
Source: chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/footbg.gif
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/footbg.gifageHandler
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/footbg.gifl/
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/footbg.gifor
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/headerbg.gif
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/headerbg.gif/
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/htabs1.gif
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/htabs1.gifl/
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/htabs1.gifo
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/htabs3.gif
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/images/htabs3.gifl/
Source: chrome.exe, 00000009.00000002.3039194874.00000C4400F64000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/s
Source: CuteWriter.tmp, 00000001.00000003.2102761138.0000000002194000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/suppoD
Source: chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp
Source: chrome.exe, 00000009.00000002.3003937174.000001A61EAFD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3048037287.00000C4401648000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3044524055.00000C4401370000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3036206158.00000C4400DAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045018350.00000C4401434000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3035137637.00000C4400CC8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032619185.00000C4400B48000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039703745.00000C4400FA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignette
Source: chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignette2c0
Source: chrome.exe, 00000009.00000002.3036206158.00000C4400DAC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignette477
Source: chrome.exe, 00000009.00000002.3036206158.00000C4400DAC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignette948
Source: chrome.exe, 00000009.00000002.3051176145.00000C4401A48000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteCutePDF
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteaofpalml
Source: chrome.exe, 00000009.00000002.3030545787.00000C4400968000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteatic.com/v6exp3/iframe.htmlS-3-&adk
Source: chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignettebId
Source: chrome.exe, 00000009.00000002.3046661762.00000C440158C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetted
Source: chrome.exe, 00000009.00000002.3036206158.00000C4400DAC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteec5
Source: chrome.exe, 00000009.00000002.3045018350.00000C4401434000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteer
Source: chrome.exe, 00000009.00000002.3049873467.00000C440180C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3035137637.00000C4400CC8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteet/pagead/drt/s?v=r20120211
Source: chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignetteet/pagead/drt/si?st=NO_DATA
Source: chrome.exe, 00000009.00000002.3035137637.00000C4400CC8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignettegoogle_vignette)rt/si?st=NO_DATA
Source: chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp#google_vignettet77
Source: chrome.exe, 00000009.00000002.3060187405.00000C440287C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp)gead/drt/si?st=NO_DATA
Source: chrome.exe, 00000009.00000002.3062585051.00000C4402CDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp)gead/drt/si?st=NO_DATAx
Source: CuteWriter.tmp, 00000001.00000002.2104210278.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asp1
Source: chrome.exe, 00000009.00000002.3068161144.0000419C00234000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspA
Source: chrome.exe, 00000009.00000002.2991873723.000001A61AB00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspC:
Source: chrome.exe, 00000009.00000002.3051176145.00000C4401A48000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspCutePDF
Source: CuteWriter.tmp, 00000001.00000002.2105393779.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspF)
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102061010.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102210137.0000000000733000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2104747350.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspJ
Source: CuteWriter.tmp, 00000001.00000002.2105393779.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspK
Source: chrome.exe, 00000009.00000002.3069581588.0000592000220000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3069786212.0000592000238000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspY
Source: CuteWriter.tmp, 00000001.00000002.2105393779.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspa
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102061010.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102210137.0000000000733000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2104747350.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspde
Source: chrome.exe, 00000009.00000002.3031567121.00000C4400A17000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asped
Source: chrome.exe, 00000009.00000002.3068501331.0000419C0026C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3065692520.0000136400298000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspexeC:
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102061010.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102210137.0000000000733000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2104747350.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asph
Source: CuteWriter.tmp, 00000001.00000002.2105393779.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asphttps://www.cutepdf-editor.com/supports
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102061010.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102210137.0000000000733000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2104747350.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspk
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3038193857.00000C4400EE8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspl/
Source: chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspl/t/writer.asp$
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102061010.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102210137.0000000000733000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2104747350.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspmpte
Source: CuteWriter.tmp, 00000001.00000002.2105393779.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspogY
Source: chrome.exe, 00000009.00000002.3026392002.00000C4400628000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspor
Source: chrome.exe, 00000009.00000002.3031567121.00000C4400A17000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asprmissions
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.aspsedllv
Source: CuteWriter.tmp, 00000001.00000003.2081195434.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000003.2102061010.000000000072E000.00000004.00000020.00020000.00000000.sdmp, CuteWriter.tmp, 00000001.00000002.2104708443.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writer.asptCookieseJ
Source: Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000051E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000052A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writerhelp.asp
Source: Setup.exe, 00000003.00000003.2051296710.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writerhelp.aspH4OON
Source: Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writerhelp.aspShortcut
Source: Setup.exe, 00000003.00000002.2051877549.000000000051E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/support/writerhelp.aspr
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/t1
Source: chrome.exe, 00000009.00000002.3031567121.00000C4400A17000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com/upport/writer.aspl/
Source: chrome.exe, 00000009.00000002.3032264205.00000C4400A88000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com:443
Source: Setup.exe, 00000003.00000003.2051296710.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.com=
Source: Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.cutepdf-editor.comShortcut
Source: chrome.exe, 00000009.00000002.3028102423.00000C4400790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.comcometjsn2dp-if-v6exp3-v4.metric.gs
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C80000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://www.cutepdf-editor.comhttps://www.googleadservices.com
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C80000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://www.cutepdf-editor.comhttps://www.googleadservices.com/t
Source: chrome.exe, 00000009.00000002.3035286233.00000C4400CEC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.comk.net
Source: chrome.exe, 00000009.00000002.3035286233.00000C4400CEC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editor.comk.netjsn2dp-if-v6exp3-v4.metric.gstatic.com
Source: chrome.exe, 00000009.00000002.3032378072.00000C4400ABC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf-editriter.asA
Source: CuteWriter.tmp, 00000001.00000003.2080092115.0000000002154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cutepdf.com/Info/privacy.asp
Source: chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000009.00000002.3032878193.00000C4400B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googlPnics.Okrt-ui
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;
Source: chrome.exe, 00000009.00000003.2817042856.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000009.00000003.2817042856.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3027926913.00000C4400764000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000009.00000002.3030293310.00000C4400928000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3028266221.00000C44007BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000009.00000002.3030293310.00000C4400928000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3028266221.00000C44007BC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFUTGhWQUV
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thi
Source: chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebndkojlmpp
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnk
Source: chrome.exe, 00000009.00000002.3019622614.00000C440018C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.567854667.
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/awbwhkldc27ygywhstypg77e7m_8679/hfnkpimlhhgieadd
Source: chrome.exe, 00000009.00000002.3025052042.00000C4400520000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocnca
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/gonpemdgk
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/e7xo23p2hym36lpmqsgqlzfmwe_3026/jflookgnkcckhoba
Source: chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/fpkk4dndblzegbba53f5uoxbqm_927/efniojlnjndmcbiie
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkh
Source: chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/kiabhabjd
Source: chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkke
Source: chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3024710348.00000C44004E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3025355044.00000C4400570000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032619185.00000C4400B48000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058899250.00000C440256C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060493740.00000C44028E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045124889.00000C4401464000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049398456.00000C44017A8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058485011.00000C44021EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/pagead/drt/ui
Source: chrome.exe, 00000009.00000002.3002580869.000001A61E6A7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3048397770.00000C440166C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047862661.00000C4401640000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3040068365.00000C4400FE0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api2/aframe
Source: chrome.exe, 00000009.00000002.3041482531.00000C4401098000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api2/aframetml/r20240415/r20110914/zrt_lookup_fy2021.html#RS-3-&adk
Source: chrome.exe, 00000009.00000002.3022752757.00000C4400310000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000009.00000002.3006803549.000001A620C83000.00000002.00000001.00040000.00000026.sdmp	String found in binary or memory: https://www.googleadservices.com
Source: chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googleadservices.com/
Source: chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3001764526.000001A61E407000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3063429751.00000C44033C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleadservices.com/pagead/ar-adview/?nrh=
Source: chrome.exe, 00000009.00000002.3032719983.00000C4400B5C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: chrome.exe, 00000009.00000002.3016981278.00000C440000C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000009.00000002.3020453652.00000C440020C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googlehanager.cjM://www.gmlom
Source: chrome.exe, 00000009.00000003.2817042856.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000009.00000002.3017425933.00000C4400064000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033684276.00000C4400C18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-XVM5E9PE4F
Source: OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gravatar.cm)
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gravatar.com
Source: chrome.exe, 00000009.00000003.2817042856.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2800783734.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2884805520.00000C4400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3020805009.00000C4400290000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3039703745.00000C4400FA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000009.00000002.3003937174.000001A61EAFD000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Source: chrome.exe, 00000009.00000002.3058724835.00000C4402228000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/mysidia/1235ea95b1643dfc06b47a36d3f258ca.js?tag=mysidia_one_click_handle
Source: chrome.exe, 00000009.00000002.3058724835.00000C4402228000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/mysidia/1235ea95b1643dfc06b47a36d3f258ca.js?tag=mysidia_one_click_handle_one
Source: chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/mysidia/1235ea95b1643dfc06b47a36d3f258ca.js?tag=mysidia_one_click_handler_on
Source: chrome.exe, 00000009.00000002.3043639176.00000C4401160000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/mysidia/3877408e605ff49d481aecbe47802253.js?tag=client_fast_engine_2019
Source: chrome.exe, 00000009.00000002.3058724835.00000C4402228000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/mysidia/ad1dda460b76b599261f3bf327c10d91.js?tag=text/vanilla_highlight_m
Source: chrome.exe, 00000009.00000002.3048037287.00000C4401648000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/mysidia/ad1dda460b76b599261f3bf327c10d91.js?tag=text/vanilla_highlight_ms_ct
Source: chrome.exe, 00000009.00000002.3037222651.00000C4400E3C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.jsdelivr.com/using-sri-with-dynamic-files
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.opera.com
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.opera.com..
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.opera.com/
Source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.opera.com/download/
Source: CuteWriter.tmp, 00000001.00000003.2080092115.0000000002154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.opera.com/eula/computers
Source: OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.opera.com/privacy
Source: CuteWriter.tmp, 00000001.00000003.2102761138.0000000002194000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.opera.comP
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.whatsapp.com/legal;
Source: OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000009.00000002.3023950841.00000C4400431000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3021530576.00000C44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026952870.00000C44006BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global event hook (focus changed)

Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe

Windows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL

System Summary

Contains functionality to call native functions

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0042F594 NtdllDefWindowProc_A,	1_2_0042F594
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00423B94 NtdllDefWindowProc_A,	1_2_00423B94
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004125E8 NtdllDefWindowProc_A,	1_2_004125E8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00479380 NtdllDefWindowProc_A,	1_2_00479380
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0045763C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_0045763C

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_0042E944: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E944

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0045568C

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\system32\spool\DRIVERS\x64\CUTEPDFW.PPD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\system32\spool\DRIVERS\x64\PS5UI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.HLP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	File created: C:\Windows\system32\cpwmon64_v40.dll	Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00470C74	1_2_00470C74
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0048ED0C	1_2_0048ED0C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004813C4	1_2_004813C4
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00467848	1_2_00467848
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004303D0	1_2_004303D0
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0044453C	1_2_0044453C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004885E0	1_2_004885E0
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00434638	1_2_00434638
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00444AE4	1_2_00444AE4
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00430F5C	1_2_00430F5C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0045F16C	1_2_0045F16C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004451DC	1_2_004451DC
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0045B21C	1_2_0045B21C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0043533C	1_2_0043533C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004455E8	1_2_004455E8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00487680	1_2_00487680
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0046989C	1_2_0046989C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00451A30	1_2_00451A30
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0043DDC4	1_2_0043DDC4
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Code function: 3_2_00403160	3_2_00403160
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_00405418	6_2_00405418
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_00404DF9	6_2_00404DF9
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Code function: 7_2_004017E0	7_2_004017E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF71E80	10_2_6BF71E80
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BE9D3E0	10_2_6BE9D3E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFF6BB0	10_2_6BFF6BB0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFE1B80	10_2_6BFE1B80
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C0604F0	10_2_6C0604F0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFFB2F0	10_2_6BFFB2F0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFDF2E0	10_2_6BFDF2E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF3BAA0	10_2_6BF3BAA0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFDEA70	10_2_6BFDEA70
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF74260	10_2_6BF74260
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BEA2A70	10_2_6BEA2A70
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFE3260	10_2_6BFE3260
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C032DBD	10_2_6C032DBD
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF70A30	10_2_6BF70A30
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF36200	10_2_6BF36200
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFD31E0	10_2_6BFD31E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF31170	10_2_6BF31170
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF35970	10_2_6BF35970
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C05969A	10_2_6C05969A
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF40930	10_2_6BF40930
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFFC920	10_2_6BFFC920
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFF8910	10_2_6BFF8910
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF2D0A0	10_2_6BF2D0A0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF63FE0	10_2_6BF63FE0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BDCBFC0	10_2_6BDCBFC0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C002030	10_2_6C002030
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFDB700	10_2_6BFDB700
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C03212C	10_2_6C03212C
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BEA4670	10_2_6BEA4670
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF60640	10_2_6BF60640
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C02E1D0	10_2_6C02E1D0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFFBDE0	10_2_6BFFBDE0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF4DDD0	10_2_6BF4DDD0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFDC5C0	10_2_6BFDC5C0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF31540	10_2_6BF31540
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C0572D9	10_2_6C0572D9
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C0362E0	10_2_6C0362E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BFE0CC0	10_2_6BFE0CC0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C0BC390	10_2_6C0BC390
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6BF39450	10_2_6BF39450
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B95A350	13_2_6B95A350
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B991B80	13_2_6B991B80
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9A6BB0	13_2_6B9A6BB0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6BA6C390	13_2_6BA6C390
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B84D3E0	13_2_6B84D3E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8EBAA0	13_2_6B8EBAA0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9AB2F0	13_2_6B9AB2F0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B98F2E0	13_2_6B98F2E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6BA072D9	13_2_6BA072D9
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9E62E0	13_2_6B9E62E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8E6200	13_2_6B8E6200
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B920A30	13_2_6B920A30
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B98EA70	13_2_6B98EA70
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B924260	13_2_6B924260
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B852A70	13_2_6B852A70
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B993260	13_2_6B993260
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9DE1D0	13_2_6B9DE1D0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9831E0	13_2_6B9831E0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9A8910	13_2_6B9A8910
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9E212C	13_2_6B9E212C
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9AC920	13_2_6B9AC920
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8F0930	13_2_6B8F0930
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8E1170	13_2_6B8E1170
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8E5970	13_2_6B8E5970
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8DD0A0	13_2_6B8DD0A0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9B2030	13_2_6B9B2030
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B913FE0	13_2_6B913FE0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B98B700	13_2_6B98B700
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B77BFC0	13_2_6B77BFC0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B921E80	13_2_6B921E80
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6BA0969A	13_2_6BA0969A
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B910640	13_2_6B910640
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B854670	13_2_6B854670
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9E2DBD	13_2_6B9E2DBD
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B98C5C0	13_2_6B98C5C0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8FDDD0	13_2_6B8FDDD0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9ABDE0	13_2_6B9ABDE0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8E1540	13_2_6B8E1540
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6BA104F0	13_2_6BA104F0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B990CC0	13_2_6B990CC0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B8E9450	13_2_6B8E9450

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00408C1C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00406AD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 0040596C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00407904 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00445E48 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00457FC4 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00457DB8 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00434550 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00403494 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 004533B8 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00446118 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: String function: 00403684 appears 229 times
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Code function: String function: 00406DC2 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: String function: 6BA129B0 appears 217 times
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: String function: 6C0629B0 appears 216 times

PE file contains executable resources (Code or Archives)

Source: CuteWriter.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: CuteWriter.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: CuteWriter.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-FDP4K.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: is-FDP4K.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: is-3BEAI.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: is-3BEAI.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: is-0HCHF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: is-0HCHF.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: is-327TJ.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: is-327TJ.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: PSCRIPT5.DLL.3.dr	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: PSCRIPT5.DLL.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: PS5UI.DLL.3.dr	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: PS5UI.DLL.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: installer.exe.15.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows

PE file contains more sections than normal

Source: launcher.exe.15.dr

Static PE information: Number of sections : 12 > 10

Sample file is different than original file name gathered from version info

Source: CuteWriter.exe, 00000000.00000003.1652232868.0000000002164000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs CuteWriter.exe
Source: CuteWriter.exe, 00000000.00000003.1651757759.00000000023F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs CuteWriter.exe

Uses 32bit PE files

Source: CuteWriter.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus24.evad.winEXE@65/773@0/41

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe

Code function: 3_2_00401B70 lstrcatA,GetLastError,LoadStringA,wsprintfA,FormatMessageA,lstrcatA,lstrcatA,lstrcatA,LocalHandle,LocalFree,#537,#924,#924,MessageBoxA,#800,#800,#800,

3_2_00401B70

Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0045568C

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_00455EB4 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_00455EB4

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe

Code function: 3_2_00406B30 CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,

3_2_00406B30

Source: C:\Users\user\Desktop\CuteWriter.exe

Code function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409C34

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

File created: C:\Program Files (x86)\CutePDF Writer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\Opera/Installer/C:/Users/user/AppData/Local/Programs/Opera

Source: C:\Users\user\Desktop\CuteWriter.exe

File created: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\CuteWriter.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: chrome.exe, 00000009.00000002.3026952870.00000C44006C3000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));

Source: CuteWriter.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: OperaSetup.exe	String found in binary or memory: opera-startpage-special
Source: OperaSetup.exe	String found in binary or memory: run-at-startup
Source: OperaSetup.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: OperaSetup.exe	String found in binary or memory: run-at-startup-default
Source: OperaSetup.exe	String found in binary or memory: video-on-start-page
Source: OperaSetup.exe	String found in binary or memory: yat-emoji-addresses
Source: OperaSetup.exe	String found in binary or memory: installer-bypass-launcher
Source: OperaSetup.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: OperaSetup.exe	String found in binary or memory: Global\Opera/Installer/
Source: OperaSetup.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: OperaSetup.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: OperaSetup.exe	String found in binary or memory: enable-installer-stats
Source: OperaSetup.exe	String found in binary or memory: launchopera-on-os-start
Source: OperaSetup.exe	String found in binary or memory: master-copy-installation
Source: OperaSetup.exe	String found in binary or memory: show-eula-window-on-start
Source: OperaSetup.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: OperaSetup.exe	String found in binary or memory: post-elevated-install-tasks
Source: OperaSetup.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: OperaSetup.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: OperaSetup.exe	String found in binary or memory: all-installer-experiments
Source: OperaSetup.exe	String found in binary or memory: ran-launcher
Source: OperaSetup.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: OperaSetup.exe	String found in binary or memory: opera-startpage-special
Source: OperaSetup.exe	String found in binary or memory: run-at-startup
Source: OperaSetup.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: OperaSetup.exe	String found in binary or memory: run-at-startup-default
Source: OperaSetup.exe	String found in binary or memory: video-on-start-page
Source: OperaSetup.exe	String found in binary or memory: yat-emoji-addresses
Source: OperaSetup.exe	String found in binary or memory: installer-bypass-launcher
Source: OperaSetup.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: OperaSetup.exe	String found in binary or memory: Global\Opera/Installer/
Source: OperaSetup.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: OperaSetup.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: OperaSetup.exe	String found in binary or memory: enable-installer-stats
Source: OperaSetup.exe	String found in binary or memory: launchopera-on-os-start
Source: OperaSetup.exe	String found in binary or memory: master-copy-installation
Source: OperaSetup.exe	String found in binary or memory: show-eula-window-on-start
Source: OperaSetup.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: OperaSetup.exe	String found in binary or memory: post-elevated-install-tasks
Source: OperaSetup.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: OperaSetup.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: OperaSetup.exe	String found in binary or memory: all-installer-experiments
Source: OperaSetup.exe	String found in binary or memory: ran-launcher
Source: OperaSetup.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f

Source: C:\Users\user\Desktop\CuteWriter.exe

File read: C:\Users\user\Desktop\CuteWriter.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CuteWriter.exe "C:\Users\user\Desktop\CuteWriter.exe"
Source: C:\Users\user\Desktop\CuteWriter.exe	Process created: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp "C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp" /SL5="$20446,5944588,56832,C:\Users\user\Desktop\CuteWriter.exe"
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe" /inscpw4 -d"C:\Program Files (x86)\CutePDF Writer"
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\converter.exe C:\Users\user\AppData\Local\Temp\\converter.exe /auto
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe unInstcpw64.exe /copy
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.cutepdf-editor.com/support/writer.asp
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --silent --allusers=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1640,i,13590044467732800076,8352524087445346693,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c1821c8,0x6c1821d4,0x6c1821e0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2520 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240417224118" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x300,0x304,0x308,0x2c8,0x30c,0x6b5d21c8,0x6b5d21d4,0x6b5d21e0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --version
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x9a6038,0x9a6044,0x9a6050
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe "C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe" --backend --initial-pid=2520 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --install-subfolder=109.0.5097.45
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x278,0x27c,0x280,0x274,0x250,0x7ffdf9937c80,0x7ffdf9937c8c,0x7ffdf9937c98
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x9a6038,0x9a6044,0x9a6050
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x210,0x208,0x234,0x20c,0x238,0x1126038,0x1126044,0x1126050
Source: C:\Users\user\Desktop\CuteWriter.exe	Process created: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp "C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp" /SL5="$20446,5944588,56832,C:\Users\user\Desktop\CuteWriter.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe" /inscpw4 -d"C:\Program Files (x86)\CutePDF Writer"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.cutepdf-editor.com/support/writer.asp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --silent --allusers=0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\converter.exe C:\Users\user\AppData\Local\Temp\\converter.exe /auto	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe unInstcpw64.exe /copy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1640,i,13590044467732800076,8352524087445346693,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c1821c8,0x6c1821d4,0x6c1821e0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2520 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240417224118" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x300,0x304,0x308,0x2c8,0x30c,0x6b5d21c8,0x6b5d21d4,0x6b5d21e0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe "C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe" --backend --initial-pid=2520 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --install-subfolder=109.0.5097.45
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x9a6038,0x9a6044,0x9a6050
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x278,0x27c,0x280,0x274,0x250,0x7ffdf9937c80,0x7ffdf9937c8c,0x7ffdf9937c98
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x9a6038,0x9a6044,0x9a6050
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x210,0x208,0x234,0x20c,0x238,0x1126038,0x1126044,0x1126050
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\CuteWriter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CuteWriter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: uiamanager.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: actxprxy.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: twinapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: firewallapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: fwbase.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe

File written: C:\Program Files (x86)\CutePDF Writer\setup.ini

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Window found: window name: TMainForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Automated click: I accept the agreement

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CutePDF Writer Copyright by Acro Software Inc. All rights reserved.This license applies to the CutePDF Writer ("The Software"). CutePDF Writer is free software. By using copying transmitting distributing or installing CutePDF Writer you agree to all of the terms of this agreement ("License").Please read the license terms below. If you do not agree to any of the terms of this License then do not use copy transmit distribute or install The Software.Scope of LicenseThis is free software. Subject to the terms below you are hereby licensed by Acro Software Inc. ("ASI") to use The Software on computer or workstation without charge. Free CutePDF Writer is available for volume distribution beyond a single-user installation. Without making any payment to ASI: a) You may give exact copies of The Software personally to anyone. b) Corporations and organizations may distribute exact copies of The Software on a company intranet site or local network. c) Commercial vendors may bundle exact copies of The Software on physical media such as a CD or DVD or on OEM hardware such as computers. d) You may make as many exact copies of The Software as you wish for purposes of distribution as described in (a) (b) and (c) above.You are specifically prohibited from charging advertising or requesting donations for any copies however made and from distributing such copies with other products of any kind commercial or otherwise without prior written permission from ASI. ASI reserves the right to revoke the above distribution rights at any time for any or no reason.Except as otherwise pre-approved by ASI in writing you shall not distribute The Software from a Website other than an ASI Site.No Modification No Reverse Engineering. You shall not modify adapt translate or create derivative works based upon The Software in any way including without limitation removal of the installer program electronic end user license agreement or any copyright or other proprietary notice that appears in The Software. This software and all accompanying files data and materials are distributed "AS IS". ASI does not warrant that the operation of the Software will meet your requirements or operate free from error. ASI DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS EITHER EXPRESS OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. This disclaimer of warranty constitutes an essential part of the agreement. In no event shall ASI or its principals shareholders officers employees affiliates contractors subsidiaries or parent organizations be liable for any incidental consequential or punitive damages whatsoever relating to the use of The Software or your relationship with ASI.This License shall be go
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CutePDF Writer Copyright by Acro Software Inc. All rights reserved.This license applies to the CutePDF Writer ("The Software"). CutePDF Writer is free software. By using copying transmitting distributing or installing CutePDF Writer you agree to all of the terms of this agreement ("License").Please read the license terms below. If you do not agree to any of the terms of this License then do not use copy transmit distribute or install The Software.Scope of LicenseThis is free software. Subject to the terms below you are hereby licensed by Acro Software Inc. ("ASI") to use The Software on computer or workstation without charge. Free CutePDF Writer is available for volume distribution beyond a single-user installation. Without making any payment to ASI: a) You may give exact copies of The Software personally to anyone. b) Corporations and organizations may distribute exact copies of The Software on a company intranet site or local network. c) Commercial vendors may bundle exact copies of The Software on physical media such as a CD or DVD or on OEM hardware such as computers. d) You may make as many exact copies of The Software as you wish for purposes of distribution as described in (a) (b) and (c) above.You are specifically prohibited from charging advertising or requesting donations for any copies however made and from distributing such copies with other products of any kind commercial or otherwise without prior written permission from ASI. ASI reserves the right to revoke the above distribution rights at any time for any or no reason.Except as otherwise pre-approved by ASI in writing you shall not distribute The Software from a Website other than an ASI Site.No Modification No Reverse Engineering. You shall not modify adapt translate or create derivative works based upon The Software in any way including without limitation removal of the installer program electronic end user license agreement or any copyright or other proprietary notice that appears in The Software. This software and all accompanying files data and materials are distributed "AS IS". ASI does not warrant that the operation of the Software will meet your requirements or operate free from error. ASI DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS EITHER EXPRESS OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. This disclaimer of warranty constitutes an essential part of the agreement. In no event shall ASI or its principals shareholders officers employees affiliates contractors subsidiaries or parent organizations be liable for any incidental consequential or punitive damages whatsoever relating to the use of The Software or your relationship with ASI.This License shall be go
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CutePDF Writer Copyright by Acro Software Inc. All rights reserved.This license applies to the CutePDF Writer ("The Software"). CutePDF Writer is free software. By using copying transmitting distributing or installing CutePDF Writer you agree to all of the terms of this agreement ("License").Please read the license terms below. If you do not agree to any of the terms of this License then do not use copy transmit distribute or install The Software.Scope of LicenseThis is free software. Subject to the terms below you are hereby licensed by Acro Software Inc. ("ASI") to use The Software on computer or workstation without charge. Free CutePDF Writer is available for volume distribution beyond a single-user installation. Without making any payment to ASI: a) You may give exact copies of The Software personally to anyone. b) Corporations and organizations may distribute exact copies of The Software on a company intranet site or local network. c) Commercial vendors may bundle exact copies of The Software on physical media such as a CD or DVD or on OEM hardware such as computers. d) You may make as many exact copies of The Software as you wish for purposes of distribution as described in (a) (b) and (c) above.You are specifically prohibited from charging advertising or requesting donations for any copies however made and from distributing such copies with other products of any kind commercial or otherwise without prior written permission from ASI. ASI reserves the right to revoke the above distribution rights at any time for any or no reason.Except as otherwise pre-approved by ASI in writing you shall not distribute The Software from a Website other than an ASI Site.No Modification No Reverse Engineering. You shall not modify adapt translate or create derivative works based upon The Software in any way including without limitation removal of the installer program electronic end user license agreement or any copyright or other proprietary notice that appears in The Software. This software and all accompanying files data and materials are distributed "AS IS". ASI does not warrant that the operation of the Software will meet your requirements or operate free from error. ASI DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS EITHER EXPRESS OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. This disclaimer of warranty constitutes an essential part of the agreement. In no event shall ASI or its principals shareholders officers employees affiliates contractors subsidiaries or parent organizations be liable for any incidental consequential or punitive damages whatsoever relating to the use of The Software or your relationship with ASI.This License shall be go

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CutePDF Writer Installation

Jump to behavior

PE / OLE file has a valid certificate

Source: CuteWriter.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: CuteWriter.exe

Static file information: File size 6233072 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: CuteWriter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: ps5ui.pdbH source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _lib.dll.pdb@+ source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000000.2079178927.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000000.2087433669.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000000.2093874178.0000000000917000.00000080.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000000.2099132850.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp
Source:	Binary string: pscript5.pdb source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.00000000006B1000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.0000000000171000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: _lib.dll.pdb source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000000.2079178927.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000000.2087433669.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000000.2093874178.0000000000917000.00000080.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000000.2099132850.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb@+ source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: ps5ui.pdb source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: .pdb.dbg source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: pscript5.pdbH source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: .pdb@ source: CuteWriter.tmp, 00000001.00000003.2080261890.000000000597D000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2981313588.0000000003570000.00000002.00000001.00040000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000000.2079178927.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000000.2087433669.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000000.2093874178.0000000000917000.00000080.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000000.2099132850.00000000003D7000.00000080.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb@ source: OperaSetup.exe, 0000000A.00000002.2957530474.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000001.2089349383.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.00000000006B1000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.0000000000171000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.0000000000171000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: dbghelp.pdb source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: \Unknown exceptionbad array new length.pdbSymbols loaded successfully. source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: assistant_installer.exe, 00000015.00000002.2363369486.000000006CA71000.00000020.00000001.01000000.00000018.sdmp

Data Obfuscation

Binary contains a suspicious time stamp

Source: dxil.dll.15.dr

Static PE information: 0x7DBE8527 [Fri Nov 7 02:32:07 2036 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_00450334 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450334

PE file contains an invalid checksum

Source: OperaSetup.exe.1.dr	Static PE information: real checksum: 0x2defd0 should be: 0x2d6a9b
Source: OperaSetup.exe.10.dr	Static PE information: real checksum: 0x2defd0 should be: 0x2d6a9b
Source: CuteWriter.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0xb9526
Source: gswin32c.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x2d2a8

PE file contains sections with non-standard names

Source: converter.exe.3.dr	Static PE information: section name: _winzip_
Source: gplgs[1].exe.3.dr	Static PE information: section name: _winzip_
Source: Opera_installer_2404172041166342520.dll.10.dr	Static PE information: section name: .rodata
Source: Opera_installer_2404172041166342520.dll.10.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2404172041166342520.dll.10.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2404172041175667228.dll.13.dr	Static PE information: section name: .rodata
Source: Opera_installer_2404172041175667228.dll.13.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2404172041175667228.dll.13.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2404172041180917624.dll.14.dr	Static PE information: section name: .rodata
Source: Opera_installer_2404172041180917624.dll.14.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2404172041180917624.dll.14.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.15.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.15.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.15.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.15.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.15.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.15.dr	Static PE information: section name: _RDATA
Source: win10_share_handler.dll.15.dr	Static PE information: section name: .gxfg
Source: win10_share_handler.dll.15.dr	Static PE information: section name: .retplne
Source: win10_share_handler.dll.15.dr	Static PE information: section name: _RDATA
Source: win8_importing.dll.15.dr	Static PE information: section name: .gxfg
Source: win8_importing.dll.15.dr	Static PE information: section name: .retplne
Source: win8_importing.dll.15.dr	Static PE information: section name: _RDATA
Source: dxcompiler.dll.15.dr	Static PE information: section name: .gxfg
Source: dxcompiler.dll.15.dr	Static PE information: section name: .retplne
Source: dxcompiler.dll.15.dr	Static PE information: section name: _RDATA
Source: dxil.dll.15.dr	Static PE information: section name: _RDATA
Source: installer.exe.15.dr	Static PE information: section name: .gxfg
Source: installer.exe.15.dr	Static PE information: section name: .retplne
Source: installer.exe.15.dr	Static PE information: section name: _RDATA
Source: installer_helper_64.exe.15.dr	Static PE information: section name: .gxfg
Source: installer_helper_64.exe.15.dr	Static PE information: section name: .retplne
Source: installer_helper_64.exe.15.dr	Static PE information: section name: _RDATA
Source: launcher.exe.15.dr	Static PE information: section name: .gxfg
Source: launcher.exe.15.dr	Static PE information: section name: .retplne
Source: launcher.exe.15.dr	Static PE information: section name: LZMADEC
Source: launcher.exe.15.dr	Static PE information: section name: _RDATA
Source: launcher.exe.15.dr	Static PE information: section name: malloc_h

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004849F4 push 00484B02h; ret	1_2_00484AFA
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0040995C push 00409999h; ret	1_2_00409991
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00458060 push 00458098h; ret	1_2_00458090
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004860E4 push ecx; mov dword ptr [esp], ecx	1_2_004860E9
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004783C8 push ecx; mov dword ptr [esp], edx	1_2_004783C9
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004104F0 push ecx; mov dword ptr [esp], edx	1_2_004104F5
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00412938 push 0041299Bh; ret	1_2_00412993
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0049AD44 pushad ; retf	1_2_0049AD53
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0040CE48 push ecx; mov dword ptr [esp], edx	1_2_0040CE4A
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00459378 push 004593BCh; ret	1_2_004593B4
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0040F3A8 push ecx; mov dword ptr [esp], edx	1_2_0040F3AA
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004434B4 push ecx; mov dword ptr [esp], ecx	1_2_004434B8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0045186C push 0045189Fh; ret	1_2_00451897
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00451A30 push ecx; mov dword ptr [esp], eax	1_2_00451A35
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00495BE4 push ecx; mov dword ptr [esp], ecx	1_2_00495BE9
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00419C38 push ecx; mov dword ptr [esp], ecx	1_2_00419C3D

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Program Files (x86)\CutePDF Writer\CPWriter2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-UFSC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxcompiler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Program Files (x86)\CutePDF Writer\unInstcpw64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\assistant\dbghelp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-3BEAI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-ICRHC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\dbgcore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\ICONLIB.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT5.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-39C8H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	File created: C:\Windows\System32\cpwmon64_v40.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\gplgs[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\assistant\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-2AGL8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon64_v40.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\converter.exe	File created: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gswin32c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-QV01T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win10_share_handler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-ER5M7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\pdfwriter64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-PO6AU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon32_v40.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\System32\spool\drivers\x64\PSCRIPT5.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172042207667120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT5.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-327TJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041189647756.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Opera_109.0.5097.45_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\additional_file0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172042210696156.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-KT3FM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-FDP4K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT.DRV (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-INHJ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\converter.exe	File created: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdll32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041185797716.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CPWriter2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\browser_assistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\pdfwriter32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041175667228.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Program Files (x86)\CutePDF Writer\CPWSave.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\System32\spool\drivers\x64\PS5UI.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PS5UI.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Program Files (x86)\CutePDF Writer\CutePDFWriter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe.1713386541.old (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-LDLTG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Assistant_109.0.5097.45_Setup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041166342520.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PS5UI.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-LD694.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\assistant\dbgcore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\dbghelp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\CuteWriter.exe	File created: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSMON.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe.1713386541.old (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\opera_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\assistant_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CutePDFWriter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-IGGEH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041180917624.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\converter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win8_importing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-0HCHF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	File created: C:\Windows\System32\cpwmon64_v40.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\System32\spool\drivers\x64\PS5UI.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\Windows\System32\spool\drivers\x64\PSCRIPT5.DLL	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\opera_package			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\assistant_package			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Code function: 3_2_00403160 #1134,__p___argc,_mbsicmp,__p___argv,#537,_mbscmp,#2764,#2764,#4129,_mbsicmp,#4129,_mbsicmp,#800,#4129,_mbsicmp,#800,#800,#4129,_mbsicmp,#4129,_mbsicmp,#800,#4129,_mbsicmp,#800,#800,#4129,_mbsicmp,#4129,_mbsicmp,#800,#800,#4129,_mbsicmp,#800,#4277,#858,#4277,#858,#800,#4277,#858,#800,#4129,#858,#800,#4129,#858,#800,#800,#800,__p___argc,#2621,#540,#823,#1168,GetModuleFileNameA,_splitpath,#860,#941,#858,#941,#858,#941,#825,#540,#354,#5186,#5442,#823,#5442,#5442,#823,#5442,#1979,#825,#403,#6389,#825,#5445,#5445,#2919,#5445,#5445,#2919,#5445,#5445,#2919,#5445,#5445,#5445,#5445,#2919,#5445,#5445,#5445,#2919,#5445,#5445,#5445,#5445,#5445,#5445,#924,PathFileExistsA,PathFileExistsA,#800,#924,#858,#800,PathFileExistsA,#924,#858,#800,PathFileExistsA,#924,#858,#800,PathFileExistsA,#924,#858,#800,PathFileExistsA,#860,#703,GetPrivateProfileStringA,atoi,GetUserDefaultLCID,#860,#1168,lstrcpyA,GetVersionExA,RegOpenKeyExA,RegCloseKey,LoadStringA,wsprintfA,#537,#924,#924,MessageBoxA,#800,#800,#800,#665,#800,#800,EnumMonitorsA,lstrcmpA,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcpyA,lstrcpyA,DeletePrinterDriverA,DeletePortA,DeleteMonitorA,GetSystemDirectoryA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,DeleteFileA,CreateProcessA,GetExitCodeProcess,WaitForSingleObject,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,lstrcatA,lstrcatA,lstrcpyA,lstrcpyA,lstrcpyA,DeletePrinterDriverA,DeletePortA,DeleteMonitorA,GetSystemDirectoryA,lstrcpyA,lstrcatA,lstrcatA,DeleteFileA,CreateProcessA,GetExitCodeProcess,WaitForSingleObject,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,lstrcpyA,lstrcpyA,lstrcpyA,DeletePrinterDriverA,DeletePortA,DeleteMonitorA,GetSystemDirectoryA,lstrcpyA,lstrcatA,lstrcatA,DeleteFileA,CreateProcessA,GetExitCodeProcess,WaitForSingleObject,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,lstrcatA,LoadStringA,#540,#2818,#537,#924,#924,MessageBoxA,#800,#800,#800,#800,#665,#800,#800,#800,#2818,#924,#858,#800,#2514,#800,#800,#656,#641,#665,#800,#800,#800,#800,#656,#641,#540,#537,#922,#858,#800,#800,#860,SHGetSpecialFolderPathA,#860,#940,#858,#939,RegOpenKeyExA,RegQueryValueExA,#860,#940,#858,#939,RegCloseKey,GetPrivateProfileStringA,#860,#2514,#800,#656,#641,#800,#665,#800,#800,#860,#800,#656,#641,#800,RegCreateKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,GetPrivateProfileStringA,RegSetValueExA,GetPrivateProfileStringA,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegSetValueExA,RegCloseKey,GetSystemDirectoryA,lstrcatA,GetModuleFileNameA,strrchr,CreateDirectoryA,#5683,#4129,#800,CreateDirectoryA,#537,#5683,#4129,#800,CreateDirectoryA,#4129,#800,CreateDirectoryA,#800,CreateDirectoryA,#800,lstrcpyA,lstrcpyA,lstrcatA,lstrcpyA,lstrcatA,lstrcpyA,lstrcatA,CopyFileA,CopyFileA,#537,lstrcpyA,lstrcatA,lstrcpyA,lstrcatA,CopyFileA,#537,lstrcpyA,lstrcatA,lstrcpyA,lstrcatA,PathFileExistsA,CopyFileA,#537,#537,#941,#941,WinExec,#800,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,CopyFileA,#537,lstrcpyA,lstrcatA,lstrcpyA,lstrcatA,C		3_2_00403160
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Code function: 3_2_00401D90 lstrcatA,GetPrivateProfileStringA,atoi,OpenPrinterA,lstrcmpA,SetLastError,GetPrinterA,GetLastError,GlobalAlloc,GetPrinterA,DocumentPropertiesA,malloc,DocumentPropertiesA,free,lstrcmpA,lstrcpynA,DocumentPropertiesA,SetPrinterA,GetPrinterA,GlobalAlloc,GlobalLock,GetPrinterA,lstrcmpA,lstrcmpA,lstrcmpA,DocumentPropertiesA,SetPrinterA,MessageBoxA,GetLastError,GlobalFree,GlobalFree,GlobalUnlock,GlobalFree,ClosePrinter,		3_2_00401D90

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224117808.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224119169.log
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224144.log
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224221297.log
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224227.log
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224228.log

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

File created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.js.LICENSE.txt

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer\Readme.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer\Try Free CutePDF Editor.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Opera Browser Assistant
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Opera Browser Assistant

Hooking and other Techniques for Hiding and Protection

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0042286C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042286C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004241EC IsIconic,SetActiveWindow,SetFocus,	1_2_004241EC
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004241A4 IsIconic,SetActiveWindow,	1_2_004241A4
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00418394 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418394
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004843A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_004843A8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0042F2F0 IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	1_2_0042F2F0
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004175A8 IsIconic,GetCapture,	1_2_004175A8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00417CDE IsIconic,SetWindowPos,	1_2_00417CDE
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00417CE0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CE0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Code function: 3_2_004069D0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,	3_2_004069D0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Code function: 7_2_00403000 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	7_2_00403000

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_0041F128 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F128

Stores large binary data to the registry

Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Taskband FavoritesResolve

Source: C:\Users\user\Desktop\CuteWriter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

Code function: 10_2_6BFC9620 rdtsc

10_2_6BFC9620

Found decision node followed by non-executed suspicious APIs

Source: C:\Users\user\AppData\Local\Temp\converter.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_6-2022

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\browser_assistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-UFSC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\CutePDF Writer\CPWriter2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxcompiler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-3BEAI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\pdfwriter32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-ICRHC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\ICONLIB.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041175667228.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT5.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\CutePDF Writer\CPWSave.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\assistant\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Dropped PE file which has not been started: C:\Windows\System32\spool\drivers\x64\PS5UI.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PS5UI.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\CutePDF Writer\CutePDFWriter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gswin32c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe.1713386541.old (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-QV01T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-LDLTG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win10_share_handler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-ER5M7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041166342520.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PS5UI.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\pdfwriter64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-PO6AU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon32_v40.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Dropped PE file which has not been started: C:\Windows\System32\spool\drivers\x64\PSCRIPT5.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-LD694.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172042207667120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT5.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSMON.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-327TJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041189647756.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Opera_109.0.5097.45_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe.1713386541.old (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\opera_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\assistant_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-IGGEH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CutePDFWriter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172042210696156.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041180917624.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-KT3FM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-FDP4K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT.DRV (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-INHJ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win8_importing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdll32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041185797716.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CPWriter2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-0HCHF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Users\user\Desktop\CuteWriter.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5454

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	API coverage: 7.9 %
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	API coverage: 3.8 %

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00452AD4 FindFirstFileA,GetLastError,	1_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00498FDC
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: 1_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	1_2_00475798
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_00403285 GlobalAlloc,FindFirstFileA,lstrcpyA,FindClose,	6_2_00403285
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_004010A3 FindFirstFileA,FindClose,	6_2_004010A3
Source: C:\Users\user\AppData\Local\Temp\converter.exe	Code function: 6_2_00403DAF lstrlenA,lstrcpyA,lstrcatA,FindFirstFileA,GetTickCount,lstrcpyA,lstrcatA,RemoveDirectoryA,GetTickCount,GetTickCount,FindNextFileA,FindClose,RemoveDirectoryA,MessageBoxA,	6_2_00403DAF
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Code function: 7_2_00401140 lstrcpyA,strrchr,FindFirstFileA,lstrcpyA,lstrcatA,DeleteFileA,FindNextFileA,FindClose,	7_2_00401140

Source: C:\Users\user\Desktop\CuteWriter.exe

Code function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B78

Source: C:\Windows\splwow64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	File opened: C:\Users\user\	Jump to behavior

Source: chrome.exe, 00000009.00000002.3032378072.00000C4400ABC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: CuteWriter.tmp, 00000001.00000003.2102141728.00000000006BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Setup.exe, 00000003.00000003.2051296710.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000057E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115240271.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857546430.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108011233.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341396918.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chrome.exe, 00000009.00000002.3035389263.00000C4400CFC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=edeea39c-9110-4e78-bd88-ed0632847fda
Source: Setup.exe, 00000003.00000003.2051296710.0000000000527000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.000000000052A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chrome.exe, 00000009.00000002.2991873723.000001A61AB0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

Code function: 10_2_6BFC9620 rdtsc

10_2_6BFC9620

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

Code function: 10_2_6C03F604 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_6C03F604

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_00450334 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450334

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe	Code function: 7_2_004031D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_004031D0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C03F604 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6C03F604
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 10_2_6C02CB98 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_6C02CB98
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9DCB98 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_6B9DCB98
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: 13_2_6B9EF604 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_6B9EF604

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtOpenKeyEx: Direct from: 0x76F02B9C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtOpenKeyEx: Direct from: 0x76F03C9C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtSetInformationProcess: Direct from: 0x76F02C5C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtUnmapViewOfSection: Direct from: 0x76F02D3C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtCreateMutant: Direct from: 0x76F035CC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtMapViewOfSection: Direct from: 0x76F02D1C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtOpenSection: Direct from: 0x76F02E0C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtQueryValueKey: Direct from: 0x76F02BEC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtAddAtomEx: Direct from: 0x76F0312C
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtCreateFile: Direct from: 0x76F02FEC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtOpenFile: Direct from: 0x76F02DCC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtSetInformationThread: Direct from: 0x76F02ECC
Source: C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe	NtQueryInformationProcess: Direct from: 0x76F02C26

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_00478DC4 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00478DC4

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.cutepdf-editor.com/support/writer.asp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe unInstcpw64.exe /copy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c1821c8,0x6c1821d4,0x6c1821e0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2520 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240417224118" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x300,0x304,0x308,0x2c8,0x30c,0x6b5d21c8,0x6b5d21d4,0x6b5d21e0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x9a6038,0x9a6044,0x9a6050
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x278,0x27c,0x280,0x274,0x250,0x7ffdf9937c80,0x7ffdf9937c8c,0x7ffdf9937c98
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x9a6038,0x9a6044,0x9a6050
Source: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x210,0x208,0x234,0x20c,0x238,0x1126038,0x1126044,0x1126050

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_0042EE28 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,

1_2_0042EE28

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_0042E0AC AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E0AC

Source: OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: k..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: chrome.exe, 00000009.00000002.2993699207.000001A61B3D0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: OperaSetup.exe	Binary or memory string: Progman
Source: OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: l..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: chrome.exe, 00000009.00000002.2993699207.000001A61B3D0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: chrome.exe, 00000009.00000002.2993699207.000001A61B3D0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\CuteWriter.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: GetLocaleInfoA,	1_2_00408578
Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp	Code function: GetLocaleInfoA,	1_2_004085C4
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	10_2_6C050CA5
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	10_2_6C050CF0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_6C050D97
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	10_2_6C04CDCD
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_6C050617
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	10_2_6C050E9D
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	10_2_6C050868
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	10_2_6C04C88C
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_6C050910
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	10_2_6C050B63
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	10_2_6C050BD0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	13_2_6BA00BD0
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	13_2_6BA00B63
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_6BA00910
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	13_2_6B9FC88C
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	13_2_6BA00868
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	13_2_6BA00E9D
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_6BA00617
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_6BA00D97
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	13_2_6B9FCDCD
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: EnumSystemLocalesW,	13_2_6BA00CA5
Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Code function: GetLocaleInfoW,	13_2_6BA00CF0

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\installer_prefs_include.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\root_files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\extensions_files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\pref_default_overrides VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\installer_prefs_include.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\default_partner_content.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\extra_apps VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\files_list VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_00458670 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458670

Source: C:\Users\user\Desktop\CuteWriter.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Code function: 1_2_00455644 GetUserNameA,

1_2_00455644

Source: C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

Code function: 10_2_6C04364A GetTimeZoneInformation,

10_2_6C04364A

Source: C:\Users\user\Desktop\CuteWriter.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Credential API Hooking	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Search Order Hijacking	1 DLL Side-Loading	31 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	1 DLL Search Order Hijacking	1 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Scheduled Task/Job	1 Access Token Manipulation	1 Timestomp	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	11 Registry Run Keys / Startup Folder	1 Windows Service	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	13 Process Injection	1 DLL Search Order Hijacking	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	32 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	11 Modify Registry	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	13 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CuteWriter.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\CutePDF Writer\CPWSave.exe	0%	ReversingLabs
C:\Program Files (x86)\CutePDF Writer\CPWriter2.exe	0%	ReversingLabs
C:\Program Files (x86)\CutePDF Writer\CutePDFWriter.exe	0%	ReversingLabs
C:\Program Files (x86)\CutePDF Writer\unInstcpw64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\gplgs[1].exe	2%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Assistant_109.0.5097.45_Setup[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Opera_109.0.5097.45_Autoupdate_x64[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\assistant_package	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxcompiler.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxil.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe.1713386541.old (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\mojo_core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe.1713386541.old (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win10_share_handler.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win8_importing.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\assistant\dbgcore.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\assistant\dbghelp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\assistant\mojo_core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera\opera.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\additional_file0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\browser_assistant.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\dbgcore.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\dbghelp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\mojo_core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\opera_package	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041166342520.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041175667228.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041180917624.dll	0%	ReversingLabs

Name	Malicious	Antivirus Detection	Reputation
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=90&slotname=6092711011&adk=1854165047&adf=3987798746&pi=t.ma~as.6092711011&w=728&lmt=1713386480&format=728x90&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479204&bpp=4&bdt=1014&idt=1034&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&correlator=464567931983&frm=20&pv=2&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=268&ady=144&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=1048	false
about:blank	false
https://www.cutepdf-editor.com/support/writer.asp#google_vignette	false
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=600&slotname=8138180617&adk=373269726&adf=126291155&pi=t.ma~as.8138180617&w=160&lmt=1713386480&format=160x600&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479208&bpp=1&bdt=1018&idt=1057&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=867&ady=420&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=d%7C%7CoeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=1063	false
https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-1-&adk=1812271803&client=ca-pub-6555658820068848&fa=3&ifi=7&uci=a!7&btvi=2	false

URLs from Memory and Binaries

Name	Source	Malicious
https://www.cutepdf-editor.com/images/htabs3.gif	chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	false
https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crxWh)3	OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/y	OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2340254789.0000000001321000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software(	OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/1	OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://www.cutepdf-editor.com/images/footbg.gifageHandler	chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/l	OperaSetup.exe, 0000000A.00000003.2382423451.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/i	OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
http://autoupdate-staging.services.ams.osa/	OperaSetup.exe	false
https://www.google.com/recaptcha/api2/aframetml/r20240415/r20110914/zrt_lookup_fy2021.html#RS-3-&adk	chrome.exe, 00000009.00000002.3041482531.00000C4401098000.00000004.00000001.00020000.00000000.sdmp	false
https://csp.withgoogle.com/csp/gws/otherrj	chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000009.00000002.3041906351.00000C44010D4000.00000004.00000001.00020000.00000000.sdmp	false
http://localhost:3001api/prefs/?product=$1&version=$2..	OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	false
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	OperaSetup.exe, 0000000A.00000002.2957530474.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmp, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/SysWOW64	OperaSetup.exe, 0000000A.00000003.2115240271.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2245114633.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/a	OperaSetup.exe, 0000000A.00000003.2331879799.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.opera.com/download/	OperaSetup.exe, OperaSetup.exe, 0000000D.00000002.2957534795.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000D.00000002.2989234157.000000006BA97000.00000002.00000001.01000000.00000011.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	false
http://dns-tunnel-check.googlezip.net/connect	chrome.exe, 00000009.00000002.3049873467.00000C440180C000.00000004.00000001.00020000.00000000.sdmp	false
https://features.opera-api2.com/E:Y1	OperaSetup.exe, 0000000A.00000003.2115000891.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2112391984.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244869940.000000000130F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2108011233.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/W	OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://www.cutepdf-editor.com/images/DocProp.pnggeHandler	chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/U	OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software	OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
http://unisolated.invalid/	chrome.exe, 00000009.00000002.3031153629.00000C44009BC000.00000004.00000001.00020000.00000000.sdmp	false
https://addons.opera.com	OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp	false
https://fundingchoicesmessages.google.com/i/ca-pub-6555658820068848?ers=2	chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp	false
http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan	chrome.exe, 00000009.00000002.3057855919.00000C4402110000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/L	OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false
https://doubleclick.net/etm	chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/C	OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crxxh	OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382286095.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false
https://i1.wp.com	OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/C	OperaSetup.exe, 0000000A.00000003.2120759479.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2115000891.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2111299021.0000000001329000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244729565.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/i	OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://anglebug.com/7246	chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	false
https://www.cutepdf-editor.com/support/writer.asphttps://www.cutepdf-editor.com/supports	CuteWriter.tmp, 00000001.00000002.2105393779.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	false
http://www.google.com/dl/release2/chrome_component/nujou4crtv5zkn6bgthixtooam_2024.3.25.1/kiabhabjdb	chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 00000009.00000002.3028337867.00000C44007E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3023531674.00000C44003B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3026675618.00000C440067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 00000009.00000002.3034144116.00000C4400C54000.00000004.00000001.00020000.00000000.sdmp	false
https://crashstats-collector.opera.com/collector/submit	OperaSetup.exe, 0000000D.00000002.2974456633.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.0000000000735000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000003.2106095274.000000003E4D0000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 00000010.00000002.2917593347.00000000001F5000.00000040.00000001.01000000.0000000D.sdmp	false
http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea	chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/s	OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3	chrome.exe, 00000009.00000002.3064180517.00000C44036DC000.00000004.00000001.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	CuteWriter.exe, CuteWriter.exe, 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false
https://pcapp.store	chrome.exe, 00000009.00000002.3006803549.000001A620C91000.00000002.00000001.00040000.00000026.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 00000009.00000002.3038379620.00000C4400EFC000.00000004.00000001.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	chrome.exe, 00000009.00000002.3032552754.00000C4400B34000.00000004.00000001.00020000.00000000.sdmp	false
https://www.opera.com/eula/computers	CuteWriter.tmp, 00000001.00000003.2080092115.0000000002154000.00000004.00001000.00020000.00000000.sdmp	false
https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crxt	OperaSetup.exe, 0000000A.00000002.2976627785.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/dl/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/khaoiebndkojlmpp	chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	false
https://addons-media.operacdn.com/media/;	OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/5375xE	chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	false
http://www.CutePDF.comInstallLocationDisplayIconPublisherAcro	Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	false
https://drive-daily-5.corp.google.com/	chrome.exe, 00000009.00000002.3022822662.00000C4400320000.00000004.00000001.00020000.00000000.sdmp	false
https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crxy	OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp	false
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000009.00000002.3028102423.00000C4400790000.00000004.00000001.00020000.00000000.sdmp	false
https://www.google.com/dl/release2/chrome_component/ad6eob6nunr64xlqs3i7jpbbwlqa_20230923.567854667.	chrome.exe, 00000009.00000002.3019622614.00000C440018C000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwareC	OperaSetup.exe, 0000000A.00000002.2978199704.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/download/get/?id=65593&autoupdate=1&ni=1&stream=stable&utm_campaign=cpdf_	OperaSetup.exe, 0000000A.00000003.2112391984.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2341267748.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244869940.000000000130F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2976627785.000000000129F000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2244979109.0000000001327000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2120877007.0000000001311000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2324192832.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2151832624.0000000056AB8000.00000004.00001000.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pa	chrome.exe, 00000009.00000002.3024507556.00000C44004B8000.00000004.00000001.00020000.00000000.sdmp	false
https://sWgic.cVd://wb	chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	false
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000009.00000002.3020231299.00000C44001C4000.00000004.00000001.00020000.00000000.sdmp	false
https://chrome.google.com/webstoreD	chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	false
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.3027563051.00000C440072C000.00000004.00000001.00020000.00000000.sdmp	false
https://www.cutepdf-editor.com/021	Setup.exe, 00000003.00000003.2051296710.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000003.00000002.2051877549.0000000000565000.00000004.00000020.00020000.00000000.sdmp	false
https://gamemaker.io/en/get.	OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	false
https://gamemaker.io	OperaSetup.exe, OperaSetup.exe, 0000000D.00000001.2089349383.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp, OperaSetup.exe, 0000000E.00000002.2097078614.000000000070A000.00000040.00000001.01000000.00000012.sdmp, OperaSetup.exe, 0000000F.00000002.2896641067.00000000001CA000.00000040.00000001.01000000.0000000D.sdmp	false
https://www.cutepdf-editor.com/support/writer.asp#google_vignettebId	chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp	false
https://get.geo.opera.com/.private/assistserv/opera-intro/102.0.53-DNA-116018-opera_intro.crxl	OperaSetup.exe, 0000000A.00000003.2390127095.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417726132.0000000001301000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2374926208.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2402190945.0000000001308000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2382423451.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ	chrome.exe, 00000009.00000002.3032049652.00000C4400A68000.00000004.00000001.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/W	OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://convertgetpdf.com%22	chrome.exe, 00000009.00000002.3040654036.00000C4401030000.00000004.00000001.00020000.00000000.sdmp	false
https://www.cutepdf-editor.comShortcut	Setup.exe, 00000003.00000000.1873116795.000000000040A000.00000008.00000001.01000000.00000009.sdmp, Setup.exe, 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmp	false
https://dl.google.com/release2/chrome_component/dvwmczhfksazn5mwlykzsdqv6u_2024.3.27.0/gonpemdgkjcec	chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	false
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA0	chrome.exe, 00000009.00000002.3050037957.00000C4401824000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp	false
http://unisolated.invalid/a	chrome.exe, 00000009.00000002.3031153629.00000C44009BC000.00000004.00000001.00020000.00000000.sdmp	false
https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crx.	OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://addons-extensions.operacdn.com/media/direct/90/287790/2c461151f9ffff27314ebfffe3c4ccf3.crx2	OperaSetup.exe, 0000000A.00000003.2429099653.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 00000009.00000002.3033429125.00000C4400BE0000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	false
https://doubleclick.net/	chrome.exe, 00000009.00000002.3050923090.00000C4401920000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045870949.00000C440150C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050250427.00000C4401850000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3037731272.00000C4400EA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047798139.00000C4401630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3049873467.00000C440180C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059391260.00000C4402730000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3058899250.00000C440256C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3047558244.00000C440161C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061653198.00000C4402B18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045456901.00000C440149C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3050666604.00000C44018C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045973971.00000C4401530000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3059452971.00000C4402740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3057982443.00000C4402134000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060493740.00000C44028E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3044918462.00000C4401428000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3060868982.00000C4402934000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3061776441.00000C4402B64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3056261193.00000C4401F80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3045707399.00000C44014DC000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	false
http://dl.google.com/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocm	chrome.exe, 00000009.00000002.3018877748.00000C4400128000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 00000009.00000002.3037321005.00000C4400E54000.00000004.00000001.00020000.00000000.sdmp	false
https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4fionKeyBackward	OperaSetup.exe, 0000000A.00000003.2402123887.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2390127095.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2417621442.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2428940437.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000003.2857057713.0000000001325000.00000004.00000020.00020000.00000000.sdmp, OperaSetup.exe, 0000000A.00000002.2978199704.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://www.cutepdf-editor.com/images/headerbg.gif	chrome.exe, 00000009.00000002.3043743155.00000C4401170000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.3041089797.00000C4401068000.00000004.00000001.00020000.00000000.sdmp	false
https://www.google.com/dl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnk	chrome.exe, 00000009.00000002.3038733835.00000C4400F2C000.00000004.00000001.00020000.00000000.sdmp	false
http://anglebug.com/3862	chrome.exe, 00000009.00000002.3026500155.00000C440063C000.00000004.00000001.00020000.00000000.sdmp	false
https://googleads.g.doubleclick.net/	chrome.exe, 00000009.00000002.3031252078.00000C44009D0000.00000004.00000001.00020000.00000000.sdmp	false
https://csp.withgoogle.com/csp/report-to/gws/other	chrome.exe, 00000009.00000002.3006431561.000001A620C1D000.00000004.00000001.00040000.00000000.sdmp	false
https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html#RS-2-&adk	chrome.exe, 00000009.00000002.3056530111.00000C4401FCC000.00000004.00000001.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.215.100	unknown	United States	15169	GOOGLEUS	false
142.250.105.84	unknown	United States	15169	GOOGLEUS	false
142.250.105.156	unknown	United States	15169	GOOGLEUS	false
173.194.219.157	unknown	United States	15169	GOOGLEUS	false
37.228.108.133	unknown	Norway	39832	NO-OPERANO	false
142.250.105.154	unknown	United States	15169	GOOGLEUS	false
173.194.219.132	unknown	United States	15169	GOOGLEUS	false
74.125.136.181	unknown	United States	15169	GOOGLEUS	false
64.233.185.154	unknown	United States	15169	GOOGLEUS	false
23.11.231.170	unknown	United States	20940	AKAMAI-ASN1EU	false
185.26.182.111	unknown	Norway	39832	NO-OPERANO	false
37.228.108.149	unknown	Norway	39832	NO-OPERANO	false
172.217.215.97	unknown	United States	15169	GOOGLEUS	false
74.125.138.94	unknown	United States	15169	GOOGLEUS	false
107.167.96.31	unknown	United States	53755	IOFLOODUS	false
74.125.138.155	unknown	United States	15169	GOOGLEUS	false
172.217.215.155	unknown	United States	15169	GOOGLEUS	false
74.125.138.147	unknown	United States	15169	GOOGLEUS	false
64.233.177.94	unknown	United States	15169	GOOGLEUS	false
172.253.124.155	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.136.94	unknown	United States	15169	GOOGLEUS	false
74.125.136.95	unknown	United States	15169	GOOGLEUS	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
74.125.136.138	unknown	United States	15169	GOOGLEUS	false
142.250.105.101	unknown	United States	15169	GOOGLEUS	false
64.34.201.145	unknown	Canada	13768	COGECO-PEER1CA	false
64.34.201.144	unknown	Canada	13768	COGECO-PEER1CA	false
172.253.124.94	unknown	United States	15169	GOOGLEUS	false
142.250.9.181	unknown	United States	15169	GOOGLEUS	false
142.251.15.154	unknown	United States	15169	GOOGLEUS	false
142.251.15.156	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
107.167.110.217	unknown	United States	21837	OPERASOFTWAREUS	false
104.18.11.89	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.136.157	unknown	United States	15169	GOOGLEUS	false
74.125.136.154	unknown	United States	15169	GOOGLEUS	false
108.177.122.103	unknown	United States	15169	GOOGLEUS	false
107.167.125.189	unknown	United States	21837	OPERASOFTWAREUS	false
64.233.177.181	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427639
Start date and time:	2024-04-17 22:39:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	12
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CuteWriter.exe
Detection:	SUS
Classification:	sus24.evad.winEXE@65/773@0/41
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: CuteWriter.exe

Simulations

Behavior and APIs

Time	Type	Description
21:42:29	Task Scheduler	Run new task: Opera scheduled assistant Autoupdate 1713386547 path: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe s>--scheduledtask --productiscomponent --bypasslauncher --installdir="C:\Users\user\AppData\Local\Programs\Opera\assistant" --producttype=assistant $(Arg0)
21:42:30	Task Scheduler	Run new task: Opera scheduled Autoupdate 1713386541 path: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe s>--scheduledtask --bypasslauncher $(Arg0)
21:42:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Opera Browser Assistant C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
21:42:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Opera Stable C:\Users\user\AppData\Local\Programs\Opera\opera.exe
21:42:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Opera Browser Assistant C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
22:41:13	API Interceptor	1x Sleep call for process: splwow64.exe modified
22:42:25	API Interceptor	113x Sleep call for process: explorer.exe modified

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47952
Entropy (8bit):	6.092206964821143
Encrypted:	false
SSDEEP:	768:VLH4eXvYyHdRtM/Mc1mjGtzg5OfIKVjCsyfAPPYA042+CVMEpYiaXx2+4:VT4eQYdbgmSxfDWfbA042+Cf7aXx2L
MD5:	E51710187732025BA13E1AB2B093CF50
SHA1:	A4EA6D9ACEFAEA9D33A99058AEA0FEF5F7DA8E53
SHA-256:	4694DC1D06A72BBA2DB202B86A18A74F9293520A9125229202671B09B3DB9497
SHA-512:	050C9470A6FAA47E70B30672FECAFF361DCCD62A17973CE4B94852359AB9622686A3A8879A96F94DAD02594942FF79B2835EA08C79EB96894587F961249C722C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w-=.3LSH3LSH3LSHe4=H0LSHe4(H1LSHE.(H"LSH3LRH.LSHE.>H8LSHE..H1LSHE.=H7LSHE./H2LSHE.+H2LSHRich3LSH................PE..d....8.^..........#......P...@.......[........@..............................................................................................y..........................P-...........................................................`...............................text...LO.......P.................. ..`.rdata...&...`...(...T..............@..@.data...@............\|..............@....pdata...............~..............@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\CutePDF Writer\CPWSave.exe.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	642
Entropy (8bit):	4.905333753716299
Encrypted:	false
SSDEEP:	12:TMHdt4LO5lgVUH6VxycSNTQxpaN/2U5NcVl+xA5N+G:2dt4qlguHox6NTQx8NFgVFJ
MD5:	D8385D9758B759942365B1ACC0E414FE
SHA1:	09EA59189959295B260B6165CAE34FED4EB33EEE
SHA-256:	278BCF994BFBD8C625E1FCC67610280200908BA984DC6C99DF5EBAF379754491
SHA-512:	5162CEBC3B4CEFF55818AF845E7174023F4ADB7FFD0B298D142590BA566BD09A25B80C4CF5E8368BEE75D26D8E58F3E4AF5527EBD935A17D5A63EDAB701ACCBB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> .. <assemblyIdentity version="3.0.0.1".. processorArchitecture="X86".. name="CPWSave".. type="win32"/> .. <description>CutePDF Writer Application</description> .. Identify the application security requirements. -->.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel.. level="asInvoker".. uiAccess="false"/>.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>..

C:\Program Files (x86)\CutePDF Writer\CPWriter2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138576
Entropy (8bit):	5.956624180380583
Encrypted:	false
SSDEEP:	3072:Otv63+wI5p9GT/ZRQ/PUe2yNH8YtE/VRWeHl:Od6OwrPyN0tll
MD5:	CB9A520B70BF242E8B41AD4F70D2BF46
SHA1:	5A3C0BD8C1133F45FA55E269284169549F1503E0
SHA-256:	AE7C73975E6C4DA06DC378D595CC0E71C482705242845FAB0FE3AF34E0DD875E
SHA-512:	3FFE489720AC481BA1E23DB013A45060495CABB3C43EF45F2F02C71CD59E75B457D81856445E96AD9E1F93B69AC0DE72DF13ADD9F8001D43112D9DDE2252052C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./%.tkD.'kD.'kD.'.[.'cD.'.[.'jD.'kD.'hD.'.K.'zD.'kD.'.E.'.X.'qD.']b.'.D.']b.'_D.'.B.'jD.'RichkD.'................PE..L.....].................@...........(.......P....@..........................0....................................................... ..................P-...........................................................P..X............................text....>.......@.................. ..`.rdata...K...P...P...P..............@..@.data....u.......@..................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\CutePDF Writer\CuteEdit.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16x16
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	4.974114265981653
Encrypted:	false
SSDEEP:	48:SUkazh/157PIdTBiciL1MhF9AT1QHm9xTG9Az8dGvE7o1LBCfdM9bbrolHHAl3:Su9/c8coMhwNE7oRBIdMbbYH43
MD5:	A68EF3A5FC089796C7275B46A3D5AA68
SHA1:	024380444D5C22BA6257AB46BF382998348F8208
SHA-256:	B24E29CDC992531DB2213E85F200E2E659EB78B0C91BFF9C657269DF7992B907
SHA-512:	8A5578D4EE7DD994040A28635F43E578DD36633E26EEB6AE7398CB2D9ACC6458107005B7103F8F1299443DBB68DFA1623C85E1FEF587CAF0B173C74656C8E864
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&...........h.......(... ...@...............................1)..H........t.........................................................................................k...........................k..s.....R..{s..1..............................1..9..........B...R...c......!...1..............................................J...B...................9........Z..1{..t....c...........B...t..H...9c.......J..1Z.......B..!R..Jk...1...){..1...B..)R..9Z..Bc.......)..1R..9Z..c{.......H...9..!B..Zk..BZ..Jc..JZ.......!...)..cs......Zk.......)..Rc..k{....k...s...k..!..!1....s...{.JZ..Rc..Zc..!1..9B..BJ..Zc..JR..RZ..s{..!){.9B..Zc..ck..ck..!)..!)..)1..JR..RZ............{...s...s...{...s.!!..!!{.))..))..11..99..11..JJ..RR..ZZ..ss......))1.............................ccc.999.111...............................................................................................................................................................................

C:\Program Files (x86)\CutePDF Writer\CutePDFWriter.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5000016
Entropy (8bit):	6.969265682618029
Encrypted:	false
SSDEEP:	98304:rzFEAoXdGXzsIMAvxx3vtAUKtXABIY17wTzWZbJFLOAkGkzdnEVomFHKnP7u9:rzFEAoXdGXzsIMIGVAIzWZbJFLOyomFV
MD5:	493173739B3B0D330A3FEC50F5EE10E0
SHA1:	6243D31FBEAA2270615205943FD5719BE5D1B4D1
SHA-256:	8A6DA523F1E171EEEE2AD1ACA62D70C5ED29459DA8219B5A357CBE112F28C3A7
SHA-512:	22027A27B38D0DE38DDBBB7026439D41AE042C4BBB142EFC164458333B9DAC8E0173D4A6BDF9AF467063A71FD8E5AC3034693D99B163EB963F1980A2BF4D5C82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........fj...9...9...9...8...9...8...9...8...9...8...9...8...9...8...9...8...9...8...9...9...9...9...9.."9...9.0e9...98..8...98..8...98..9...9...9...98..8...9Rich...9........................PE..L......e..................)..p".......%..........@...........................L.......M...@...................................0.\|.....2.h.............L.P-....I..... @..p....................A.......@..@..............d............................text.....).......)................. ..`.rdata........*.......).............@..@.data...L....01.......1.............@....rsrc...h.....2.......1.............@..@.reloc........I......DI.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\CutePDF Writer\PDFWrite.rsp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.139730271830087
Encrypted:	false
SSDEEP:	3:rhgzFkCBl3ai2wAtBkQWKajJmvjVEqIJ7FtQ1YE5CA8TVvIMdBNfqCAfWA:1IlIwkBO1mhKJXQyEctTVQMDNxLA
MD5:	FEF862EB25DFDC61A328B941960629EE
SHA1:	8E20F7C17D890545AA28C2BDAB1845C4DCE673A8
SHA-256:	C21B6FC73A4D92EE282C927699B892A8D7207AC1C78475A530C1D1E4264940D6
SHA-512:	52AB438CC25D63B5697E04F6B3840B7CD8FBAD637593DC3686EC0786786AFD70C9D0C2604850E5F5733C7D8A33AC5E687096698B9889EC39075A4CBC0D5713E9
Malicious:	false
Reputation:	unknown
Preview:	-sDEVICE=pdfwrite..-q..-dPDFSETTINGS=/prepress..-dAutoRotatePages=/All..-dCompatibilityLevel=1.4..-dNOPAUSE..-dBATCH..-dMonoImageFilter=/FlateEncode..-dEncodeMonoImages=true

C:\Program Files (x86)\CutePDF Writer\README.HTM

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5941
Entropy (8bit):	5.543261233847591
Encrypted:	false
SSDEEP:	96:txnJ0eX6L+DfBgYOSIU04bibAh2LYLwUH/eWqIYYGpAU+7pg2HNEqZAIG5vQcU:tjZjDfBgLcVpse/3t9zfDNETzK
MD5:	1444D84C8D78209F0BBAC83F2290EFB5
SHA1:	D414CA3330A30CA727DF7CA600017917B1E35F38
SHA-256:	61E862557C4032005457B16FC9D8E7F50A40C6686DFE159B156DE2A2F8713A45
SHA-512:	0783931ADFF1975A0CF3B9199B4F0FC4E3FDE4D2CAEE9D0F745BF891A4B0D7CD2B2296119FAF7BDE15893E2AAEDF4805DA3B02EC75F7C50F1D0E55D2058C3776
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<HTML><HEAD><TITLE>CutePDF Writer Readme</TITLE>..<META http-equiv=Content-Type content="text/html; charset=windows-1252">..<style type="Text/css" title="global">..BODY {...FONT-SIZE: 75%; BACKGROUND: #fffff4; LINE-HEIGHT: 125%; FONT-FAMILY: Verdana, Arial, Helvetica..}..A:link {...COLOR: #0000ff..}..A:active {...COLOR: #ff33cc..}..A:visited {...COLOR: #800080..}..H1 {...FONT-SIZE: 145%; MARGIN-BOTTOM: 0.5em..}..H2 {...MARGIN-TOP: 1.5em; FONT-SIZE: 125%; MARGIN-BOTTOM: 0.5em..}..H3 {...MARGIN-TOP: 1.2em; FONT-SIZE: 110%; MARGIN-BOTTOM: 0.5em..}..P {...MARGIN-TOP: 0pt; MARGIN-BOTTOM: 0pt..}..LI P {...MARGIN-TOP: 0.6em; MARGIN-BOTTOM: 0em..}..BIG {...FONT-WEIGHT: bold; FONT-SIZE: 105%..}..OL {...MARGIN-TOP: 0.5em; MARGIN-BOTTOM: 0em..}..UL {...MARGIN-TOP: 0.6em; MARGIN-BOTTOM: 0em; MARGIN-LEFT: 2.75em..}..OL UL {...MARGIN-TOP: 2em; LIST-STYLE-TYPE: disc..}..LI {...PADDING-BOTTOM: 0.7em; MARGIN-LEFT: -1.25em..}..DL UL {...MAR

C:\Program Files (x86)\CutePDF Writer\setup.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	325
Entropy (8bit):	7.20106642973316
Encrypted:	false
SSDEEP:	6:V0a6rD5cWmZcuiYCCTagcQvZwKGD9C1qfAvTVqQlEgM7n3aejXkGc:VG9cWCNiSTjcgCDo1qfALVVczjXPc
MD5:	67035D9C58C47711636B51DD93446FDB
SHA1:	47A6CD944187EE8DB6DAC222C38C7D175FB032B6
SHA-256:	1E34D78C2BF339A20867107244BDC5EBC36DFF14A36BB4ABAC133F89A41AC602
SHA-512:	B200DEF063446D2093D82AB67904307D4B1AF08E21E706EB2B64B4A2ECFDD90D7D7F05FDDC11BC66986ACFC7D4144530469B0C15D5C1A8B737AA2054DF943751
Malicious:	false
Reputation:	unknown
Preview:	........[....w..N&J...%.5P.IU..\|..$..y..d.+.`;.....0N7 .o...6t../....z.....J.yT...X.r..hl........ ....J.=.. ;..b.......K\{[p.......V..Od,..o..........@r...P.m.y..Ne?...a.... !..y..$....b.+.,^.....0N7c_....#...].L.....r.#g.H..........}.jy.....p;..V.#aXl. ;.......G..95.>........V..Od,..a...>.....h....A..N&

C:\Program Files (x86)\CutePDF Writer\setup.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8109283062792874
Encrypted:	false
SSDEEP:	3:B7GAW4Pqov:9Gpy
MD5:	98D4F595778E7FD9C0D0FD54E4BE16A1
SHA1:	60DF3C869EB52F749D298B8ADA532076C2DFCC05
SHA-256:	CC7146A7DDE8BDAF039607DD230627D3B95DCAE75FE8222315B7DA02F1E1C11E
SHA-512:	ECB0227475F9E5042D99E1739B7623BB9247C13A9BD91078E007CFB6DF856DFBF928A480ADB6E481D2925808A04EF41F930B52696BE819637515C5C36B67ED48
Malicious:	false
Reputation:	unknown
Preview:	[Preferences]..Concurrent=0..

C:\Program Files (x86)\CutePDF Writer\unInstcpw64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36176
Entropy (8bit):	6.125794494968039
Encrypted:	false
SSDEEP:	768:ncP89wE15MIy/oXkCy6A9RY2CMEpYiaXx2wf:ncZ65Zy/MFybY2Y7aXx2wf
MD5:	7B17AE1C9AED3C8C89FF6CDEF68F9FD5
SHA1:	409CFA7BE022E9ECEBFC03B031B1DB4CF795BF3B
SHA-256:	A7246D0AFF1BC7843BD345903A667974DB97E9B9D935679C7BFE587DE074D496
SHA-512:	D082DBD57460DEFF9B8E072479F5789C42F65EA9677BF7CE976C66F52EBF369253A6C941F09CE4ACD7F0073AEAD886E23970DF2CDC49E34A203C9DF397F7888E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E..$...$...$..\...$..\...$......$...$...$......$......$......$......$......$..Rich.$..........PE..d.....&^..........#.........T.......4........@.....................................D........................................................P..........8.......t....`..P-...........................................................@..`............................text....(......................... ..`.rdata.......@......................@..@.data...P#...`.......L..............@....pdata..t............N..............@..@.rsrc...8............P..............@..@................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer\Readme.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	MS Windows shortcut, Item id list present, Has Description string, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.8503686980267797
Encrypted:	false
SSDEEP:	12:8EEtNcm5jHZ5/essYLMbdpYm2InlyFrlq//JbOJI:8HcmFH/erdEIns6/JEI
MD5:	336659DDD8993F24FBA3932EC9B8591C
SHA1:	A0F7A878F5F8772F42A5F66571CF17A8F4C3ECC4
SHA-256:	960E18ED9F3BAE7D36F678129858809AFDAFCE8385CC188E5FFA65370CFA5C75
SHA-512:	623EC79BC64C7D3C883A514054A454EDCE94187A77594733AB994E4EE7C322711AE47E0BB01B601FFFDF24035CAD9B27EE9D5FFFC26A58A40E203124A65FD4A5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@...........................................................h.S...Bi.....+00.v.a.....h.t.t.p.s.:././.w.w.w...c.u.t.e.p.d.f.-.e.d.i.t.o.r...c.o.m./.s.u.p.p.o.r.t./.w.r.i.t.e.r.h.e.l.p...a.s.p.........S.h.o.r.t.c.u.t. .t.o. .r.e.a.d.m.e.2.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.u.t.e.P.D.F. .W.r.i.t.e.r.\.C.u.t.e.E.d.i.t...i.c.o.........%ProgramFiles%\CutePDF Writer\CuteEdit.ico..........................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.C.u.t.e.P.D.F. .W.r.i.t.e.r.\.C.u.t.e.E.d.i.t...i.c.o...................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer\Try Free CutePDF Editor.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	MS Windows shortcut, Item id list present, Has Description string, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	1.799645445150989
Encrypted:	false
SSDEEP:	12:8EEWcNwm5jyldsTMbdpYm2InlyFrlq//JbOJI:82uwmYldFdEIns6/JEI
MD5:	F969A75892003A3398AA168B46875F50
SHA1:	8F18384ADE4A8C4884F1650A7A6A4D4DC0232F4C
SHA-256:	7CE2AD6F4CB0E9A83D861DA67317212D90C2C8EEE4191A4B01053AF03E5D87A6
SHA-512:	7A865D3CD05DE63E8B25F4D3C5986EF6E14E66E68B52934C6DB396C9C90A76303F7973D158D36E477E3BFFBDECF03C8808C514933643B4DE54EBBBDBE808BB43
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@......................................................`....h.S...Bi.....+00.J.a.....h.t.t.p.s.:././.w.w.w...c.u.t.e.p.d.f.-.e.d.i.t.o.r...c.o.m./.........S.h.o.r.t.c.u.t. .t.o. .C.u.t.e.P.D.F. .E.d.i.t.o.r.2.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.u.t.e.P.D.F. .W.r.i.t.e.r.\.C.u.t.e.E.d.i.t...i.c.o.........%ProgramFiles%\CutePDF Writer\CuteEdit.ico..........................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.C.u.t.e.P.D.F. .W.r.i.t.e.r.\.C.u.t.e.E.d.i.t...i.c.o...............................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002f.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	111512
Entropy (8bit):	4.0255200825467385
Encrypted:	false
SSDEEP:	768:a07FuniAqkiGcXwr4jk0SWrEGexWOBNOL+OLJvnSIxLcRR1vseQGFpmnypo3UDMJ:mqkYXVrj4WUjMhsiIGsn6nFwKdCyUw
MD5:	2FD3A469137CB31D7B1D9037AF66C579
SHA1:	15DE601FE2F074F7787FE3C01E6A8FCF91015138
SHA-256:	EBAC86DF599EB76720B2FD910DB49E519DF1ACF9834E925F9E2760D8EFE3A96E
SHA-512:	5D1CF1FA6498F98039D3370BF5ED057C946AF4D58BF429762E78B5B29C1CCD4934DBEA4AF259FF7DE1950C3CBE2DFB7650DFEB53D2B70EBF05FAF764A7EDFA56
Malicious:	false
Reputation:	unknown
Preview:	....h... ...............P...............\.......c..........x...........Z.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000030.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	109720
Entropy (8bit):	4.03737681818459
Encrypted:	false
SSDEEP:	768:+WFYQotkfGIuUWUjk0ZpDgCMsXjNHLfVyJ5crsxqlxmR1vYRxigXm2yp+3yBhqin:ckbuIDTXXRw1hqi/GBno0DSF8KhWybE2
MD5:	89BA07301458526B5E19245306723D94
SHA1:	C6D35C7B664757EFDF389A92E207F8E045F11462
SHA-256:	658A5A09BA465AEFB49474437AE06E10387E6DA4041887FD571E539A614B196D
SHA-512:	D855C445F77332C8B9C14BA50839F36BDB71A4ED00B741AA7C34DF7AD7CB21541581A21E8E3B6369A86C0A3665AD2C8E8B9C75C9518273F886DBA8DED1D20A9C
Malicious:	false
Reputation:	unknown
Preview:	....h... ...............P...............\.......c..........x...........Z.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\features[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1626
Entropy (8bit):	4.400391620873616
Encrypted:	false
SSDEEP:	48:YqRyRrRUtRCRoRzRMR9R/R5DR3RoRaRRRCR8xRSRMMRbRGjRIjRKBhRORRRqgRDF:FCFUjSM9QzZ5NhMa3S8Xit1WMKV+3hDF
MD5:	4A74A7A9E350C493E6EF5A9A8E5254BD
SHA1:	CE0D6ACC7640DC1071174F24D26B673B183A5241
SHA-256:	55DD79E1FA36D8B00FF435C71B9E967F02BE83B515A2C0D5C32C820DF542B372
SHA-512:	F614AB0AF0E067A536310C3C462356120C831071E5BA7CD06F03BE6049EC3809AFCA8AD44087235CA1E46372F9D4633E3D4C79F7D7D2A1BF1DF82AE201EB69D1
Malicious:	false
Reputation:	unknown
Preview:	{"features":{"01979299c8cd":{"state":"enabled"},"03b8357e5a08":{"state":"enabled"},"06fbbd0b7bf7":{"state":"enabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"26000b66a01c":{"state":"enabled"},"26f7e2d59ecf":{"state":"enabled"},"278deecb29a1":{"state":"enabled"},"3389f6c15eb9":{"state":"enabled"},"3fc0872a857b":{"state":"enabled"},"40db6e644d2c":{"state":"disabled"},"50796754ffc7":{"state":"enabled"},"5448a57d6689":{"state":"disabled"},"5a28d66c82cd":{"state":"enabled"},"5aceda74693f":{"state":"enabled"},"603cade21cf7":{"state":"enabled"},"654296fe9d6c":{"state":"enabled"},"6713f3df0bed":{"state":"enabled"},"6a00b9093bf4":{"state":"enabled"},"7e93fef4a11d":{"state":"enabled"},"804beb213cf7":{"state":"enabled"},"818c3ef12d0b":{"state":"enabled","dna_filter":{"required_dna":["64336fb81a04836eb8108d24fbca3aa3682db0a5"],"forbidden_dna":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"]}},"970fe421a344":{"state":"enabled"},"9a48123ec9e3":{"state":"enabled"},"b7751444

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\gplgs[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8108488
Entropy (8bit):	7.99875147360848
Encrypted:	true
SSDEEP:	196608:GpHHh4vA+IS5m3twMpmtdtBmdQUB2Y6+UsAl0XvUrxV6:ch4vA+IS5m3tBQQQ661lgvUc
MD5:	BF9F58A65F6954406E6DCD29BB458A19
SHA1:	9302E9671FD31D6CE714817D354194897AC42BDC
SHA-256:	AD578753BFC7F03FBFDE3DEA1DA4C281153B12EE9369709A616F6B0149A7434C
SHA-512:	6F3CDAAD855157E94E93208D218C2526D339B0D1EB67E89EDD26D94213D12C1808EA2040862F4B17F5C899574AB10E09B6149919766FCA3146B7A92B391A83B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...F...F...@...F...Z...F..Rich.F..........................PE..L.....[:.................V...*.......?.......p....@...........................{.....~.{......}.......}...............{..2....q..P.....................{..............................................................p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data...5............f..............@....rsrc................t..............@..@_winzip_. {...... {..z..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Assistant_109.0.5097.45_Setup[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2569880
Entropy (8bit):	7.994542409084778
Encrypted:	true
SSDEEP:	49152:jp1cf3NHoGb3R8JKnU7WT33NQVcpYNUgPjkDEUua1qIiWJW4H:jrcPNHvGoYW33Y2gT1a1qEAA
MD5:	15D8C8F36CEF095A67D156969ECDB896
SHA1:	A1435DEB5866CD341C09E56B65CDDA33620FCC95
SHA-256:	1521C69F478E9CED2F64B8714B9E19724E747CD8166E0F7AB5DB1151A523DDA8
SHA-512:	D6F48180D4DCB5BA83A9C0166870AC00EA67B615E749EDF5994BC50277BF97CA87F582AC6F374C5351DF252DB73EE1231C943B53432DBB7563E12BBAF5BB393A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................$(......................................b........................'..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\102.0.53-DNA-116018-opera_intro[1].crx

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1558464
Entropy (8bit):	7.989755786519264
Encrypted:	false
SSDEEP:	24576:hlUVZK9zhPTQQ3YAIC5oEiEq6A4cSDzB2kXpsUpgELS3Qeug5yjKhk:0WcsYyJMb4cSDznXpsYgEYQUy
MD5:	C1B0681E1041A881F378D703BCD62D3B
SHA1:	3F11F065B8329E079F8DDD4DB3F876BFED9E68AC
SHA-256:	C622D0A631A3510E149520C0B9D03BD42CEC098812A3D6161F97B0982248F9D7
SHA-512:	42EA37415C869A1368549299E4A04DF8E709C6F8C8B484DC7BCF8B0EB2E8D239D760C582240FECEA674D4023462686A37B50E5B1E3CD9A77AF7F6D8738A431BE
Malicious:	false
Reputation:	unknown
Preview:	Cr24....E.........0.."0....H.............0............c6....'P...xnv..5._k.....a.3Bp&....?.u.#....w[...h..T..tAL.01.Z8.Q..=...0.....A..\|..M. N.s...U..+.ej\|J.c..b..ZO..].n.1\i.I.0..=E..^..WO.#......#UZ.x=.%WD%.d~....R...4...y.E...3<Xa-...&#.+{.Y.:hA.;C..n...[.?V$$..:d.....,......r.3C.e.CV..d...............Z.p.........O.KU.-.v....7b...KS....N~..q.A..............h.y.y...j..eA]>.^..k3...<...NM...`UB!V.A.=.[...m^.x...qn.pL...B...v....N.S3..&..~.......Lw...\......iAJ...h$......n.J.P..@Fj....+....M.!y.vd.T.x.B......8.)}.4;)u.X..t..}d...H.>.......G.......a.......PK..-......b.Xk.s"....S.......0d406bdcf61e6d381f23.svg......................Mo.........E:.Y.....bNB../.......$A.E...U=K...C..vjz............x..py.C.-.............;X`A[.OW......n.........p........x.q{........../?.\|..8\|..._Owq.....W?._..............4........7....r.x.{.......... b...\|..l};........H..U...-< ....&..r.Xx.rZ]..W..A.{.G]..s...d5..."C..W..I5...:....=.......D...9 .6...-6.0.cgYb...S~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2c461151f9ffff27314ebfffe3c4ccf3[1].crx

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Google Chrome extension, version 2
Category:	dropped
Size (bytes):	7122746
Entropy (8bit):	7.999414748600489
Encrypted:	true
SSDEEP:	98304:dNMrj1b+wYT81lzKLstWE8yZwS8QjH39KeOsy2add2wj1hakIhmWd2Bc2JGGdBjT:d+teM8sLjH3ZyHflakIog2B9UUu8fV
MD5:	2C461151F9FFFF27314EBFFFE3C4CCF3
SHA1:	B52EBA8C0AF62AF12B358A507D23175ACBDD7D8B
SHA-256:	DEA799F75750F62A4491A81DF7F2C9ADF7B4C6D05D0B0BE9060686C1231C85F0
SHA-512:	CAD5B537FC21C9913A6F53AA25AABA6176A9A62F34A47D19BB23E38CDA5F73C6CAC769C4A2D509EBEAE8ABF424F576D95F9B549122B22634E81C1150AB20E533
Malicious:	false
Reputation:	unknown
Preview:	Cr24....&.......0.."0....H.............0...........)..^.+..#.5.4o.@4.u%'.i..[....+..<.M..>....._..!....\|.k...F...xL....{.`..}..".Be....r.y..D.....%.'F.....~....b!e...0I..g.E.U3.......1...$.9....".M.T7~;..rTTA......\|.c..e4..V.).7.mE..... U.0!......y<.3...G.jC...x..O=....l..\|.y.$2..nm._1.......[X.......m..x.N...p.Z.\|9W..4.iQy..g...VL`.9...;[.~.....q.VJ........i.,SH?w.M.\U.moS.4=n?.Q5.]..m.-.:.."...;...SD.~.....[..1$.Po......8.dY.U.....2.lM6&.O..n.o.V.....xB..k.D......\.M].0..g....q...X>...a.-9..GpeA.1g.w.F9.&.q.'..T..<..1w..[.&PK.........~.Xs....^'.........aria.js.k{.8.0.....E.3.-J!..d........Nz.=^.%Q6#.TH.ck.....o.....y3.....B.P(....?.U..A.uF...........]...+V.X./a......z..?>...&.o.ye.!...n..b............m.R.s...wD..E9.].h.G..0Gh..#...X..){.].8..@...5....}._........qh.R...\|..".4%.c4:#.U......F...O..6:..X.;R......c..D?..Cg\.....Y..F....JV.H.+J.....VY......oW.....8;6..q_.&..5....j4FV.......v..qc8...N.'.TYV.C..WWw.p..r5........v..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Opera_109.0.5097.45_Autoupdate_x64[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108893416
Entropy (8bit):	7.999992755622592
Encrypted:	true
SSDEEP:	3145728:BBFS7Vpknp2sTT4bt+vy45oRmdfAKLlEPE:Bza6p2sT8btA59dd5EPE
MD5:	5014156E9FFBB75D1A8D5FC09FABDC42
SHA1:	6968D1B5CEC3039E53BBBEDEEE22E2D43D94C771
SHA-256:	7A01E11E1830BA3C154E5A6C383DA15938B1E48F89A2FE4045CDD260924B6802
SHA-512:	BFC5C44881D0FA7BCBCCFD530D874FA624ADEC50E1A16063A72DE12876D2DB10CA5EDD6FA841EA63E9DECA3FF2ADF54065F50719FE051D41DE92BB68EDBA4016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................z~......................................b......................Hk}..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\109.0.5097.45.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.929804541487484
Encrypted:	false
SSDEEP:	6:KdhlRu9TbX+A8/5RFYpdrjFkojFX0CdiYCWoA1G:KLuVA5cpdG007vWBG
MD5:	5A10A67CAB2D1C8F0664D96A8FFAC7D6
SHA1:	3C936A6B07142046C31BAAADFF6532C8FE6526C9
SHA-256:	0EC120A054C3C56605B210E4DCC233E58EB1771C53920B8D7A28604D2B5D15D6
SHA-512:	696EF811A44E8808E07187DC82CB5918196BA91AE1C60EF6163C1861AB863C916A91D3CA1BCA552C93BE536C92FBC3A66AA10F68E0FDF97DFD50F5FA7E411895
Malicious:	false
Reputation:	unknown
Preview:	<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='109.0.5097.45'.. version='109.0.5097.45'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	7.4499555099946
Encrypted:	false
SSDEEP:	24:ciP9m1YeeE54bc3qw8LztHGRYD7+qtemyjzhGY:cQ9m1YeeyT3j8LN4YD7+qcrzwY
MD5:	F4D70BC86E8544D7758742C2EBA89D47
SHA1:	5DF4635794AB25E2F88BCF8EC39C19A09383A029
SHA-256:	56BCD46DCFAE3147A8B8B3D00EE5041DAD4655E83A7E829BF637377C96538643
SHA-512:	D20CBD543BF97890D64C07F9E99188604F4DC5DEF904AD74229A3B1D9D9A06FFF93AF711C99A178799E9DE472D930AA52A0C154F0D2953ABE5FFC3CFD1708AB9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................PLTE.................#.."..)..)..(..(......)....)..+....+..)....+..+......+..+..+..+....+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,._.....5tRNS.........#'/5:=@DKPTX]flrv}.........................g.R....IDATx.....:..`M.....jz?.4..?.){O.Y.......u.8H.%.4M.4M.4M.4M...8....wH.. .^..m..M.Wc.H9/]........)...ft.{n.I..u..:.fg...3.<..^q.e:h....un.L.3..I9..E......Do.Q.>^..._...n.dI.-mz3X...)r..c. ..c.%$...G....$..\:..........M..e0&.\...r....OB...n...vH......X..V$.s...Ee.}.Wz$.....p.-...`Q!...nV..9.7S..p1A.+e.......'..k......../$B.A@..a...:t....!......\.Z.y.y.0..F......_.JaAhK.......~.A.JM.W..X.P.X.f....?..g...\..7..S......m.Z...?k#..u.r/..j<.>.7W#nE. ..X..j.D.... ...M%.-...$..ru.7x.D-.;c.I.........>...?..U..Z.. L........4.T9.21..I.9....jA.8i..)h.K....>.....3J.x.A.`.2j.b.._...S..>...t................2......)....j..2....;.v.9g..$M.R8...L.o....N[$...;5.{.f..F.x>s.u.{..gl.a.F.3Te".X.I..-.4Z...v..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-100_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	6.996664132200843
Encrypted:	false
SSDEEP:	24:WOadsjPV3jjKYdev9M9MZlz2vaaUTaSBeRxuvzAYOG/:WOadsjVjlcMA2SySsDuLh
MD5:	7F69F89F11FD675B36E8DE01DE3C29AD
SHA1:	B91E00E68889367DE138FFA5E7FB3C9DE2A18467
SHA-256:	3829DBEFE8BD528BE268F3181A902E1FE78883EB8F8AAC679C9985C2AD13C6B9
SHA-512:	06C162296C5AC62429E6E5DEC07B836E6053CB4EB0291D8ED904F71CC42352C134870ED964517D2600F03FD7CF3821EE877EA83A330C9597FD7D629F9C2A6432
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................PLTE....................................................................................................................................................................%:...5tRNS.......r...uXLC?%./.....m;.....}..hd4xQ.).H.\+.$.......IDATx....#+...j..].........D. \.].....?B.a..a..a..a..<...iy.G.....s..n.C.^kxl..E........4......S...XTM;~..../..v\|R,_............X.a..].....)[...3}...4)......+..aT..6......h3...].....K....t...MH.&.RF..3...k.z ..3."..X....Bl$.'...f..N..SfP.I.).[.D.L1......O...t...Q^.90h.}Gh[W7X....e.$G.z.w.TTT..B.w.W.%)p...s./$C.A....}.d.0..1o.....1.....Y.X.H.._(s_/x.Z.q.R..6......._....EB......SG.)5.H@...o6...?5......sk..\|91>.....1Z......$....O^..5.>K=.<f...k"nbOZ$..=l_..U.......x.E...X.Z.\|...A.}...':..Yojq...j.:..... I...o.%.......bU.pvJ14.b.W......<.D......._.....Y..Xjm^r...../.!...0h.\|.;..?.....^.s.~..0,.5\Rbr.......t.....Oa..=R&*.}.1.&{.....T.k._.T..M?.W#J...U..f..F-w;..E..lG.....k...xa'...6.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-140.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 210 x 210, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1377
Entropy (8bit):	7.522866206704587
Encrypted:	false
SSDEEP:	24:ZNEmuY++eydyWnImBwVWFJYpla6+Qzjy4EOTJACEUSC1EZPimrNlUpiAPxgz:ZNE1YNeARI4w+v6+QCOFrl1EZP9xlUtW
MD5:	A0076D9B3DB9054267A7C86C9323AEA1
SHA1:	22B85AEEC3E3804FE1F6E91D5A9AC1C6A0153B6C
SHA-256:	2637072751E1E6398C45D2C5B22C54ADADFBBD4D3007238799F5DA63F846167B
SHA-512:	8FB750BDDEA61501F8CE2B0D0C27D29F322C9F297777F26B1401696C836C844369A9F6890BBB9827682DEB70004CD98A973A0742D2D218F12A9FC3C301F10985
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............Gnp....PLTE.....,........+..+..+..+..)..".. ....+....+..+....+..+..'..+..+..+..+..+..+..+..+..+..+..+..+..,..(..).."..+..+..+..)..)..)..(..%..+..)..+..+....+..+..+......,..V(...6tRNS......mW1..f.:.`.s.....z...M..'"...PJ,...?.6..[AT......5IDATx........................... .....9s..........K...b.n...w...r.-.P4g.Z....."...g}pUg1......w..hd..q_..E.....@40..>...]K.gum.Cu.]..inF...T..........[.O..'.e........^....m..{.....ST.+!....].I.%{x...he....f.3....v.6>.7..<ND5.....;.c..._T.B.Y......M.."E.w.B...;y.(.(.Y....A...f.+.N............:8W.sP.N....fd6A.........Q.$wA.T5....J...a&`...7@..J..nJ......<Pe... Y........#..}0.....1.l.`.k.O.j ...jk.....C...T....,.....+.U\|x.8..,@.....Q....o0.`...k...;.)..w.F....<..]..<4.n0...+qe0v(.7.....s.`X.=A..~.2..\|W..A..^.I3vC^..j..s...^.Oj0]0....T.Y.2..;.I[."...\.Y....H^.x.+.@.....2........w.5.x^.@m4^=.AM4^.u..:..`....f..VJ`:..=T@y....@....u.....2....L.U......x.j....8`N...Nb.".

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-140_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 210 x 210, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1386
Entropy (8bit):	7.150203984555013
Encrypted:	false
SSDEEP:	24:ZpGW5v411Tsolci+BFR3igG0VM2TstxzPVlV+WABiHLwAHWDmUvcWO2hBg:Zj5vg1TvlcPBFIwVjovPElyDYmnWO2hO
MD5:	F601DF01A867A51514EA89AC9BFE9B86
SHA1:	827CF9859B7B1864236CD1F03E8AA40758285E82
SHA-256:	CE3559B2EFD6D547FB822440690CFBF793EB70C98154AD4DBF3A7C0E1AF5E166
SHA-512:	2714E67298058E8FDAD4459CFA17E2C7C67353BBFD9EA850BB403E669AE085BA579C31F7D64889470A97565719342E6A30EFE2F66566783197194433AA947600
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............Gnp....PLTE........................................................................................................................................................................,.H....7tRNS......."......_..E:....bL(.w0......rgS6+.{mY...?.G.q....:IDATx.........................@o\...\|..ff.r..W..'WS...I......`>.L...M.x...w.F.{.O.....e5..z....F..v.....TSX...;....-s....W....x...U. I...U.T...i.......a..L.l...u..{....J..B.=...a.v.)/h....a2..?b...N0P...~..Ko....#........l...p........(....1e.x..$!en...~....a.......:.....L.S....l.c.(+. ..(s..bBY...F."'..N...\|..h...B..).p.(..!..SC..o........O.h....?.g.....E.._.S..:....f.%eh..(....6..,...\|.8.NQ8G>....M.C....1....N...15..C........M._....=".J.A.W...../.j.&.....mW).j..E..h......W.L.;t..s8.Q.B..e.b.....l......U)..F..9...d6.....svm....9........R./..U..-(....Z..\|...U....t..i...d..a@.....E..K.3E-.7DO..m.Q..........l...#J>.x.......g..)'..........M......7...-..)j.U.P...T.M.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-180.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 270 x 270, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.694831501719709
Encrypted:	false
SSDEEP:	48:UFafoMN0Sy9s6HTnUeIMt9FwDibMxb7ZqWN240P9ERHUjk5wEsq:UhJSmIzdDibMd7sWpUERSTED
MD5:	0A76F51F6169A31402FF7C61CFD05161
SHA1:	843A32D6DC0D5B9D97C5F475F96E49852823A103
SHA-256:	7CA510381079A4B166E9D5FCF0DC005D9606197E8636621B655D6459941139A0
SHA-512:	7056949D7AA9CC4C96F9C13D656CFFFA9F9A49CA78F6BE3037CD38CC1D8712917CC235099F24723BBA26FC9FFDBA015480309D0418961C1116DBE7B65DE6301F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Oo......PLTE........(..)....)..+..+....+..+..+........(.....)..+..+..+..+..,..,..+..+..+..)..+..+..+.. .....+..+..+....+..+..+..+..%.. ..'..+..+..+..+..+..'..)..+..$..+..+......7tRNS..!4AP^iw\|pcWF<%.1........8......K...............R.W......IDATx......... ..eCT.............<....}....Q.?..k..............6R5....v....b.\....Y.k..V..x.n..+dL.i....kCd.6..`:SH?.9..qa.4.U.\|.<DZ){...!.H.;\|J..:....L....?M..Re..]:..j=T...jvo......C....W#\|...-.].....i...D}.b..T..y..V..+...`<..-...w...!.w..N....;/....,..q...@.u..N......e....k......a..O.....K^1...a.j@.W..X...n..x.Mj..h....f..(.>N....x.\....choR...O.x.+....c=....r.OQ......!...90../...x5..B.A.&.`u.9...N.;\|..l".b........)L..h.;.\`..K..Mq].0.....r.yx2.......s..._4....T).G.^...z.\|....>%}<(^. ..>)i.a%....pEI...&..]Ck.%g<.D..:S.g..l(6.#4.A..Oq..\Z..x.Pjr.........S.`.m..H.W..nm.(..Y.^....?......g..O.(X@S..v........^..(..................9%M.w[....^Q.#.!.Q......{.z.%^.Rp..f...l..%Jz.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-180_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 270 x 270, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	7.394848436660686
Encrypted:	false
SSDEEP:	48:+CaN3f3AzZHpQ0G/ieZvDODsuqK1pFidzN:+Co3MJQ0GamvyDsuzf+zN
MD5:	67A0163CD9753E42360222A17173F593
SHA1:	E4EE5C2288CBD5D354AAD1905B917285A3DAEB92
SHA-256:	F7EB888CD9BCE4641FCB01088B05BE242F616DC06C3F823E51FB63B53B6F14F5
SHA-512:	87E69E15BA6DEE402DBE5A90DA864136EC2C6884C204A567AD461E0181E70514F73A7DF22A47DE63D4829FA937E56FC4C08CB6C5268313F7B9AF1E7217D81F47
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Oo......PLTE...........................................................................................................................................................................45.D...9tRNS..-Qcoy......~T1.h....#..u7...;..H..M..@......D..^X.&........IDATx......... ...].L...............\|.Km}...\|..R.i.....1+.6...3&L..c.....eX..y.'.Y..7,.R.f.e.v..o.w.6.=............W. ....#s.......o..Z,....A..W\|Q/. e.3>G...i.)1"w.........."?....C...;2..p..s~.'U.At=F......\....>C...!..^0..1C..SD.....vY2LP.....K.j.y[o./W...M..3...v..^k..`..0.\|.....9.JOh.........'.....0T.!.+>.{..oa.7.....o1....c......U..BQVv..a.0.(..$}.....8...r{..0.oS6F....Q.l.PN..........."w.3.......I......E....)...U.r..@...;+.Jx..;..u(.Y?....."..S...j..Ym..?;%.9.Z."..<J...nO..<.(h[.X."./.P2...#E'..(8..NG=..HI..r....i@A..M])..Ec3...<...1.....;..bb'7.....))AK..YV.`.CCg...^7....m)*#..%.4.%.I.K....D...8..vN.-....q.c.x........%].B.....T......f-..). &...-...6.Gh.D.[..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-80.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.264599360772662
Encrypted:	false
SSDEEP:	12:6v/739dOKPEZNcNNNNNNNNNN8GaNNNNjnqmQpiKDp6q43r8LsduzlFlCgeYeAnnF:aTw7GIndQsKwq+gsduzlXeYeAn/b/5
MD5:	95A8F1834D8DA00AD94C0CF2AA09853C
SHA1:	7E830E3EF55B4D7B9A18EC8C151BEBB2C28F0069
SHA-256:	F287370FF8C7E2BA120407CAFE09C1FCE674AE8AF5BD5FCC0C2DD1C6628B9CE9
SHA-512:	C89BE6E503C26EFD4EEC12C77E091570E187FF64928CAB01F6F873D9CA3769F019A1724F76B57C9D4038495E29CC4106F919082913323AF1ECE7AFF820C828F1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.............PLTE..............%..!..'..(..)..)....(....)..+............+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,..+..+..+..+..+..+..,..+..,..,..W+...0tRNS........'+029=GKVZajov............................!....'IDATx......0....0..._.wy].%].w..:!..d..a..a....OqV..y3.:.:..bT..i./K..:...U\|=...X...+...g....."=.5.j.$du.>.....".....q^&..0.\|....C..g..G..........0?f.@.G.F..e..d.B..K.K....6..x.Er..nWP.{h..-....n.3X...?.@.A.d.).>.%..>..........'{J.....$.. ........0.<..&T..3..}.l.'...(.{m..T.A.......=..`J.....~.Z..]...~..3.2...r....n. .F.... "...O,^\..,.:.T.x.Q.c.)..?........N....=~..G.@..{.3..x.N......j.W.{...91....I`..[...EK`.,.E.'..O..Es..Z..7iN}@xU.6.9..OwD.j.w.....v..Y.b.&..Ucc.N.W..A.,^.h.x.......;....}........... ..a......_.u.fu.......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-80_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.429896741621628
Encrypted:	false
SSDEEP:	24:jHpFt6IS0OhLQ8Xf0sIhphiSQMXdRYgkdl1:jHpP6ISnlQq01pnQSdagOz
MD5:	3015766C5CA769E54009F167550F7389
SHA1:	0EFF02455A1E0FA1724BB1D4333C3D24329F9E9A
SHA-256:	0A9129BDE051C17E96E516D5BC509E1A06A1E066A5E2796627CBEF8630002B47
SHA-512:	7EA7495163E0246F78F88DFD0EE72B8584108C286227D70CEC9DE125747F21F2618F46F7197F7CB9C0F40D297BCC3582CF70F54EBF7F9EB10941FBAA6BF0149B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....IDATx........................`....u...8B)A.....3...!...............(.........!..1B9....mo....?....MNN.i!Rd.A.=..Qa.%.H1....S.p.3x.+f...T.......#./.Bd..Z.a.W............0F.cEH1.....N..y..+X.p....8.c.g....5@.'.(Q.A.-r.....Q.Nl.)....{..(0A..+.T....;...."....oH.....3..!50~.{\......-..S...q.6...\c.o.n..&...rg.._....Nn..{0..._...<...(..r.#..op?t.S42.T.........]..@}j.....#.Uu.....(.[..m...C\z../..(0.7..GC..m.>...$.....P.E..}.....u..}.........?...~..,k.s.Y`.......F...#;)J.....N.........o......n.t........T..,=l.a-Z....4I...<X[v....Mw...m..U.......=q..o.....:..M....]....Mc........bT..<.C..o3FISv./... 4..d...NG..'.1E../....gU>c..'LMPj..y..I.........k..y.a.B......"..k.hp@..[..k........[.a........................#..t.:.[.....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 70 x 70, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.2639879483870775
Encrypted:	false
SSDEEP:	24:Ae+exGFGyzF2tpU6KQfXso3qppW5g12QzXsKnV3QIKuG:APe0YU6rXVqppW5gohcFQIKuG
MD5:	EF710F4543A25076078FBC1C09EC9E2C
SHA1:	E4EA1C2CB24CFFF03569DAB28877D11F9C6CFC74
SHA-256:	FB5662C5FDE7D49862DA2E0253AE03DC7E5F9AFD2EDC65D4EFA6DC3A3026156F
SHA-512:	FC979D06806A69DA71336533D96B1CB66B227064A224E23C6F5BF9D1FE4E85A9D9546643CE296BA5F04C025284D5CA2C445C52695AAE669735A2A5B48CE07A00
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F.....F.......PLTE........".....&..&..#..'..(..)................+..+..+......+..+..+..+..+..+..+..+..+..,..+..+..+..,..+..+..,..,..+..+..+..,..+..+..+..+..+..+..,.kW....2tRNS........!(1<BHMQY^dkoz............................f..#....IDATx...E..@..P.=.....-..h..Mh..F......V{......v.)..7........Gz7..M_..........b...'..^.yP..6^&.i=..~hH.:...._..m...i..1.....\|R.@..A.f,K..H>........+..M2...$O=.u.h.[..<&.U..cq.(....u.I}.zp...v.......p..\SAS.).:K..s..#.4...]1L8.H..(H..Cn..]...i....`$.%..P.67....b....i.?.+..8...G.}...<...B.T..Ob.qW..F^..gj8.D..h......8?R....M.X..,N...5e.q.....0Sr.......g.G...{1.`lf.....@...o.I......n.n.0!..L...00E._m..mJH...A..c..D.....D.......~...%.v....A.../...W'w.H........9sd}yy....'M......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-100_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.641591962867115
Encrypted:	false
SSDEEP:	12:6v/7cZWA5gFgRjSjGKz5hyE6CtTKM8Eg0aNWXRwFfowiB51AK2kpE4aFs9o0apq2:qAfRBKz5hyyNL4WXOWXRAXkpEFsK0aq2
MD5:	AE8EECB8DB4D20EFBD816B887EF75840
SHA1:	1D0CC741D0A75E5E8AB51DD8B6A99F5E679EF5DB
SHA-256:	3FA9DFC982544F3FFDA0795BEEC69C65D6C5883BE0DE37133466E643B5F3AEEA
SHA-512:	0CB71EB86AB2C5D4C70F04D7B10736AA453D51B56723ED7C9DC332F92EA428EB7861F23DA2E30416BEA8CC59877BA2C87F3032EA473028A7DF8C6A299D517572
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F.....q......IDATx...d+A...... @..@ ........<...C.!.........E (J. .8.C.7...z.....\|.(...wvow...0..0..0......c.X'....[.......k#.....J%.Q..y.7\|8T.....E.1.x..e.-Ys.L......g=....J...2e.X1].u'A[....G0......9..Cg..d....)k+.$oe.WV"...I.+0..R9m...s.tS.S.@P..K.d.S...&..m$@._.e_..Z...,..=..!.....t2s0..@.s...X.u..}....{.c...b.....X...#..3.......C.....r.,.S}.5$b$.MHP......L.j.p...._..W..rH.pKJ~..I.A....fH~..=..9"...&..kR...i.?....B..6\|".L.oG.8....x G..&.O../.-........../.c...YI../.u...g.{..B>"..V...)..k....~...6....X...pd....D.)...=~..\IA.C..$2.......]..Y'..D.....!..1.S..,.A....!....../g._.......M5..?I...........K..vv.\|h=.r..S.V....r.;./o...../.NX.O..\.a..a....[..[......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-140.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 98 x 98, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.440994235634435
Encrypted:	false
SSDEEP:	24:COv1Ps6OGRGu54iF380GX40OBLGTyJ5F0AiYEmX:Cg1b1z380e4vBLGTyHjiY3
MD5:	9590B4BD9378A2D8706DCBDC630FAE8A
SHA1:	751EB2AA5CE4E83133A73FDB9EFFFC013BF37EC8
SHA-256:	84F8EBB629791E0B73CD53D7F3445D685145D0787A207E25842B237C98A8C99A
SHA-512:	B2666EFA916584C9B090E305EDA116F2A90C58862FA36A0963176B09B493A4CE5E601A178C74BE0F2E59811AD42CD1D5747E8A45EA07C3F5D52B28E177FA5603
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b......{.<....PLTE........!..#..'..$..&..(..'..(..)..)........)..+......+....+..+..+..+..+....+....+..+..+..+..,..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,..+..+..+..+..,..,..<T...7tRNS.......!&(.3:BKPSUY^bgnty..............................7H......IDATx...E..0........h..O.p....kV...}-V..H$... .bk.>^..>...z...;.O.]f%..X.....f..h..c..B....ng.^w8_;RN..%..7v....k..2B(...4H...x..K6J...+..b.B...K..$.<..;.}`.^:....R...1....e....k.]rlK..).s.7..S....C..q.7J.Z....E....8O..n?(.%.b!.....g....9..\|y9...Ghg...S....G.W.3...r.m.U).Q....c1...A.(D..h.q...D=_..gT.&.VxnAG.yj...@.BMr.......J..k.E..b....q..z....4...Y.Z.....U.X.[......h^.W..2.z.Pp)D.J{.3....>..'.v...rs...M...".GO..f..I..}...E..e...2.$q....\.V.Wu.x.W.iW.x..1%v.x....3.p..w..Y.+...%...7..#..V...C....sR...G`.....$(18Z..cKu2......Q.-P..Q.5..O..2?.g.L3...$..]b..}5c..6.mz......s../ix....F~....Q..`:...U.jJ..m.R0......../.3...s..L......c.M...?z~.H$....G.....[....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-140_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.694615159268941
Encrypted:	false
SSDEEP:	24:fbIFkRK4nrvxryp8AHxXVT70X2JbW/tQL:fbekRTnTx+pvHvT9W2L
MD5:	9B103E9DFC26DD4D837DF8AB55EC4FB8
SHA1:	6F46830A3A63E0EEC923BCCFAD57D8391AC3E559
SHA-256:	99CD2B5809AB9C604613B305BC80E6F68B858C1289C07E84AADABC4C3768FF32
SHA-512:	E8023067638A9FB849AC9364A45C8BE9A6DD325FBC704D960CF270CE1075AC6C9D57B7F96CAE62985E92E5543DC2F2A43D473A2DCB0060AF067CD474AAB7E59A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b............(IDATx.../Hd[.....Z&...l.d.M0...d......6-<6Y,.&aA0..M&.I.,2.`.........}..z....&....{...............MY......#<..S...#.p..v.&......+f...?.EG...c.a...).8BK...S.0{.2.Y...X\|.....}\|..\.;.x...!.\|P..^........l..}...m.......;.+.......w.....>{...q.k.c.G.q.[....XQ-...`..o..5^......G.b.q.<...x{.q..vg.h-(..X.{...P..>..p.Ya.Rp.t.<..XWy.z.up.....v0)....Y.w.m.%..Hy.t...%r..N..C...)......?k.O..E[....7..~....)..6........4\|...0Y..{.0..t.....s......)l+z.V....9...TK%N...uV...U.\|.Y....7.xj`.WS.4T.O.w\lj.....h.)f.~7..:...N.Q...u..../...h.....8W..5...{,..z<,.X.sa .....;.I..F=nJ....."U.\...Nc...\y....Lq.^&.2.i..a...,.f.4...S.g;M....u6..a7[...9...-..A..T..-...9..K....u..s........C/IQ.4A.h.".....4...p..f.e..$W,..q..F.....H...b...uh...I.^......l..;L.".:......`.gL0.+.x.............h..oC.Lz.2.....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-180.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 126 x 126, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.574565747601677
Encrypted:	false
SSDEEP:	24:ncsPHr2aLNDn0sd+rBfKvFGVufbZULKffNFpH71Mey9a/ttyugJt93gfQN:nTzhLNbdUBCtgYVUL2pqIPyugJtafQN
MD5:	7AB03A8BA1C0243B96C4124CD5341073
SHA1:	7DE490DD37EBED58337FC0DB654F12398E84A78A
SHA-256:	C5D33EE3B5E8DCB9E9AEAE5F14D0E92CF9BDC16D6245CE65DD4340C8A0BE4F26
SHA-512:	C96846F008E8AB440009BF2442A2CB9DB3D24452619C8C2B669395F971F9A316EC62693BB586A94E565F1CAB893BF665112C34CC1FA46319E571E3FB4D2FC41D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~.......U.....PLTE.................$..%....(..&..+..(..)....)....+....)....+......+....+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,..+..+..,..,.w.^...4tRNS........#'.49>CGKPTZ\ainrx.................................IDATx...e............j.[{o\|.....a..?.O..L&..d...rg.<.oO......Sq...h..w..Q...4.1.uZ.'r.G~..u.9r....F.....4t.9HX..P.i9l.+.b...-.$.5$....X4]\|..].....T...i8....\AB.oJ...P.u.Ip....\|.....a.^..%..$j......K..........a..S:.....{-....).]..t`.....J.....Nm........=..O..m......jS.Bk\.L.O.Ae.~..B.F......g...b.S.x...Q^.".......tyE..2....j+UDT.r..X...9R....W..I.......r.bK.....A...F......P..z.c.....3%..g.......j0....aj@a.C.o^........m.m..J....f6.......}/..C......Q..w....Q...'./e.Qt(.,.9.DQ._...\|D.Rx;0p..@4o.y..Q.".;.".<)...%v..S8 ...zj..Rh...w...U.#.Zj..J.l....y)t...zi.9^...'0.V).R.nXL.=.~.5.0Jk..o.Lk..U..`.m..P........KL.)T.Z`.....[^.....6W,fZA!..%4)l..X....~...SJ....B+.-et.)l....4.Q...8...F.QFT.^.#.{.B.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-180_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 126 x 126, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.069967959827789
Encrypted:	false
SSDEEP:	24:ufdahMt0bORtkTn8pEWze/LpuWyuGShLvoTY:i0hZbXYunDb0Shs0
MD5:	1521BE4B8C8F2E0CE20A89F163DE3909
SHA1:	C291448B74FC3D7060C1DF4B35026084981EE441
SHA-256:	E5112331E0E2684FFB5ADC0AC23324D9836CF067111F1F5834C77B1153A8A5D7
SHA-512:	6A0781D275DBF8FAD4EE464E759DE74399918ABDC99CEF3C74E5D66A0D555A8BED363DA964C15E2AD9AB3CDE5A17D537BBCBADB10585AA1EF50F0B614FC39A50
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~.......U.....PLTE........................................................................................................................................................................,.H....7tRNS..........!%05;?DJOTX\afmqw\|..........................\|.%.....IDATx...U..F...khfffnSi.;..cy..c%y>..]v.t...r.\._..l....+.y...Q.FF.....n....V..)...Y.B...y........o.....kWF.'..>...F.To...K@.,l...."8.....^..Dj.W.........tt\.]..~f.Z....Y.=>...."...O...-................Y....n.FB.XN....7..)..N...Cu...K$a.5...x+$."...o...7.2..R.g..Z.8..........&..D..G...8..y......e#..q..>R.Sz...q...8-D.!....2..E.....4V..q.:.81...h....{blR.tC.)...B_.8..-;bl...s.r../@...#(B..c..Q.....m.....e..h@....5.mG...t.....1n. N..,n.T.Z..)#..1..a+b8.b...4.sL~V.B. .....^.7o.(.....&....../~...b...8EDr&.....1..!.....G4...]E./...V........D.x....+...o.M...aK.....A[..!...^.)...//..WPSr.%...Z.eE..jXI..EIY....'.N.k.T.o.....$...F..8.....`.U.... .@.u.....hx.0w.R+;...o.Yp...$cC@.J!.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-80.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 56 x 56, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	590
Entropy (8bit):	6.966656188079672
Encrypted:	false
SSDEEP:	12:6v/7M6MTtyNeGaNy8TzNNy+MSW3DOaNNLrN7+5UXT4JYMEzc8wCMd+nYIof01:hnXGcTfzs1ro5UXxMENPMMx1
MD5:	1B4FF26A106929E3A5710900A9D984E7
SHA1:	D3E1BB4FA64083743AB56ECD89D586DF6B583BCE
SHA-256:	91BA72309E34C5336C09B8F5C787A6327082F275D5D7BFE491C5430E67C80752
SHA-512:	D8537FA3B0DA1B2EE7C8CFBE9101A7DCA624AF4532305E06F211E4DAC799AE9B533F19D3CDF052352E2A926BFE32CC908CD3944B2543010E7BAEFE52697ADD92
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8......X.,....PLTE.....+..+..+..+..+..+..,..+..+..+..).....$..+..,..+..+..'.....+..+..+..+..+..)..)..)..#....+....+..$..+..)..+....,..)....+..+..+..+..+........tRNS./........?.....!.{....49.(wU..^CpO.+<...k..l,....EIDATx..U.r.0..1......+..;j....6..E.x....p<./..]......}B7.m2.v...zw.....]H_s....'i...;../^./...9G."8j.Y...A...$5T...$-..D.AZ.=..@9.......}...9.\|......i]......k.0.~... e1Wx.!.b.0.O..{e(......,.A.<_s..8^.......9..pZ...#t.......t..K.x9.....r..a.kr...dR..../..$.^...].......[...~t....@?1gN... ...aE..'..#........0.F...K3..;.....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-80_contrast-white.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	519
Entropy (8bit):	7.481207836176718
Encrypted:	false
SSDEEP:	12:6v/7K/6plTlYz3xYdbgkiF2hR8gKFliTulrp7TC21:TAuzBero2hKRFATulZTr
MD5:	169DC90309162BBABF07AC3D954A076F
SHA1:	A4C87F029A4F34D66847271CDF8C5E73B1E48A90
SHA-256:	37B0F1FB4A08AF8A42E6D8FCE4C7380DDAE0272150D7A9BB8B1D138066A9FFBE
SHA-512:	B7633C8FAA5614EFB402C47957577DBACCA1A1B3FD0BB39CF79EB3A06EC6A55F9B8C5EE9569271EFBFD7D43AD348D275C0C6C9FAF840663268BCA2FBC6C64BB7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8.......;.....IDATx....d.P...#....B.e."0.....p.........C`....p..B@AP(..Q..}.s..[....... ..$yo_.c.,.,k...........9...D..E....`..l.'..v...9.T....S..0.=...G......7.^.\.+.o..Xb....F....sk..%]..T>nBw..&8....c..l.....j.a.9z/F#.13\|.g.)z.tC9.......s>.....W8.D....G....Z%.b8...8...y..p......P...,.R..1..r}.8xKJ.,.m.+..............g).y.\5._.l.._.v...11....~....._..s.>x..a.Y......T._t".._6.V.2...`.~.X._!....v...7,.;N.5...{S4..."a..K1...s.To..M.[.z..B.....B.,.,...?.x..H......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\MEIPreload\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.824253848576346
Encrypted:	false
SSDEEP:	6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
MD5:	442699C95B20A60470421C6A4D29960F
SHA1:	C7317F2D2414C991C21205BA3C68A187B997E3C1
SHA-256:	44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
SHA-512:	C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\MEIPreload\preloaded_data.pb

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	8254
Entropy (8bit):	6.795641289553097
Encrypted:	false
SSDEEP:	192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
MD5:	D5E4C2634EFF8A9B3FAF432BF406D6D1
SHA1:	A691F5C9877079193C1F7DFB16DBC30BB0372EC9
SHA-256:	C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
SHA-512:	B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
Malicious:	false
Reputation:	unknown
Preview:	..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...\|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Resources.pri

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	3.118957212117411
Encrypted:	false
SSDEEP:	48:Whs+6rek/gF1A6Gbi+4eTy8iPTUucUITUuqQTUGUQTUsITU6UQTUQITUuUQTU0I0:WWnep/FFLxPoRJo+oGpoBo6po1oupop0
MD5:	400817D0A91767CB830767AA94383F31
SHA1:	73F36C895190223F94E4D52657F14454B2BCBA44
SHA-256:	35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
SHA-512:	2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
Malicious:	false
Reputation:	unknown
Preview:	mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\assistant_package

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3016096
Entropy (8bit):	7.995928138464168
Encrypted:	true
SSDEEP:	49152:ZpcMEa6uqacxbjtin6MVyGrD1Bj/kASIcQd+UUqq8M2CrVjiGRVj4B203DSofAyK:Z+bZztiLfzDkAaY9o8M2YRiFB13DSdx
MD5:	E350524C6F6BAA2AD86807EDA40EC091
SHA1:	C0581EBC142B91E0A56F020A4B5ED96EDDA0A2E2
SHA-256:	B59C4DB3400ACE63FF8A85C524266E5A86E69720C6D41FA853666D57E284F311
SHA-512:	653F70AE9637A4FACF20194A35E8412BBD57247F5D9C80620A00BDE5BE38457187591DEDD80C763197A8F6D646927888BB83BC78C3D932FBA1DBE68095E52B4C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b........................-..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\b3f1fe4f-1fcf-49c6-b37e-023d620a35b8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	361921833
Entropy (8bit):	6.974682451803852
Encrypted:	false
SSDEEP:	3145728:BgDqZKAYngpMSxO/MZSIosRYVROFGD/ZDiIrrcVGG2Xe9We:MzIoM5IEP
MD5:	D206978AC9C50980FB28EED74F09747D
SHA1:	2EAEA0C87D5D4EADF4C0071CB83BF7F072ED8E82
SHA-256:	EB61859C5C700C805F73EAD2888AECCF0A4EF0AF718D78C0A5A470D2532BD4F8
SHA-512:	9DB365B987F19AC339768DEBDBCE13582A094F99215115CAC3D640EC5A53A6A6397A538F8BAF9914FFA53969F8DAB3F25F0CF8951AB46A9E620B36DB7554DFF5
Malicious:	false
Reputation:	unknown
Preview:	<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='109.0.5097.45'.. version='109.0.5097.45'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>...PNG........IHDR....................PLTE.................#.."..)..)..(..(......)....)..+....+..)....+..+......+..+..+..+....+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,._.....5tRNS.........#'/5:=@DKPTX]flrv}.........................g.R....IDATx.....:..`M.....jz?.4..?.){O.Y.......u.8H.%.4M.4M.4M.4M...8....wH.. .^..m..M.Wc.H9/]........)...ft.{n.I..u..:.fg...3.<..^q.e:h....un.L.3..I9..E......Do.Q.>^..._...n.dI.-mz3X...)r..c. ..c.%$...G....$..\:..........M..e0&.\...r....OB...n...vH......X..V$.s...Ee.}.Wz$.....p.-...`Q!...nV..9.7S..p1A.+e.......'..k......../$B.A@..a...:t....!......\.Z.y.y.0..F......_.JaAhK.......~.A.JM.W..X.P.X.f....?..g...\..7..S......m.Z...?k#..u.r/..j<.>.7W#nE. ..X..j.D.... ...M%.-...$..ru.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4927400
Entropy (8bit):	6.4029612582957025
Encrypted:	false
SSDEEP:	49152:pCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNw:AG2QCwmHPnog/pzHAo/A6d
MD5:	C08BDD750226892D0834FB8C9CDFA44D
SHA1:	F293C392525A09970BCF8CD37736881D2FDCAB42
SHA-256:	1B02D9D63F9C28A6297A258A1FD44EDD6646509B63B061C06311B92C9B979E43
SHA-512:	13B43790821A1DF01CC56E738062CD87D45A657DC1485911F4CF7318075722A1539450CBF7AC2616F50A658B717A210ADB804573CAE80957A3BEC0910E245FC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..O....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxcompiler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21869472
Entropy (8bit):	6.533562255930368
Encrypted:	false
SSDEEP:	196608:IQKeXWgF5O+kwRE1lZC3V+mruyR+RIrYZqtmI1aIKr:DXW05OHyE1lZC3V+mru4+RIrYZW1Gr
MD5:	E83CEB89ED8DD6B9F0480D8CC69489D7
SHA1:	F26E53BC4EA4556DC4CDBAFA718CE1007C55D32F
SHA-256:	CC0A18BA9CCCED00C4C546AA1DBD94A68473A4EE91A2939241CB0B373F027CC6
SHA-512:	023D7DBBBB818F584B388AFB0D8B55F2BFAC582B5DC66F2E85F5039C010D9A1CD79AEF88D1A246445D01B59B08C43201557DA24DE59AC9EAC94D999FC332A46C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ..........G.....p........................................0N.....T5N...`A............................................p...8...x.....M.......B.X.....M..)....M.X.......8......................(.......@...........`................................text............................... ..`.rdata...5<......6<.................@..@.data........0B..n....B.............@....pdata..X.....B.......B.............@..@.gxfg....0....L..2...6L.............@..@.retplne......L......hL..................tls..........L......jL.............@..._RDATA..\.....L......lL.............@..@.rsrc.........M......nL.............@..@.reloc..X.....M......rL.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxil.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1519000
Entropy (8bit):	6.516270899147749
Encrypted:	false
SSDEEP:	24576:4Cfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkr4:4Cfhbh3v3mtEAQrW41obCraeRhy9ou66
MD5:	E71D7A6E7DF4575CA15471C7CFB05757
SHA1:	E6084EFD897B2667786B32AAA826847435652A01
SHA-256:	47DC5C4D7D0AF7116FC29ABA8BC1A416AA9C119BE852B06A3DBAAB0498F0E915
SHA-512:	EEED943DE5E9DD30389A789AECC2DB2EE78505ED84CE4B0C8EF3900B17957028259D9A7F8403037C90F6B765E2CCA0956B14DF3438EDC2BB1EEE84D02C78574F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@AC.. -.. -.. -.OX).1 -.OX... -.OX(.. -.VU(.. -..R,.. -.. ,.. -.OX$.. -.OX-.. -.OX.. -.. ... -.OX/.. -.Rich. -.................PE..d...'..}.........." ........."...............................................@............`A............................................l...l...P............`..t........O... .......o..p....................o..(....m..@............................................text...\........................... ..`.rdata..F...........................@..@.data....{.......T..................@....pdata..t....`......."..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\files_list

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5670
Entropy (8bit):	5.184091466166757
Encrypted:	false
SSDEEP:	96:4IyTf85XZyITJhowbO7Vt+Z1fuv7GqngzDeOJZJinORnUU:Haf85XMbwbOHCuSqnevOORnUU
MD5:	64F6A87CD6989836F73CEDB54111817B
SHA1:	19CE7C6FE039588448D4F38D79FB6D2AE4F18941
SHA-256:	97397491C796286FA89F201BE2B66197CF0BA811650B783A0B1C6CF066DA691F
SHA-512:	34F264386C615F6E30EDD0B8E74AA9E1C232E17909556FE74A3AAD0AC7FB4557CF30561467F161B1B81DA128166668F5C42C657237BCE0EC00F5F2A1DBEE54C9
Malicious:	false
Reputation:	unknown
Preview:	109.0.5097.45.manifest..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..localization\sr.pak..localization\sv.pak..localiza

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\files_list.1713386541.old (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5670
Entropy (8bit):	5.184091466166757
Encrypted:	false
SSDEEP:	96:4IyTf85XZyITJhowbO7Vt+Z1fuv7GqngzDeOJZJinORnUU:Haf85XMbwbOHCuSqnevOORnUU
MD5:	64F6A87CD6989836F73CEDB54111817B
SHA1:	19CE7C6FE039588448D4F38D79FB6D2AE4F18941
SHA-256:	97397491C796286FA89F201BE2B66197CF0BA811650B783A0B1C6CF066DA691F
SHA-512:	34F264386C615F6E30EDD0B8E74AA9E1C232E17909556FE74A3AAD0AC7FB4557CF30561467F161B1B81DA128166668F5C42C657237BCE0EC00F5F2A1DBEE54C9
Malicious:	false
Reputation:	unknown
Preview:	109.0.5097.45.manifest..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..localization\sr.pak..localization\sv.pak..localiza

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\headless_command_resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	7.902711533935921
Encrypted:	false
SSDEEP:	48:OAlAoY+itOhQ/1gK0JrX9oKN0pkkKkTd5H2aQlGJxSo3Lge//BwutTamzOQwB:hc/sq/1kxL05Td5WaQl6xZge/pwYam+
MD5:	912C416558F41D4DBFEA108D836B419E
SHA1:	5707B39EEE018EDB52F474F9C467EA6F9E63DDA9
SHA-256:	0C0BA64CC23078C9BAF3A19C4A3EE5E4DAD94AF14448FA6E71C6F7F7FBC4DF79
SHA-512:	24CB1CAEB6570E11AAE8B7A281810251E61579B5C0448B10110F716233ED4DB187B3F17A444DA6ADEFF0B97ECD30771762C96E1BC6C350F333C2F3F02A06D454
Malicious:	false
Reputation:	unknown
Preview:	.............v.....v......(.............-.1k.0.....Kv....h........."=G.^....Uqo9...R..1g.w..mqv..e.~.x...,+..[.<.8/...!..........6C..tTR.@..P.Xq....-_#O.........4`.P......\|...J.5........~.8.6...p.:..l.].l.Y._EY...................N.H....H..=!&.>...%@.. .4..6....w{.vy......S.K...Ei...ouNyo...v...W/^.B.K......~.^.\|IY....>u....e...,'(..A.k..R........y.75Au......s.....A..}S...u.N...\|.....I........H..{^.sK.~.....9e.L. )Y._F..../.!zq.mt..@....3.3.?.............Y..=.H[4\.sE6..Ca..#.@d.W..E..\...\|_L.]8....6M...k1.g...$]._CJ.....?H..0...?d-f..?..53...$..D..$.d...B.j6!."...FIFZ...c...p...j..^...B......{.9..rq.j.S.q..........B[).AJe..hu....,...vz..zm+.........D........u.C.O\....(_..Y..w.)j.)..QNsZ..H..k...(..I@...R&L.Hq..Z.c.f..`N&...~..mx.....K..ke.Q.w.)..j...8.j\."..W](._..E..v.@..'U..;:.(Q.`.0N.gXQ..K.H3.tSua...6aS...%.ug.,N..U...MT.f.)........D....kY.=m...,..m.z`M...Y...V...Q....%M..!,q63.....B...kc.0.>.....R.NF. .?*p#.0.c.8...1...=`..k....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\headless_lib_data.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1039525
Entropy (8bit):	7.978173087941506
Encrypted:	false
SSDEEP:	24576:tYVVG74M0gcF/Ah1y+cBBOoO0TOmgF3UtgLpC+li:tcG7Ghp/OBKOmglLpxA
MD5:	8F214319257335D3CD8A9F11DE370101
SHA1:	888725D96677B2650396280866AA27B7D325B5A5
SHA-256:	CC96C6E4422857F5C23B524D6069270CF2C720A52580666AEBDE85322AEB23D2
SHA-512:	87E123647D30058117E3E325F684E41793FFFE6C1F288EEDC2E631EB9C0744A9ED8E87C3210A8BD26703F547B3267C2D1F63CCFDAEA97414B981EED23478C12F
Malicious:	false
Reputation:	unknown
Preview:	............f.......$.................,.....m.......................................-.....L.....b...........E.....#..........v.....vG....v.....vG....vv....v.....vB....v....vA....vG....v.....v9....v.....v.....v.....v^....v4....v.....v.....v@....vu....vh_...v.w...v3z...v.{...vI~...v.....v.....v.....v....vb....v.....x.....x.....xQ....x_....zc....{.....{.....{.....{.....{.....{.....{.....{.....{D....{.....{~....{x....{6....{.....{.....{.....{.....{N... {8...!{T..."{."..#{`(..${.(..%{.-..&{[0..'{.1..({.2..){.3..{.5..+{.6..,{.=..-{"?...{.B../{pN..0{.P..1{R\..2{....3{....4{....5{....6{....7{a...8{....9{i...:{....;{C...<{....={ ...>{....?{.,..@{Gf..H{rg..I{.h..J{.j..K{^k..L{Ql..M{.l..R{.m..S{...T{+.........j..............................................g.....<.........................................h...........F.................u.....B.................N.......................!.................M.................T...................................?...............".r...#.u...$.....%...

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\headless_lib_strings.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	3193824
Entropy (8bit):	7.979368473263937
Encrypted:	false
SSDEEP:	98304:7mBKInI+6HrwrVtAJMeM/alfSznbmpeHkxckJaRR+dwJ:7mBKWkkrVtAJfMwfSzbYxckJab
MD5:	A93C4D6BEB4E7EDAF89195B1EBCE5CC4
SHA1:	8D0C13D7CCC14705F971D685DE00D64965A72B88
SHA-256:	4937C47D5CA6B2865D479EEB9539AD73AD3FE86E1DF988A4269E4D0169BB6C72
SHA-512:	686850F05CD8D714123FF561DF78E061BF84E008336BFAF9A1B702488FA7777CA88F02829C1D51EF6A64436ADD0A9AA7A293F9E001128AE0C68DCF325CBBA827
Malicious:	false
Reputation:	unknown
Preview:	...............p.....p.....p..../p....@p.....p.....q....\q....oq.....q.....r....Cr....Sr.....r.....s....Ns....ds.....s.....t....7t....Lt.....t.....t.....u.....u....]u.....u.....u.....u....%v....fv.....v.....v.....w....Uw.....w.....w.....w....Cx....tx.....x.....x.....y....Dy....Ty.....y.....y.....z.....z.....z.....z....*{....>{....}{.....{.....{.....{.....\|....W\|....v\|.....\|.....\|.....\|.... }....,}.....}.....}.....~.....~....g~.....~.....~.....~....2.....w.......................7....._.....j.................!.....,................%.....:...........................J.............................L.....n.....}..........!.....V.....\|.......................".....{......................`......................\........................................(............................L.............................d.......................L.....v..............................................................................................%.....4.....Q.....a...............................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	10750864
Entropy (8bit):	6.281225317736208
Encrypted:	false
SSDEEP:	196608:sQPBhORiuQwCliXUxbblHa93Whli6Zm6wO+:sMwkDliXUxbblHa93Whli6ZEF
MD5:	CC5D48E2D711EA5920F8AB2BADB52104
SHA1:	AB79BD64E603A450BA446AE709E033C8246C90D0
SHA-256:	099963A244012301EB903BAD416D22DC322DA13C086BA206A8B38D83A689E1DE
SHA-512:	ADC1164791D57F567C711AB4E4650CDAE0638E7DBA47BE9B10DC9E0EEFEDD8A56125B67B51269C3B6EC3708AEDFD76FC571A294DE92B6CE67684CF4DE3217C87
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......F......,F...0..?F...1..RF...1..bF...9..uF...9...F...j...F..0k...F...k...F.......F.......F..0....F.......G......G......+G......>G..`...QG......dG..p...wG......G.......G.......G.. ....G.......G..@....G..0....G.......H..@..."H......5H......HH......[H.. ...nH.......H.......H..0....H.......H..@....H.......H.......H..@....I.......I......%I..0...8I......MI......eI..@...zI.......I.......I..0....I.......I.......I..0....I.......I.......J...3..$J..`3..7J...3..GJ...g..ZJ...h..mJ..Pk..}J...k...J...k...J...M...J.......J...$'..J...0'..K..01'.+K.. 8'.EK..p8'.\K...@'.sK...A'..K..@F'..K...H'..K.. K'..K...X'..K....(..L....(.$L....).=L....).\L...Y.~L......L.. -+..L....+..L....+..M...W,.7M..@.,.NM..0.,.lM....,..M....,..M....,..M....-..M..`g-..M...h-..N...T/..N.. ./.>N..p.0.UN....0.qN....0..N....0..N..P.0..N....0..N.. /0..N..p/0..N.../0..N...[0..O..@\0.$O..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6568864
Entropy (8bit):	6.6474446551280035
Encrypted:	false
SSDEEP:	196608:XEKDvOWCQZncBmuyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ4:XE8vOWCQZncxu
MD5:	053ADC8C34F1ECB38BCA1C6832DD27AC
SHA1:	350D0C8D7F5A32D6301937382FE35F4E0B143E8E
SHA-256:	37012CB59D6D03D5E5A07378B242515E4D803CF4E775EC56365ED2627AD4D07C
SHA-512:	6FC86355E4AFB3FFBB3DA6B23FEAF77616ABD97FAC178E54BD62BCD88AEFC4AADB23309C2EE78ABA3FA189F7F2ABCBB6A2E53A5453148EFED0A401B3DE50412D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."..........._.....t..........@..............................d.......d...`.................................................`...P....p....]......;....d..)....d.(.......8.......................(.......@...........0................................text............................... ..`.rdata...g.......h..................@..@.data...PJ....... ...f..............@....pdata...;.......<..................@..@.gxfg...P&.......(..................@..@.retplne.....@...........................tls.........P......................@..._RDATA..\....`......................@..@.rsrc.....]..p....].................@..@.reloc..(.....d.......d.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	606112
Entropy (8bit):	6.224408133215955
Encrypted:	false
SSDEEP:	6144:YRaFtKKZ55uSrp2w3DIF9Y4hvEVyay1MB9um3uL9s2HzzohS/mHTi:YcFtv7uSt2w3DIFDH4B9TuLHoYme
MD5:	35109F09F82D547BA6367609C3BE1151
SHA1:	C6E543E7F851CB40BDFEC1836007D72801FEC737
SHA-256:	63DD78BE825BFA0923FF64F0EEA852750CC4EA48AA50C40CB736D933AF90EAFA
SHA-512:	4289BB53A79FE67FC689E9DC7513CF42FC036E1B5FFD543C2C5F9E96E91A9337A9309D52FE6C01498283CE7948018C772C39C9C8FE6EFC9B6557E3D31966FEB1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."............................@....................................\|.....`..................................................5..x.......P.... ...D.......)...........-..8...................p,..(.......@............9...............................text...s........................... ..`.rdata.............................@..@.data....R..........................@....pdata...D... ...F..................@..@.gxfg...p$...p...&..................@..@.retplne.................................tls....1...........................@..._RDATA..\...........................@..@.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2308000
Entropy (8bit):	6.390465255126942
Encrypted:	false
SSDEEP:	24576:gDmpsxn4NmRINZ8m5n+ky0Vd/ouU9Rmc23jaScRVrfUv8rIRqtoNhEIg4DXb:gDQ3Z8Y+kJ3/o3Rmr3jaT1fhsRqtoNw4
MD5:	5CABD27D139FB116BDDFA7DA5CC678FE
SHA1:	0CE3A84C9A8B3CC253E6FFBE390615BEB2F98F87
SHA-256:	F577DAF7AEBC9AC5AB1E45FDE258FF545940E228B2A3A577702D451EA512150E
SHA-512:	04EBC94293188EEDF17247D8091229A423704D284113CAD09C4D94F40E9C51F5EDA35EF06A36BF7BE88D657A16327BC9C467B6037736F250EFA743ABA63720A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."..................l.........@.............................p$.....K.#...`.............................................b...L...h....0!...............#..)...P$.x.......8.......................(...`3..@...............0............................text...6........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.gxfg..../.... ..0..................@..@.retplne...... ..........................tls.......... .....................@...LZMADEC....... ..................... ..`_RDATA..\.....!.....................@..@malloc_h..... !..................... ..`.rsrc........0!.....................@..@.reloc..x....P$.......".............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe.1713386541.old (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2308000
Entropy (8bit):	6.390465255126942
Encrypted:	false
SSDEEP:	24576:gDmpsxn4NmRINZ8m5n+ky0Vd/ouU9Rmc23jaScRVrfUv8rIRqtoNhEIg4DXb:gDQ3Z8Y+kJ3/o3Rmr3jaT1fhsRqtoNw4
MD5:	5CABD27D139FB116BDDFA7DA5CC678FE
SHA1:	0CE3A84C9A8B3CC253E6FFBE390615BEB2F98F87
SHA-256:	F577DAF7AEBC9AC5AB1E45FDE258FF545940E228B2A3A577702D451EA512150E
SHA-512:	04EBC94293188EEDF17247D8091229A423704D284113CAD09C4D94F40E9C51F5EDA35EF06A36BF7BE88D657A16327BC9C467B6037736F250EFA743ABA63720A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."..................l.........@.............................p$.....K.#...`.............................................b...L...h....0!...............#..)...P$.x.......8.......................(...`3..@...............0............................text...6........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.gxfg..../.... ..0..................@..@.retplne...... ..........................tls.......... .....................@...LZMADEC....... ..................... ..`_RDATA..\.....!.....................@..@malloc_h..... !..................... ..`.rsrc........0!.....................@..@.reloc..x....P$.......".............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.visualelementsmanifest.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.998309867995081
Encrypted:	false
SSDEEP:	6:ejHyaVic4subiL/bWHMjjTDhkQwYZXXKmBakQwYEbghuPYEpwhugVF6n:eF8iDbWHMjoO3drghuP5whuQF6
MD5:	A19B4BFB5A4CC4F482C00E4CE4566066
SHA1:	45399F2B595FE986510AC49DB12708684657B1D8
SHA-256:	DEB8410BF403C8C447E20BE621504420A7B8DE62A83B3624A81B2B8640566F70
SHA-512:	399A1C1F18CCB2338B4B8FB9049A37622DF90C226666B59B09EECEDD7A7CFA1D42D5E81EADC581F4CEAF2BA947AF8976BC5104DE15EEFE096D88EDBF35EBA203
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#FFFFFF". ShowNameOnSquare150x150Logo="on". ForegroundText="dark". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	480672
Entropy (8bit):	6.41710930420727
Encrypted:	false
SSDEEP:	3072:5zVbcXfa2sNvVQlPO6cs2ZpWr1vLxdplDrgr7fkU76l66UY1qZDxcSFXNTsjS0A3:XWwW/vGMJvrDr27fkHNUY1qJdixDxCNR
MD5:	D75A85DCE6912735B3CBB8A114EF7DE6
SHA1:	075D1B151FD82A320C88DA53CDDE2CFA967D05FF
SHA-256:	DD6D59EF4C3C7793B0D1981746E137DCFDBF8F1E8F1F40E3671FABE3644B2AA5
SHA-512:	D2B880FD9E1997A4A525133E0B5270B4DDAB3F888F674133027F94CBB4F099DB9C5868FA4C32822B00DED18EA756B061C117EDC3CF8C171F8CE29F6CF00048E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." .........&......P.....................................................`A........................................(...h.......(.......H.......LA...,...)......H.......8.......................(...@...@............................................text...j........................... ..`.rdata..\|...........................@..@.data....K....... ..................@....pdata..LA.......B..................@..@.gxfg... &...@...(..................@..@.retplne.....p...........................tls....!...........................@..._RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7652256
Entropy (8bit):	6.499129558055649
Encrypted:	false
SSDEEP:	98304:jUH61VT5ZfD7rRtQzc3+eUhhKZtDXm3BzGN:jUmV7fXrRKbfhMZZCBzGN
MD5:	CC2BE16C9D36F837BF14CE5BC1054D01
SHA1:	09807F71CBF34FFF0F8C34B95B3E5A4AF1F2DDF7
SHA-256:	50EA3A047426EA6530130BA9505DE4A90ABE3B691499C448999A97F0A8D82F27
SHA-512:	F67C7405C7554DB6D5582E9D9B142A9B96CCE93B351E43244720B83FC12398459153E7B0E31F6267A5221BA5928EE4E9405D62565FBAE00B4DE8A43F5B4140B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ....."Y..r........I.......................................u.......t...`A..........................................l.......l.d.....t.......q..R....t..)....t.0...,.k.8.....................k.(....AY.@.............l.......l.@....................text....!Y......"Y................. ..`.rdata.......@Y......&Y.............@..@.data.........m.......m.............@....pdata...R....q..T...:q.............@..@.gxfg....,...Pt.......s.............@..@.retplne......t.......s..................tls....B.....t.......s.............@..._RDATA..\.....t.......s.............@..@.rsrc.........t.......s.............@..@.reloc..0.....t.......s.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	818433
Entropy (8bit):	4.776861496610102
Encrypted:	false
SSDEEP:	24576:oIq0/19ohsQeErl9cIhIA6g2HK2jY/HvYVzQkECgUEVbGy1qJ6GKVDOL+s3S2H0+:Bq0ieiJInK2jY/HvYqHUEVb51q/KVDON
MD5:	6E3C66D0B3D875F55518ED7029A06A7E
SHA1:	8AB7F0C2AEE2F17AFF28434EC31C714887961218
SHA-256:	97921B1BEC9BFF071F39D6EC3B013AB7896847B09A81BA7DEB3181A89DC33E3A
SHA-512:	AD7C490883DBAC1CCD4D8B65987841728F277782F24986329C6BCEA7CB647168A612E2F925257461080D983D4035D22300C43D7EF485AECC5DB53425815DEAE2
Malicious:	false
Reputation:	unknown
Preview:	........g%..e.....h.!...i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w.....y.....z.....\|.....}............................................................. .....%.....G.....U.....r.................~...........[.................?.....i...........v.....".....`.....V.......................x...........L.....r...............................................h.....d.....&.............................(.....^.....&...........;.....e.....Q...................................T...........I................./...........b.............................P.....v.....-............ ....K ..... ....t!.....!.....!....r"....."....6#....V#.....#....g$.....$.....$....t%.....&....P&....x&....s'....Y(.....)....3).....)....d..........*....e+.....+....%,....m,....I-.....-....d............/....90.....0...."1.....1....T2.....2.....2.....3.....4.....4.....4.....5....>6.....6.....6.....7.....8....^9.....9.....:....=;.....;.....<.....<....j=.....=.....=.....>....&?....q?.....?.....@....jA.....A

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1051578
Entropy (8bit):	4.369769045441902
Encrypted:	false
SSDEEP:	3072:q057EAg4iZJFmAf4GIdRcvCNHMFWFbiOjOV15yFLZP3BT:qMAAKZjmAf3QGSLbvOByL5B
MD5:	846F66D54EFEF168FB88D2DB30F4D6A7
SHA1:	EAEA93AF91044FF608A8B3B11318670C5E6DD167
SHA-256:	9BBFBB9C35A7CAAF2517C6DDBD6E9839DCA4E3EC25F03091CBE99C24E6580069
SHA-512:	EBC0EA24A254C0F1200823041AC283CD3AC0AB08EE535C8F349518491031E36DEB63C28CF446B05A7D1EC4A8EB61840EE83AA06B22893D42C78296FD24569AFA
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.^...h.c...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....R.....Z.....a.....h.....o.....p.....q.....v.......................8.....b.....l.....(.....d.....Y.....0.......................(...........%.................g...........c.....&.................}.....&.............................0...........\|.....S...........9.....(...........\|...........x..................................<.....n.................0...........M...........+.....^...... ..... ..... ..... .....!....'"....Z"....}"....]#.....$....v$.....$....r%.....&....n&.....&....R'.....'....F(....l(.....).....).........#.........u+.....+.....+.....-....*...........=/....70.....1.....1.....1....`2.....2....+3....[3....)4.....4....V5.....5....j6....C7.....7....R8.....9.....9.....9.....:.....;.....;.....<....D<....G=.....=.....>.....>.....@....\A....OB.....B.....C.....D....`E.....E.....F....dG.....G.....H.....H.....I.....J....EJ....KK.....L

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	518217
Entropy (8bit):	5.409593500909758
Encrypted:	false
SSDEEP:	12288:reEQF7f6ybGbf1bCCrz+W58ryU8kcvKOl3nRWgNO5u5iURJCQrVyNSHN0exS6tx2:reFsryaVzRJOzJ7kvjmY0
MD5:	D35F812CEC85605F25DF6801E1F1255C
SHA1:	1E02ADBEA304023E6EAD09FC952DCD27ADE6D3D3
SHA-256:	9602DC9165A532B05B649BF282DD4E58D7BF9007DBEA3878EE33419C35ED9319
SHA-512:	C4DAF762E23A8B1D685E9A8DE15375D625D24D110882458CCAEB8DF10C93A7A7831819C6A6E178B1D7C7773D217CFD8A27CF4B9C125BEF317B1D07B7A59D7230
Malicious:	false
Reputation:	unknown
Preview:	........]%..e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....\|.....}.........................................................................(.....C.....c...........&...........".....A.................].....v.............................w.................&.............................u...................................<.....j...........\.................7.......................S.......................m.................6...........V.................=.......................).....s.......................X.......................f.......................l.......................R.....}.................'.....S.....`.................K.....\...........N.......................f.......................V.....y...........&.....].....r...........X.................5.....\|.......................h.................".....m.................l...........f.................m.................S ..... ..... ..... ....J!.....!.....!.....!....C".....".....".....#

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	512050
Entropy (8bit):	5.84527364151659
Encrypted:	false
SSDEEP:	6144:jfns9bfw0mal4DrszYc+ENOWvISBI8QJso5sJwOGLr7Vqa2:70w0maluszYc+ENOyISMDk
MD5:	72C184BA2A5DBBCF473BDA8F2D412EF4
SHA1:	25BB0DB17CD8F10E99E77048E03BA520C87C92E8
SHA-256:	2296C925D88159B6923E9158F877AB28E37DB72D4C9666F3B1FA6417494C2088
SHA-512:	369B1E953FB28F8D7A08BE77F775F9E8EE7CCCE0AE41FB9C5D53436DCFCB8EB264858BA5CF5D02F9016C993AE342E7DFA5E9975F4EA3D427B45A04D0EB6A91EC
Malicious:	false
Reputation:	unknown
Preview:	.........%B.e.h...h.m...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....~.......................W...........J.....h...........,.....a.....p...........s.................Y.......................~.................'.....z.......................}.................:...........K.................'.......................Q.......................z...........5.....J...........E.......................T.....q.................-.....Y.....k.................2.....C.................I.....]........... .....U.....g.................<.....I.................K.....^...........-.....g.....{...........p.......................c.....~.................3.....T.....s...........:.....f.....\|...........\.................".....z.........................................L.......................w...........3.....E...........W.................5.......................? ..... ..... ..... ....C!.....!.....!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	475920
Entropy (8bit):	5.468298950055233
Encrypted:	false
SSDEEP:	6144:6j2bgf3mVzVWJcPPMetZqRd4m7wwHzZhEqEyiw3LLfe7DeUvVY5psgAeuos4zM:6k6WwcMeAOqEyiE0VYkjPom
MD5:	5CE5D54A9F7A7D7A934C72762F3BB7B2
SHA1:	A8F56CECE4830303377B8594DE1335468C044BB9
SHA-256:	C04FBFE6720D87B3038FFC90B356A756780BD2D3FA88F616991606C14BE3827C
SHA-512:	F65AE7AC6A7231410F63CA4818A29F4A67E803316D2C6B2CD064C7C962E37405B5134AB251E8C6290E8C4E61AC5DAE2B1DE235F9BDCF2F550F50A2065A792708
Malicious:	false
Reputation:	unknown
Preview:	........F%..e.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.S...t.\...v.q...w.~...y.....z.....\|.....}.....................................................................................!.....:...........!.....b.....q...........S.................+.........................................0.............................f.......................c...................................9.....\...........6.....r.................Z.................+.............................2.......................].......................@.....d.....r.................=.....K.................B.....U.................F.....V.................5.....B.............................p.......................\|...........Q.....i.................E.....].......................1.........................................'.....a.................;.....T...........!.....Q.....f.................Q.....g...........H.................0.......................t.......................`.......................G ..... .....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	517776
Entropy (8bit):	5.50482355408763
Encrypted:	false
SSDEEP:	6144:XDpfy4Vx8wcy8EapLi7TUjzsC+ntFJJgUCE9SFRV/z84GLjjXH:Xtf/VxEy8E3UkC+t7CE9csjH
MD5:	E2A66EBF9FCA49A4F689AC775F9BE4B8
SHA1:	5F910564C9DCA46E4C7C7BE5D0EC122C96D8618F
SHA-256:	C8BC94FA5A2E9C1358273BE7566720A46B622E10A7CBB377901B179A2E980360
SHA-512:	1293AD3B023B1AE0B4F8BC625D0159B59E5B5CEDB3BCD15835B5B48E0D4AD4679D6A3A4B7097D2A92DAD50758E7846D4838710F572E2774036CCD329AD383DCF
Malicious:	false
Reputation:	unknown
Preview:	.........$c.e.&...h.+...i.<...j.H...k.W...l.b...n.j...o.o...p.\|...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................#.....*.....1.....2.....3.....5.....F.....].....o...........I...........Y.....n...........q.................N.................!.................N.....f...........Q.......................z.................I................. ...........6.....r...................................^........... .....2...........^.................l...........`.................^.......................m.........................................@.................!.................F.....V...........=.....p.................f.........................................y...........f.....\|...........Y.....{.................E.....b.....u...........H.....q...................................n........................................./...........& ....g ....} ..... .....!.....!.....!....x"....."....8#....e#.....#....N$....{$.....$.....$....d%.....%.....%.....&.....&.....&

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	888020
Entropy (8bit):	4.862531304508221
Encrypted:	false
SSDEEP:	24576:Oyzw0HnjiCKR9wJIaCK+ED2xEEbv77ZTr9Ieu9lmfPXpqYDMIWbIz+9Lq7Yyvoii:Fw0HnjiCKR9wJIaCK+ED7Ebv77ZTr9I9
MD5:	A8DF5D3F92D7F004E918796347A6E048
SHA1:	A63E867BB374200C56D1D9DC38CD7163FE19009D
SHA-256:	007221B33AFAFDDEEA468F16F89DF2DAD1595E07E5117045541BBFB91ABC92ED
SHA-512:	5C0BBF9CAC4840F62F8B386EFD2702991247551BEEC570218C90A2DC136296C636C2F9841A28CD5A49F265148906ED54720EFD3C40462EDE3D2669C9976E475D
Malicious:	false
Reputation:	unknown
Preview:	........1%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.'...v.<...w.I...y.O...z.^...\|.d...}.v.....~.............................................................................R.......................D.....\|.....w.....F...............................................\|...........E...................................3.................r.....5.............................a...........m.....).......................j.............................<.....i.................H...........3...........0.....Z......................."...........u.................. .....!....."....=".....#.....#....4$....[$.....%.....&....j&.....&....N'.....(....`(.....(....B).........\....}*.....+.....,....,-....^-....1...........Z/...../....20.....0.....0.....1.....1....a2.....2.....2.....3.....4.....5....f5.....6.....6.....6.....7.....7.....8.....9....59.... :.....:....Z;.....;.....<.....=.....>.....>.....?.....@.....A...._A....oB....kC.....C.....D.....D.....E.....F.....F....5G..../H.....H

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	418491
Entropy (8bit):	5.529086906141164
Encrypted:	false
SSDEEP:	6144:t6pXhiC4y/Io8s0rjBcQRAbqOGyR4dpuF006d9vbQb+:4pXhiC4ywHrSRDq06rQK
MD5:	608BB4B9B7BEF94E5259A502DFF26939
SHA1:	9996CA3070B100002BF8C7C9FF4C91B434DB4F3A
SHA-256:	4EDDBB9794BFB5559B3532AC9DFEF966A6B00666C37703A820A9777C451F92E9
SHA-512:	7EEFAB25241B9B8DC1CA2B1662E5F7AA18161BBB47986494E290DB0997A40FA7E33222EB82DEB1E5DD10D7122EDC5487528E80AC20111EE385E3BC96F1C9C457
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.P...h.U...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......&.....+.....3.....;.....C.....J.....Q.....X.....Y.....Z....._.....l.....~.......................r.................".....p.......................q.......................h.......................>.....g.....u.................).....6.............................j.......................`.......................<.............................R.....~.................R.............................9.....H.............................,.....i.......................>.....p.......................G.....S.............................].............................b.......................O.............................Q.....g.......................".....o.......................>.......................%.....\.....w................./.....^.....n.................K.....c...........6.....~.................L.......................B.....n.....}.................(.....8...................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	420674
Entropy (8bit):	5.529737626426335
Encrypted:	false
SSDEEP:	6144:/xD1y1UA4OUpOZringSs/85QwedFyREZfGucp6O9gxQaq:5D1yK7lirwQw8ynp6BQx
MD5:	A727D0174423F1A0AAF664261BAC0482
SHA1:	819DAF9A305CFE43D3BBB4224EE880F01A0378EA
SHA-256:	9F2F1B54ECABEA91EA94B21B6F01BD5DF9F91031C6DF0054CDDF456E048695AB
SHA-512:	C77D366EAE838F02440E795DEB0B607945D8800FEB55EA67C7878D15CA371CCEC9908805069BED9285A089E39129BF8073C9D8F81CA2A54C6A3D13A3B2C6E69F
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.'...y.-...z.<...\|.B...}.T.....\.....a.....i.....q.....y.................................................................E.......................Z.......................O.......................R.......................-.....r.......................5.....\.....i................. .....7.......................7.............................g.......................5.....}.......................}.......................I.....d.....s.............................W.............................i.......................E.....r.....~.................5.....@.............................H.......................".....\|.......................\.............................;.....P.............................o.......................V.............................V.......................5.....m.................V.......................i......................._.............................A.....Q.................*.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	507385
Entropy (8bit):	5.384275656508378
Encrypted:	false
SSDEEP:	6144:xZmv1Ld0cQEaY57i+XugHRz+m+qRWYQWY9Acwlyrr7sky3r+ivvwwzd:x0b33PiQuUEUcwly4towx
MD5:	0593321989F9D4642D37AF02112B02B8
SHA1:	3F0C9F56263B8078551FEB52910674B75CC508F8
SHA-256:	6D76B915C3A2A16E93C61AE15ED1282717BD7ABFA54632F744DE0AF5694292EB
SHA-512:	A9C1439F14DD76301CEB76B4434D48F412846551135863D9A73EAC2F3DF0E822C4EBEBD12876651C8A3ADCBA9C4677FB8885BFCC669E00AD7F67DE40895DC223
Malicious:	false
Reputation:	unknown
Preview:	........f%..e.....h.....i.(...j.4...k.C...l.N...n.V...o.[...p.h...q.n...r.z...s.....t.....v.....w.....y.....z.....\|.....}...................................................................!.....3.....H.....].....t.........................................3.....K...........[.................R.................$.....v.......................d...................................:.....j...........`.................B.......................u.................0.................d...................................h.......................M.......................D.......................^.................".................$.....0.............................j.......................b...................................X.....y...........3.....b.................5.....\...........&.....\.....l...........a.................Q.......................G.......................k................. ...........5.................@ ..... ..... ....-!.....!....."....W"....k".....".....#....'#....:#.....#....+$....u$.....$

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	503543
Entropy (8bit):	5.372890679718701
Encrypted:	false
SSDEEP:	6144:eKXoni5FrMDvQ/2125jssBi9OmVlw6PZXk8jxWP+PmXg9+gH8EynIfKnXzP1G7j6:/kAFQiiEmVVMPF88Eys7jKoLSl
MD5:	27141E57CBBA0DA1083E86305DFC5C35
SHA1:	4113AB092C68830A4DD2707424281FD2375EAAA5
SHA-256:	72A3B73AED887E6DD444DA7B2119BB750274CFD4DDE5ACDA3F9FC6F74C4DB5C0
SHA-512:	2C713B7E11215D2265B9686AA46A9E0F7F3F1016F3511E5CD52919B713C12AECEA9D4F9147FFF4E7600735038022CC27C767E9DBAB37A145F2AD58078CBF3350
Malicious:	false
Reputation:	unknown
Preview:	........]%..e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....\|.....}.........................................................................!.....6.....K.....c.............................y...........4.....J...........l.................W.......................v.......................t...................................R.................y.................E.......................o.................%.................`.....y.............................Z.......................N.......................@.......................[.......................U.......................E.......................,.......................#.....z.................2.......................j.......................e.......................x...................................[.................C.....g.................A.....o.................Q.................G...........+.....B...........O ..... ..... ....A!.....!.....!.....!....Q"....."....."....."....F#.....#.....#

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	471231
Entropy (8bit):	5.451359603375548
Encrypted:	false
SSDEEP:	12288:2muA819ymFfIW21plWa4M5YYvYumOlfYYnLldtQ9XJkc1Jy:fLO2RtwFxQ
MD5:	1C43155162CBEAE5BFD20D4E26C09613
SHA1:	8A2DA5A6CEA99CDD860CED78EC8DB4CE85C5F6B5
SHA-256:	FEA1FC6BFF92E59D2FCB2EB5B8C00214C5EA3B20DD59D89C8D648047B2A0B4F0
SHA-512:	AD08D9CDFA258E70A5C80A5F7CD8693FE15F554EAB3D91D683D3A4AE520E486D133ADA833F65375A6AE180258C9A9BCD6482E125CED3145F25BB63998712F4A2
Malicious:	false
Reputation:	unknown
Preview:	.........$W.e.>...h.C...i.T...j.`...k.o...l.z...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................$.....,.....4.....;.....B.....I.....J.....K.....P.....b.....u.................(.......................w...................................1.....G.................N.....c.................=.....K.............................n.......................u...........".....<.......................0.......................4.................".....@................q.................5.....X.....o.................+.....9.............................a.......................@.......................%.....s.......................X.......................7.....`.....j...........J.......................<.....X.....n.................>.....W.................>.....M.................P.....z.......................(..........................................................-.....}.................[.......................f.......................+.....D.....T.................3.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	525946
Entropy (8bit):	5.28289516215121
Encrypted:	false
SSDEEP:	6144:BYMRcdhSju/fCVWo94oXuPZhDVcPuy9aOG+Khm:liv0cRoAk3a2Kc
MD5:	EB6354B2B211AD91F6D7D6A2FFFD2E55
SHA1:	E1C2AC3AE7E54681307631CB04BAB799CA0FFC55
SHA-256:	EC0C00AC8177045FD9C66C9C42B81A6469058DDACC608A1CDD78CE52FF4DD52F
SHA-512:	EBE64D0CD647263044B0A691372DB09F1946E12D65865112BD0802866372783812D362AB024792711223A53CCDEF43D3527931B641EA23098AA4B8F3C743FD27
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....\|.....}.....................................................................................%.....A...........p.................k...........'.....B...........w.................x...........1.....M.................B.....Q...........$.....[.....n...........n.................n...........?.....f...........X................./.......................t...........:.....Q...........x.................W.......................O.......................6.......................;.......................].......................i.......................k.......................l...................................c.................F.....r.................1.....N.....d.................[.....u...........j.................P.......................i.............................. ....a ..... .....!.....!....."....5"....."....F#.....#.....#....<$.....$.....$.....$....P%.....%.....%.....%....e&.....&.....'

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	537896
Entropy (8bit):	5.406714758625134
Encrypted:	false
SSDEEP:	12288:iuGtmSHHJprL7NaGFG9xbEIIS/2U4CjiZzrMYnYfvSi3z4sGA4XJRCeB2WhSW2E:iuGtVvVoGA8/
MD5:	3C479D516FA032AAAAFF41E2A64B9C32
SHA1:	C185E7EA5CA0FBEAEDD84F88CFEF76D4C6E73BAF
SHA-256:	0C9B605981016F66F763314D950DFE036D43B08B297E489E896B6DF4BBB08FB5
SHA-512:	066100FF57DEAECF33C79E13399934C9232942E9263BE6C6200024E4B329CD96370311135B705FCFD8D14254809B05E05B963F1A019C1E2FAD6EE22C2118FD81
Malicious:	false
Reputation:	unknown
Preview:	........V%..e.....h.....i.....j.....k.+...l.6...n.>...o.C...p.P...q.V...r.b...s.s...t.\|...v.....w.....y.....z.....\|.....}...............................................................................*.....<.....K.......................2.................Y.....q.............................w...........1.....Z.................:.....J.................Y.....n...........c.................U.................&.................C.....U...........-.....j.....}...........h.................W...........C.....c...........(.....Y.....p...........".....L.....^...........(.....^.....p...........@.....v.................W.......................R.....~.................?.....k.....z...........>.....p...................................f.......................X.......................E...................................].................@.....].....s..........._.................>.............................. ....c ....v ..... ....h!.....!.....!....`"....."....,#....E#.....#.....#....!$....5$.....$....!%....f%

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1083641
Entropy (8bit):	4.39270740266553
Encrypted:	false
SSDEEP:	3072:qpu2hzi95KisPgCAaVNIRdbUV/BB0ZV1d1E/ZDS7WOxEWUt2bhtWmhdYyBbkbumX:j3Kis4CAENIRfNkLPD3
MD5:	9D2EDD5B8447019266D440A94C920CEC
SHA1:	170E5705C167AF4CC19CC7D52EE40838CF44DF79
SHA-256:	4A67040AC922511345D7BC02FB562CFBA62F2238547DD7F6F4CB6FD9CAED3194
SHA-512:	1E27ACC6EF9788D6EFFE3B5E94A2E351C29DB1FD8EC5AEA9FD343789E2520A41257E576BB7A9954BE7E5DEC485E61FCCED9567ED34E5A043E5A8A8B94678F23A
Malicious:	false
Reputation:	unknown
Preview:	........h%..e.....h.#...i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................".....)..........+.....-.....O.....z.....................................................j.............................;...................................9.............................\|...............................................;...........a.....#.......................Z.......................................................................\|.......................e ..... ..... ....v!....."....P"....i"....@#.....#....e$.....$....U%.....&....g&.....&....6'.....'....6(....R(.....(.....).....)..........*.....+.....+.....+.....-.....-................{/....&0....s0.....0....:1.....1.....1.....2.....2....q3.....3....!4.....5.....5....D6.....6....R7.....7....!8....`8....T9....0:.....:.....:.....;.....<....E=....}=.....>.....@.....@.....A....<B.....C.....C.....C.....E.....E.....F.....F.....G.....H.....H....=I....:J.....K.....K

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	501615
Entropy (8bit):	5.537963892200896
Encrypted:	false
SSDEEP:	3072:jN7HHaOC70gFwHwu1qYpaBV08LFm9fAGC7LIVPc9RqH7KxDn3OWF6AGqJW+Bfmp9:jNT6OCAw0qDbqKjR8I1hKwwFar2COEW
MD5:	81A0DD591F79BF429D2CCB95B08179B9
SHA1:	E4A2206A35714AF7FE0503F3354A0BD1EFBDD76A
SHA-256:	736D75C43DA49B0D5231B64709D9EF22D642C66A8A44A1C67933CE285D286A88
SHA-512:	89DA7199214E4A87E1D5F42F86F83A5C0484E876AD3391575D67EE7D24FF237EAAED031C62E954ED4F32989EC75A65A2A6C2B127FB24FDAF8BA5F8E05484E4E1
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.N...h.S...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......'.....,.....4.....<.....D.....K.....R.....Y.....Z.....[.....].....i.....w.................6...........$.....E.................I.....^...........U.................0.......................D.......................8.......................7.......................q...........<.....^...........*.....n.................J.......................}.................w...........d.................5.....\.....x.................1.....B.............................f.......................j.......................i.......................j.......................N.......................^.................9.............................v.......................T.......................h.................A.......................'.................&.....?........... .....r...............................................+.....O............ ....A ....R ..... ..... .....!.....!.....!.....!....9"

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	537257
Entropy (8bit):	5.651087026709074
Encrypted:	false
SSDEEP:	6144:9Ntdxc3DFts4mnVR1AADhntGHZee9K9X3BdpEN/3IC8PHG+Gkit1D5XeRTZfpzgQ:9xq3DlKVc194iDD5XeR7cLtA
MD5:	50F816347AE51C75F485F99E9701F302
SHA1:	DD5A4A6CFBC65AA248B4610003C6C180BCB90D07
SHA-256:	A5AE4F3D88B2A8B9CEDCF4F4DD7B20DE4C76E78859E83D15B535359169192293
SHA-512:	7C00BCA68C19D432BB586E81EAEC81A5E29892F52BB34B6DAC836221A7FEAC9DEBE9C04ACAFB67409610C6FF2912956AB9E6D469D1CCAFFB7CB6C52B49C8E374
Malicious:	false
Reputation:	unknown
Preview:	.........%?.e.n...h.s...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.%...\|.+...}.=.....E.....J.....R.....Z.....b.....i.....p.....w.....x.....y.....~.............................}.....-.................1...................................u...................................C.......................Q...................................V...........".................+.................Q.....c...........J.................".............................".........................................;.......................R.............................0.....v...................................g...........?.....T...........A.........................................l...........Q.....g...........K.....r.................Y.......................u.................].................O.................(.....@............ ....0 ....F ..... ....9!.....!.....!....8"....."....N#....]#.....$.....$.....$.....%.....%.....&....c&.....&.....&....M'....~'.....'.... (.....(.....(

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	454822
Entropy (8bit):	5.400559449786276
Encrypted:	false
SSDEEP:	6144:g868dcwkGuJopPpYwkK5WmmvHMRusCbWBvv+VZ:g86hwh7PpaM/CbW0H
MD5:	5BE1EF03C0AA12BD76FF16A175E666FB
SHA1:	AFD0B59127585D5148BD5CA92BE928167CD72403
SHA-256:	6066FE2B587510F1556EC37328C2EE972D285E86384C6D81FB4D765994B5CF1D
SHA-512:	F7946F473C418EE0AAACEEA3CBFA70ACBEC738641576022835B259B7A09E12A8EF23B150CBC6A3361C7084AC29DD98063BEAA9ECB2211F9D351A425EAB352CCE
Malicious:	false
Reputation:	unknown
Preview:	........P%..e.....h.....i.....j.....k.....l.*...n.2...o.7...p.D...q.J...r.V...s.g...t.p...v.....w.....y.....z.....\|.....}.....................................................................................-.....?...........%.....m.................&.....S....._...........&.....i.................@.....y.................;.....k.....~.................-.....D.................2.....V.................@.....W.................$.....1.............................\|.................'.................G.....[.............................W.............................h.......................I.....z.......................].....g.................2.....<.............................r.......................a.......................I.............................D.....c.....{...........".....M.....`.................7.....Y.............................g.......................f...................................V.....e.........../.....i.................6.....d.....r.......................,.................".

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	503945
Entropy (8bit):	5.307344758355449
Encrypted:	false
SSDEEP:	6144:R5cSkxwE/snH3gIefnsFK54qGIbe3qn6JaZLlyy5kxAjNu4u9mEYfXZuxkNz7dAB:R5w9sHqZL3YZLR8ZODDP
MD5:	55D8FA8BFC0BBC2253FA61959620BB6E
SHA1:	E443BB3BDC4A2A72459D20C2C82C231C190B573C
SHA-256:	C7629323CBCE869F14EB055C1C3EC620911128E88B80F0F884CCD3C07D1B2C96
SHA-512:	EFA4D881BEFF0B72D9068971970431F5A83E5E3AF93DFF39A15CC0F00C4AD59A37E3DA4C3BDCD297F55582FA3A2A79937022A12275B8715FE01B0A609CAD15D5
Malicious:	false
Reputation:	unknown
Preview:	........F%..e.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.S...t.\...v.q...w.~...y.....z.....\|.....}.....................................................................................).....:...........R.................E.......................z...........S.....o...........d.................(.....p.......................@.....l.....{...........W.................@.................4.................I.....Z.................T.....j...........A.................(.......................o.......................U.......................!.....h.......................d......................._.......................:.....h.....q.................<.....E.......................&.................[.....t.................@.....Y.............................a.......................p.................M.......................).........................................:.....`...........w.............................<.....f...........S.................. ....B ....d ....w ..... ....D!.....!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	605636
Entropy (8bit):	5.810413132597904
Encrypted:	false
SSDEEP:	3072:+D5aCS30VsUCR1b6YoSSVOCKBrduLuFrLg35AclFIGjvKZcjjSxX+QUYN64DMKVI:+DigsVR5RpfB1J9TRVM0IOdPgsyCan3l
MD5:	D56B3044EF3D46027815D0605488DDB4
SHA1:	188AB004DA70DC79C5AAAFCB313AC394A6A9F1AE
SHA-256:	A492BC7E62ACEDFF9E72849ED67988368BF99D7B4C015BE9E8591AB1208EBE9C
SHA-512:	109FE1A18DE41B1575D56FA40E2BCED3C11F80B1ECB6A93FB6FD36338B2A6F12ECC64F39A5237F3D05AE502629CF394816D744966E9F103D6FFB2315A36FF6E7
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....v.....w.....y.....z.'...\|.-...}.?.....G.....L.....T....._.....g.....v.....{...........................................................$...........J.................9.............................0.................d.......................$.......................E.......................x.................A...........P.................(.......................H.......................f.............................d.................K.......................k...........'.....B...........U.................d...........P.....t...........y.................S.................%.................L.....[...........f.................h...........X.....w...........q.................J...................................E.....c...........o.................Z.......................r ..... ....%!....@!.....!....."....O"....e".....#.....#.....$....*$.....$....C%.....%.....%....K&.....&.....'....+'.....'.....(....R(....n(.....(....\|).....).....)

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	507103
Entropy (8bit):	6.154554116885957
Encrypted:	false
SSDEEP:	12288:zC3X3bqp7h+HxEGj1vpUB1RrOeDls1HPmsEVnjxRSQG0GDzRXfw9MdKV2Wr:zCH3+GH0lz
MD5:	08E7CB173C71F50D6F103A7D38B484BD
SHA1:	A3942CEE8CDD4CC5E5C0F99A25434D92B473D3B5
SHA-256:	D5DE57F30AB7FA8A2F1DAEBD8FAD573E2EB645DCE8E9E549F227ECE416BD2CAC
SHA-512:	044A1CBED20BB9F9DE1A1A35D39ADF73957DF955BB74BDB7BF10BCACA4054289733E2A3825FCB9A39C10C0737E96D8972A921A3216827F3322C6B7FB61C081D4
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.P...h.U...i.f...j.q...k.~...l.....m.....o.....p.....q.....r.....s.....t.....y.....z.....\|.....}.........................#.....+.....:.....?.....F.....M.....O.....T.....`.....v.........................................d.................!.................K....._.........../.....q.................C.....x.................G.....{.................Y.....~.................w.................$.....{.......................m.......................x.................M.................'.............................l.......................G.......................G.......................o.......................z...............................................~...................................W.....k.................:.....T.................<.....Z.................E.....X...........K.......................F.....Z.....g...........'.....Q.....d.................N.....i...........g.................,.......................M.......................B.......................7.......................N.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	536317
Entropy (8bit):	5.643555630797763
Encrypted:	false
SSDEEP:	6144:++3kHBENG3YGsPNaZirFyXcgYo7nO02IA6SxGC71/ZX4qVCSz2X:jkHO5GCN8irFlo7nm6Sx171x4l22X
MD5:	C001A0AF45E737903685FE12D3DF2237
SHA1:	CE362B1A15F45FE085B86E286C5C8A1D044F2D0D
SHA-256:	B9D5DB7AFDBB0A1C2072DEE8DF107C832AAD9DEA06AA4D85E80822E760049ECC
SHA-512:	032ADE5EEE6A4527707EBCE01CA87B43BF271113C6D0D8150E371EABB36BF7388A7C4075ABB0E795C4FB7B6BC39CC0EE902B98C699CF28A89262AE60DB9327EA
Malicious:	false
Reputation:	unknown
Preview:	........L%..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.e...t.n...v.....w.....y.....z.....\|.....}...............................................................................%.....9.....J...........y.................o...........F.....^.............................g.................6.........../.....f.....u...........q.................@.............................&.....m.................w.................3...................................R.....k.............................g................. .................3.....E...........1.....d.....y...........s.................6.......................\|...........8.....I...........M.......................y.................U...........A....._...........E.....r........... ...................................-.....E...........S.................5.......................q ..... ....<!....R!.....!....j"....."....."....w#.....$....s$.....$.....%.....%.....%.....%.....&....$'....i'....z'.....'....;(....Z(....o(.....(.....).....)

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	534894
Entropy (8bit):	5.6500379486550605
Encrypted:	false
SSDEEP:	6144:luLmp4dAKSDdbN28c9guMO7KTnN5gY9JxkRIMzGvkpnjNNatVFLrygRe5Z1DWuTC:0dAHxS7KTN5hxrvkpO2B0H
MD5:	E7AEA52AD8A913500AC5070797381DCB
SHA1:	3E1E3D6419B88D66A0C6245BE78D352927177613
SHA-256:	A74554D1D6667F722306303B50436B11E0796B2342BFBA9F5645E3702D3F721D
SHA-512:	1C0F7BEAC6108A05966B1D9E167F8B6B772FFB8F331719F01753EEC204BA5E7568BAF4DB99478B8185F9022D2EB6B2DC268FFEF387A0FB626334B56B81FCDF54
Malicious:	false
Reputation:	unknown
Preview:	........s%..e.4...h.9...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................".....*.....1.....8.....?.....@.....A.....C.....V.....p.................B...........c.................\|.................W...........M.....j...........z.................5.......................e...........-.....?.........../.....a........... .................<...........=.....z...................................Z...........@.....].............................S.......................].......................i.............................+.....p.................k.........................................I.......................}...........B.....S.............................F.......................[.................8.................,.....;...........Z.................5.......................] ..... .....!.....!.....!....,"....p"....."....&#.....#....K$....^$.....$....a%.....%.....%....0&.....&.....&.....'....j'.....'.....'.....(.....(....()....l)

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	470078
Entropy (8bit):	5.299102797827191
Encrypted:	false
SSDEEP:	6144:Of6mM7Ew6iTJ7x3IqccEeAvPzfoQax4bdiqYc8q7e:OfnMww6iTFuqtEeAaxLiNK
MD5:	2306128B71BCAE59C6C0277DE7A1E752
SHA1:	C75F4EFD0A3197410938840CFF5C676276AC664C
SHA-256:	8A2059DB7A08C290C7CD003450E26B91614DAA3955CBA9A5A9AC91B19DFAF5F5
SHA-512:	F475270E1D63A94E196D1CB46D608CB0721B9EFD12CE602CFF96635DD838B504EBF2E0FF5E8251DF9C214337A291DBEC5C8FEA338C192332BA0BCD169B947C9F
Malicious:	false
Reputation:	unknown
Preview:	........O%..e.....h.....i.....j.....k.....l.....n.'...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....\|.....}.....................................................................................7.....N...........U.................).......................=.......................o.................2....................... ...............................................,.................`.....x.................E.....N.................$...../.................(.....9...........*.....}................. .....;.....M.............................k.......................Q.......................^.......................W.......................G.......................7.......................E.......................h.......................P.......................+.....w.......................`.......................@.....X.....d...........%.....V.....e...........2.....s...................................U.......................m.......................I.............................q.......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	459816
Entropy (8bit):	5.449363894990241
Encrypted:	false
SSDEEP:	6144:QmGAUm8mrBXwLqB4p8R85yzn6gbtR5ryofpm4QtCu:Qmj8mrlwZ285yz6gv5fxm4QtCu
MD5:	F8CCF1F03345325296C5C9C124DB4002
SHA1:	00622F5A65167A74CB5D3ABE9981674D7F3DD7BA
SHA-256:	8D38CD61FFEF986CF59151E7457945B5E4560E20B08BE4C3C086B6CB4F8BC9EE
SHA-512:	F772231AC6309F26DC7C74C62884C39B0A4373505E9E0F8A4A72FC8A1B7E3498F6A88BA49F7EAB7D25E440E38A2ADF17F10A66C99C3CE812B16D00333B2F77C0
Malicious:	false
Reputation:	unknown
Preview:	........J%..e.....h.....i.....j.....k.....l.$...n.,...o.1...p.>...q.D...r.P...s.a...t.j...v.....w.....y.....z.....\|.....}.....................................................................................).....@...........m.................E...................................T.....o...........6.....f.....}...........3.....].....k........... .....I.....X...........(.....X.....t...........].................F.................2.................D.....X...........X.................S...........0.....R.............................c.......................F......................./.......................E.......................G.......................E.......................7.......................F.......................t.......................^.......................A.......................H.................,...............................................0.................0.....D.................[.....j...........y.................U.......................? ..... ..... ..... ...."!.....!.....!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	474213
Entropy (8bit):	5.385877052785105
Encrypted:	false
SSDEEP:	12288:cFGc36H0NHOsFuqqJliCoTrRO5QjcC/fj:VkHOsFuqqJlGY5QFj
MD5:	FD0613AE60F52CC74969B61C66B253F0
SHA1:	A8079D81D6451CBC451B4AD4668AB4CB3332AB27
SHA-256:	1E0DF58E9938BB08A211F3875F2B07F6DAB536A9E132979632384D40593296A8
SHA-512:	32D8C7316AB04F238A95B89E15A3992ECBA2A4201603CF7CB4FF1FEA9FAE29DEC6F6E834BE2178849A9DECE0F8FD57C165A4550DE05AEAEB561CD8CFECA93606
Malicious:	false
Reputation:	unknown
Preview:	........Z%..e.....h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...q.^...r.j...s.{...t.....v.....w.....y.....z.....\|.....}...............................................................................7.....H.....Z...........d.................7.......................[.................).................,.....C.......................&.....\|.......................~.................8.................G.....g...........%.....Z.....i...........4.....k.....{...........`.................;.......................f.......................8.............................].......................\.......................U.......................5....._.....i.................@.....M.................=.....L...........(.....h.....~...........7.....d.....~.................>.....U.................3.....E.................N.......................:.....N.................D.....U...........'.....j...................................w...........$.....I.................E.....Z.................!.....1.................!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	519669
Entropy (8bit):	5.763056963429436
Encrypted:	false
SSDEEP:	12288:4SdSTJzPn14aCHLWoOBCrHfQfM6HCab6VPSCUdXCe3mRRtyYsGsMsucZr1uvupi:4N+HTCMZ
MD5:	9E5525CB614167938FB36AD83DAB1E62
SHA1:	67D20678A0A4D90FC88CB4A360F437A56AC8CBF5
SHA-256:	C54993DBCECA14B149A36EFFC8B4150031D72EACCD215A1F9E47A1E2564DBFF2
SHA-512:	CFC37FFA21F50C7DA77E9E5E17C3492ED25A3E09BEF69A3D28017C57BABB0CAA4B1DF62DAE1C1BBC5BAEA25F5B2506ED84DB08273476B2BB17A2648CE041CAC4
Malicious:	false
Reputation:	unknown
Preview:	........F%..e.....h.....i.....j.....k.....l.....n.....o.!...p.....q.4...r.@...s.Q...t.Z...v.o...w.\|...y.....z.....\|.....}.....................................................................................".....7...........h.................V...................................d.................E.......................Q.....}.................\.......................y.................U.................>.................@.....Y.................S.....f...........c.................Z...........4.....R.......................*.....w.......................?...............................................-.......................).............................o.......................g.................!.......................I.......................).....r.......................h.................7.......................c.......................C.......................[...................................V.....l...........b.................3........................ ....Y ....w ..... ..... ....\!.....!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	494949
Entropy (8bit):	5.440865642472541
Encrypted:	false
SSDEEP:	6144:dXSBhjX7Tnufywf9kSUceCTTKsR/fFVINBXBLpOF/nDedeRIV:d8XTnuflecpKsRnU
MD5:	E6B92015E689E7D99BDABC6E9AA0D065
SHA1:	E6ADC1F047749DFB39041E2D7A6A6ECA37313272
SHA-256:	C164B32720970909053666611930282A839817803FF07110841A96DA37A9B275
SHA-512:	89751113DB3213853C997F81B1992692D6C71C22C0416ED7B71ABAE61C3DE3071662EFB89448E69AD685E181894A64BF63CF0162C2100D565B19E9A342270002
Malicious:	false
Reputation:	unknown
Preview:	........X%..e.....h.....i.....j. ...k./...l.:...n.B...o.G...p.T...q.Z...r.f...s.w...t.....v.....w.....y.....z.....\|.....}.........................................................................".....7.....Y.....n.............................d.............................-.......................q.......................f.......................M................."...................................?.....f...........:.....~.................X.................%...................................].....~.................?.....R.................?.....N.................;.....I.................J.....^.................9.....E.............................m.......................X...................................L.....e.................&.....;.......................T.......................~...........!.....~.......................c.......................g...................................v...................................f.......................@ ..... ..... ..... ....;!.....!.....!.....!....m"

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	501710
Entropy (8bit):	5.418472263920774
Encrypted:	false
SSDEEP:	6144:EY8CJ/9irod5GrGYbSR8gqCg4JVJJxhd/AahGO44L:EjCp8rjbSRrH
MD5:	FD92A51B33C8BC1A5A9D0B76AB18B19B
SHA1:	2F524D542A59C165BF11915E9F67AEFE72A8F0E1
SHA-256:	2F5AECD146BBDE5CB50F365BF2A95C18C11A6D2C62C2327903BB786AFB8562E7
SHA-512:	9D1FFD4C348B5A7CD94F8E8C206E98483C632B261174FE04EABB105E903155633E40C0807227B81B4B6425A83467A2CB51175B7E64159218210313A6A9B7748E
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.T...h.Y...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....y.......................A...........&.....A.................W.....k...........s.................m.................C....................... .....q...................................6.....d...........D.......................~.................3.......................P...................................o.................<.....k.................*.....[.....j...........-.....i.....v...........=.....v.................>.....s.................!.....N.....X.................'.....1.......................-.................[.....m.................E.....a.............................\|...................................<.....m................./.....A.................%.....:.................I.....c...........k.................\.................7............ ....Z ....u ..... .....!....3!....H!.....!....."....R"

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	515145
Entropy (8bit):	5.47688753468307
Encrypted:	false
SSDEEP:	6144:yRpjBcZ6yn/Ni2s2/Th6Ybuq6wdXYCYc4i8Sr5qi8YGCcEJSAZoHPo:yRpjBcnNBTh6VwdXKcF8+klYG9EzmHA
MD5:	15C936599BEC71A0E68B9E52BBC44837
SHA1:	F015556497E0F7FACA17B16934D3B3867EF7D165
SHA-256:	FD6287D4A82D7EDCAE4A8A75B62C4736E3C2FF884D66134A5554083F24D19666
SHA-512:	4FA7225B042C1797BFED4BDABD5471F0C63A680B1B24185ADC834300F291CAC32E7422282E61CA43A97DFB19A8A23953C464EDEA3BD7B35654997DA1291D0FB1
Malicious:	false
Reputation:	unknown
Preview:	........l%..e.&...h.+...i.<...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....B.....Z.....h.....z.............................i...................................m.................u.................*.............................\.......................z.................g.................;.................a.....z...........=.....q.................\.................I.................G.......................!.....p.......................A.......................&.....~.................#.....x.......................`.......................6.....\.....l.................M.....a...........Y.......................`.......................0.....P.....t...........5.....d.....w...........h.................?.......................0.......................[...................................R.....k...........\.................?.......................C ..... ..... ..... ....E!.....!....."

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	819374
Entropy (8bit):	4.93123855644869
Encrypted:	false
SSDEEP:	12288:VOO9JGMfQjRo4YoepEaX+jhvYDDc/lgtUMxDkDWT1TYy2T5rqnTf+QjIvy3jDpSg:k+25sitc
MD5:	B68C8EECE31F35918429FA86E85125F3
SHA1:	63ABF09444AD7281B6B51B5B8B7BFC39E8090722
SHA-256:	DD993C5B89B3008E2CBB9A080CE866D0EA1345A9402504A6B296F9CD80A5A707
SHA-512:	73348999013ABB2A6A102474F8ED957E8A07EE68C0BFABC56A2EEF477342141B6121283523672DC95AB6F02A389706DA60809AF77EDF6E8C7040E62ED0B7E22D
Malicious:	false
Reputation:	unknown
Preview:	.........$\|.e.....h.....i.....j.....k.%...l.0...n.8...o.=...p.J...q.P...r.\...s.m...t.v...v.....w.....y.....z.....\|.....}......................................................................... .....O.....g...........O.......................`...........b...........e.....".................`...........%....._.......................9................./.....F.......................(.................e...........X...........=.....r.....................................................2.....,.............................;.....x...........k.................=...................................6.....[.........................................>.....U...........R................. .............................. ....=!....g!.....!....c"....."....."....2#.....#.....#.....#....Z$.....$....b%....{%....o&.....'....m'.....'....Z(.....(.....(.....(.....)....%....e.....*....c+.....+....K,....u,....H-..........}............/....q0.....0....J1.....1....s2.....2.....2....V3.....3.....4.....4.....4.....5.....6

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	520332
Entropy (8bit):	5.809724931981123
Encrypted:	false
SSDEEP:	12288:qR/zgVuOkogo8Hc7kHpTjuxd9oEIkDnAXt41:qRDOkjHLcduGnAXS
MD5:	002C99E41FF7EA559B13B729035A223A
SHA1:	8EDABD5415B95BBEDDCDBF48F8692945D429BF35
SHA-256:	3C23E6FF6F8CF0A35E591BDBB3F8195390A83189F41ADDA2FAA7DC41D1956F81
SHA-512:	4365DFABAC0BA44D21BB05B8629F3F68DF216434ACCF92ED4559567D4D4063BFF73849FC98B63C258CD8973925A220E25EC5CD591D4EFDA21ADB2B3012C116AA
Malicious:	false
Reputation:	unknown
Preview:	........b%..e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.....y.....z.....\|.....}................................................. .....!.....".....$.....8.....N.....`.....u.....%...........B.....]...........>.....p.....~.............................q.................'.................%.....8.........................................<.....a...........{.................k.................6.................O.....`...........g.................U...........3.....N.................$.....9................. .....2.......................,.................J.....`...........=.....r.................I.....u.................f.........................................d...........5.....M.............................}.......................p...................................V.................4.....P.....e...........C.....j.................r.................t...... ....r ..... .....!....u!.....!.....!....@"....."....."....."....=#.....#.....#.....#....P$.....$.....%

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	768487
Entropy (8bit):	4.874682183149247
Encrypted:	false
SSDEEP:	12288:GYgaCNOT7TF9vZxUUMLE37Fi/k/kIX7eXZNbISAG170OsoQwkCTgeeDZE4Egiz6:PkW9Y/tG
MD5:	87FD5D0188185A93095066286B57FE12
SHA1:	2AE75553FFD54BD16C93CC39526B42DEA7F5DB37
SHA-256:	BDACA796C41C8FCE67FEE9177D3E4A618E6292DF0DFED8EE1BFABC3C8F1B196E
SHA-512:	EECCEFE88DEB440D408D542E63FE8EB96336F806857813354D7398C81FC810473DB7AEE4C33E992C40361BF9BCDB079821276665699C376F5645F05F21B2C671
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.T...h.Y...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....c.........................................:.....n.....2...........?.....b.....].....(.......................i.......................E.................D.............................~.............................Y..........._...........^...........C...........<.....a.....G...........~.......................6.....r...........r.................^.............................+.....c...........F...........G.....r...................................% ....m ..... ....'!.....!.....!....."....."....:#.....#.....#....w$....(%.....%.....%....a&.....&.....'....2'.....'....A(....z(.....(....a).....)....@....]....-+.....+.... ,....x,.....-.....-.....-.....-..........3/...../...../.....0.....1.....1.....1.....2.....3.....4....64....$5.....5....=6.....6....A7.....7.... 8....A8.....8....<9....t9.....9....b:.....;....w;

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	465038
Entropy (8bit):	5.555565729480048
Encrypted:	false
SSDEEP:	6144:IJe0KERZ9+Zgm+y9gipftAJy2d9Ip4gfivIMeaTRcFAaG16nMVp7mzI+n/4i054j:IY0KEnKvpft9AOGG
MD5:	82CE24A90375F5C6E71F508F4FCE93A5
SHA1:	C07E7A9A998B430673CAF6C8F809327B423AD9CE
SHA-256:	3AE3FA304B58B7C4D421364F6E1CC15404411B0CDC5FCFFFC42741FA83F0A534
SHA-512:	75DADFD4FEF04D9678D02FEF8549C3F0D7D27A5650F91DC6FAAEB2B32B49D29BBB4972705F8E8CDDE73B68CC6E8E8EC9860D7AF9A5A897F852D8876CE9C07304
Malicious:	false
Reputation:	unknown
Preview:	........J%..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}.....................................................................................,.....@...........E.......................w.................H...................................7.....S.................8.....H.................9.....I...........-.....f.................t.................2.......................<.......................z...........B.....X.............................Q.......................-.............................b.......................g.......................k.......................].......................M.....x.................K.....}................._.......................Z.....z.................0.....N.....f.................".....4.................I.....y...........-.....L.....b.................F.....[.................O.....e...........i.................T.................".......................1.....{.......................S ..... .....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	481823
Entropy (8bit):	5.388512062225318
Encrypted:	false
SSDEEP:	12288:PvRfwkLiYfvtAKq4llWMkePfEMDW3mmhtNiG5TNCBaRdEtU5bsdyM1GQ89a10gSs:Rfj7UJc
MD5:	E2A313E956F53723CE7330D718FD9400
SHA1:	F4EC0D365F3383F76BA3F3104A56919438907AC4
SHA-256:	86A49974EB374B157FA8A3A0C81D1C33F93FF429B04FD7A58B5D307D9AF1862B
SHA-512:	A657D31193A68029655FE69BA7D1BE2BB53A7EB7C4CDCCAF7D502CDB9935248670EE69E9A30CD473FE5C4A0F70CC7E2DAF1FB3484D9993112408151F3008E8C2
Malicious:	false
Reputation:	unknown
Preview:	........K%..e.....h.....i.....j.....k.....l.....n."...o.'...p.4...q.:...r.F...s.W...t.`...v.u...w.....y.....z.....\|.....}...................................................................................../.....F...........E.........................................O.................(.......................#.....z.......................^.......................c...................................e.................O.......................Q.......................Y.................7.................,............................._....................... .....l.........................................3.......................4.......................2.............................\|.................7.......................c.......................h...........................................................A.....s.................5.....G.......................0.................V.....y...........s.................Y.................!.................].....t...........0 ...._ ..... ..... ....j!.....!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1227930
Entropy (8bit):	4.13391259590605
Encrypted:	false
SSDEEP:	6144:OUt9GDfQ//Nc0vbtRetm1vYpiManVhnvHcZsUV:X3GDI//NZv6tm1vYpiMaYV
MD5:	D5F96121109A9B6FAB95F18E2F118ECB
SHA1:	813E426CCFFA8E8141A7A1172B6507AFA8BB6989
SHA-256:	CE53F26C1A6FFC0168CA53BE1E4C6F3A701E113B64AD8575E959D217024457D8
SHA-512:	4D725989D738FB3E3E88C8E68CB9EC1148254615373B8827B699EBD312E52B3E51E09CA0D970F31BBD42462252F9E42ED8A8E6FD9741AB347859FB2A20205C66
Malicious:	false
Reputation:	unknown
Preview:	........U%..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.q...t.z...v.....w.....y.....z.....\|.....}.........................................................................8.................2...........-.................n...........X........... .....z.....R...............................................G.....{.....b.....D.........................................e...........m...................................3.....[.........../...... .....!.....".....#.....$.....%.....&.....'.....(.....(....0).....)....e*....A+.....+.....+.....,.....-.....-....1.....\/....f0.....0....D1....;2....,3.....3.....3.....4.....5....+6....Y6....R7....B8.....8.....8.....9.....:....R;.....;.....<....2>.....?....R?....M@....5A.....A.....A.....B.....C.....C....>D.....E.....E.....F.....G....=H....KI.....I....SJ....+K.....K....AL.....L.....M.....N....SO.....O....#Q....6R.....S....hS....TU....>W.....X.....X....<Z....I[.....\....s\.....]....._....._.....`....#a.....b.....b.....b.....d....1e.....e

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1121993
Entropy (8bit):	4.386288242359646
Encrypted:	false
SSDEEP:	12288:9c/7McKNA/A/2TvPmTjJAG8ntJuiH7/gYshTWFshvqdW/3wkAE26KO+ykaIeVyJh:2htsO
MD5:	ABB73ADD2582BE253BA154FC9DBB927C
SHA1:	0860432BF0090ABF13263CC99F5DFE4013903056
SHA-256:	3452A09758986D4E0AFB619EBA98332FD8E2B42D4D900879934A016D3D59EEE5
SHA-512:	80D8505F779583C961D1AD77B83B7466DF7A2E41CE841A8A52AC007E5F5F1391C9FE44D77CE83E931B7D29A9FD9149A3A7647C1C59CC992DEE78800AE3499EB2
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....\|.....}......................................................................... .....v...................................(.....z.....l...........U.............................W.....p...........J.....,...........(.....].....l.....<.............................P...........3.....].....).......................I.......................M.................'!....%"....b".....#....H%....(&.....&....m'.....(....r(.....(.....).....*.....+....A+....U,.....-.....-.....-...../.....0.....0.....0.....2.....2....s3.....3.....4.....5...."6....c6.....7....R8.....8.....9..../:.....;....};.....;.....=.....>.....>.....>.....?.....@.....@....DA.....B.....B.....B.....C.....C.....D....LE.....E.....F.....G....kH.....I.....J.....J.....K....eK.....L.....M.....N....TN.....O....WP.....P....:Q.....S.....T.....U.....V.....W.....X....SY.....Y.....[.....\.....\.....\.....].....^....#_....d_.....`.....a....gb

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	965544
Entropy (8bit):	4.443700173020655
Encrypted:	false
SSDEEP:	12288:wKu+N9LyZYA6h4FkcSrkI4kbVb5HiLDVcwPqXqWkhIz9iw1pDr7MDx72nCVU6CZZ:wXpWP
MD5:	96AB3541A32FCA2BB2DCB370F2FB42DD
SHA1:	6D068A3299BF7008DD152E5281183D6447BFB8DE
SHA-256:	C2BC03F8D5B9AC42F5BDA334485DF678BB987492B0A27C1C5E5F3C44E4850EB5
SHA-512:	88C06917C0B21AD25DF6978DCAECE0B4CA0C015DE6473192BBF323E1FCCC87E26EF966293D3C18A7DF0BF1985DFF640412E67E5F9735BAB311C90CACB160D794
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.!...t....v.?...w.L...y.R...z.a...\|.g...}.y...................................................................................$.....x.......................[...........b...........c.................p...........F...........Z...........M...........o.................x...........A.....Z.....}.....8...........!.................).....z.....H...........s...........b...........o...........j.....................................................B.......................M.......................7.......................? ..... ..... .....!...._".....".....".....#....p$.....$.....%.....%....U&.....&.....&.....'....P(.....(.....(..........+.....+.....+.....,....--....y-.....-....g...........2/....i/.....0....w0.....0.....1....>2.....2....}3.....3.....4.....5....E5....u5....J6.....6....37....i7....h8.....8....l9.....9.....:.....;....;<....\<.....=.....>....`?.....?.....@....kA.....A.....B.....B....cC.....C.....C.....D.....E....AF

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	494706
Entropy (8bit):	5.639270985867021
Encrypted:	false
SSDEEP:	6144:4PdbHZaO5ZqYUJEAti1h5edfO7rlzIi9Dv0+zFza7O/tThbM07LPMVcN:4ZHZaTPJC5L9Pb
MD5:	E0142CC4AF6354EF0F893B27DD429616
SHA1:	ADD81EE790D598B090378B9758198160BA0616C2
SHA-256:	32AC0FFF2293E9B5CCFFA3C9DCDD25F282389DAB91CD941FCC453BB5078EFBE1
SHA-512:	4993A2358D89725E63318944061A6C39AF4B352D447191FAE7E4034236D35F13DA4857593D7B0B6BC55723F232E86E7B67CC4B46C3FF9EED4A17A63F8854AA4F
Malicious:	false
Reputation:	unknown
Preview:	........p%..e.....h.3...i.D...j.N...k.]...l.h...n.p...o.u...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................".....).....0.....7.....8.....9.....;.....S.....o.................8...........!.....:.................C.....T...........M.......................q.......................h.......................T.......................c.................9.......................o.......................n.......................{.........../.....G...........9.....~.................V.......................[.......................W.......................`.......................s.......................\|.......................w.......................x.................B.................%.......................4.............................q................................... .....K...............................................".................:.....T.......................'...........,.....s...........) ..... ..... ..... ....f!.....!.....!....."....}".....".....#

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	816561
Entropy (8bit):	4.967129142340634
Encrypted:	false
SSDEEP:	12288:RZec01fCuB3IjbtA3+ZT3l7udIhq+4uL2uyjAQWtYUNiqrhbnkCIqgmQkb:zeXkT5
MD5:	1045FFCB51696D4649DE218C8627D733
SHA1:	C9E1769F0019BBF2727A445C19A8336184708820
SHA-256:	8D188E9E90B10D7DF93027DC0DF731F5558AF9C7DB064C50527EB866330871EE
SHA-512:	2E6843D8A8334AC11993D88A9DA9CF35F24973488D1CEE6C8C7BA1C4A457370B32E245ECE242B40A11D2371B6DB2B8230015563CA0C4EC5743EA9691B040E9B1
Malicious:	false
Reputation:	unknown
Preview:	........7%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.$...s.5...t.>...v.S...w.`...y.f...z.u...\|.{...}.....................................................................................<.....~.....b.....%.................}.......................x.....,.......................G.............................y...........7...........#.....8.........................................H...........6...........0.....V.................................................................Y...........!.......................}...........9.....Z...........Y.................i...........g...........#.............................).....s.............................. ..... .....!....]!....x!....q"....A#.....#.....$.....$.....%....b%.....%.....%....Z&.....&.....&....V'.....'....u(.....(.....)....9.........(+.....+....),....],.....,....1-.....-.....-...."...........~/...../....+0.....1.....1.....2.....2.....3....\4.....4....&5.....5....e6.....6.....6....f7.....7...."8....?8.....9.....9..../:

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	582379
Entropy (8bit):	5.816277025416376
Encrypted:	false
SSDEEP:	12288:K60+cq8AnV7GzsFhziNHpzskxaI11Czyfw56jGfg19askgr:E+cq8WVSsFNiNJIkxaQ1Cefw56jGskgr
MD5:	3C77D65D18010D4167D0552EB9EC6F63
SHA1:	AF4948CCEA45274566F2B4B84D5A15F240FA73E0
SHA-256:	335E5CF2AD86B143B507BDD2F274E88E8A2E449BA7BCFDEC331D842A58505317
SHA-512:	25B01995FABC936E01C9F774FC5DE0F1C4D28EAC7534B31A9AA0368123F6D05CFE7F956F063B0A90AB6FF2BEC89BCBB74A300474AB019CF9E9049AB5F1B32432
Malicious:	false
Reputation:	unknown
Preview:	........$%+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...\|.^...}.p.....x.....}.........................................................................................z.......................!.....r...........;.........../.....U...........V.......................j.......................r.................]...........'.....Y.................+.....Y...........j.................Z.................6...........f.......................4.................8.......................R.......................m............................(.....p.................].......................o.......................\|................./.............................:.................?.....................................................6.....V.......................J ..... .....!....c!.....!....."....."....."....."....y#.....#..../$....V$.....$.....%.....&....#&.....&.....'.....'.... (.....(.....)....>)....W).....)........]....q*.....+.....+.....+.....,

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	417509
Entropy (8bit):	6.731075715070066
Encrypted:	false
SSDEEP:	6144:znI5iSfdmkSU8XzAnM9Y6daBlbKVIc772+Wi2Njv:zI5/dYdjAnM95d6hcm+Wi2pv
MD5:	3DD86ED9F3012C07738F4964DC8FCDF9
SHA1:	85831E97DEF2670982445338A82E90A5746C9081
SHA-256:	E7A141DB8DD1FE91F8C4887FF85DC922D715E5D3FF843D78E48C4A192DD6C26A
SHA-512:	1D7BA85F64C88DA2632FBD5C12ED499F19D58E69B98F7B9F3757C9432A36E2F03BC27B2F5DE7A6F1CD3A5A4D65CEF860AC45C88E1042A26BD51B29AC468FD631
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.,...w.9...\|.?...}.Q.....Y.....a.....l.....t.......................................................................a...........'.....9.......................(.................).....;.................<.....Q.......................+.....w.......................V.......................V.......................r.......................c.......................I.......................P.......................S.............................].......................".....B.....Q.................Y.....k.................9.....E.................%.....1.............................[.......................^.......................o.......................F.......................8.............................j.......................M.....g.....s...........,.....U.....g...........).....^.....~...........g.................,.......................;.............................R.....p.................3.....`.....r.......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	421388
Entropy (8bit):	6.732253725524516
Encrypted:	false
SSDEEP:	12288:uFRnXRuhEWRNutp6SfXKxi4mj8+kwOGlm:kuhHMLtfaxiljJkwOum
MD5:	58C69402898277827173256B536D7E3B
SHA1:	6F1415D29BB5654B4F8EB0288879E5E908F48BA7
SHA-256:	7C5BA20C3F85C84454EFFBE8096E98F5E1A7C0BBCE94A4274B805B06B8A17557
SHA-512:	9CCC2F93111856A9459B5AA142C1EDBCA96A94E60EF08F9809E887B80EDD59801A328AD3E053FA769A24D835969A5F211A381B975E7EC9E0FF4C85B8BBF5F0D4
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.....................................................................................n...........%.....7.............................v.......................r.......................Z.......................0.............................^.......................[.......................R.......................5.....^.....j...........0.....e.....w...........O.......................+.....?.....S.............................e.......................9.............................k.......................T.......................5.....].....f.................7.....C.................@.....T.............................f...............................................i.......................C.....W.....c.................0.....B.................$.....>...........*.....s.................Q.......................T.....}.............................,.............................s.......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\mojo_core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1981344
Entropy (8bit):	6.486533865041766
Encrypted:	false
SSDEEP:	49152:MlE1QGO48lC4TzE9+S31gwmErZf9aDq+Za2xLyEv:Kk3CsrdVh27
MD5:	A9D41940010CC34D6D78186A48DB0E72
SHA1:	67B6CB76C54AE375BFDE5F84515BE549E885129D
SHA-256:	B7447561003E617C3CA6C36E9F075745CE76417C6939CDAF013DE05A15766EE5
SHA-512:	D7216DCDA8DA9F350DD301857F941C4A5A24548BD6772415FD34B5D323D9B8230C5F1FF76E609C0E754EAC91AD14656237C4FCCCC864FD0ECE5BB9A8120DFAF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." .....j.......... ........................................P......~w....`A.........................................'..p...((....... ...................)...0..........8.......................(.......@............/...............................text...6i.......j.................. ..`.rdata...k.......l...n..............@..@.data...............................@....pdata..............................@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0... ..................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1272736
Entropy (8bit):	6.465281172730175
Encrypted:	false
SSDEEP:	24576:xn8Kjx1PWeJzGczu89ell4gMJGwInB0oVc1VEr:xn8A1pGczu8q7MgwuqS
MD5:	28D3E8BB5F9EB6B4233D36AA4B31C89F
SHA1:	607E602FE72E9ADED3B418300E593729DB5A9B23
SHA-256:	EC20E321572E2BBA9B5E5EBAF11B3CE73AE0B9F5BED22E951971C8AB020BD6E8
SHA-512:	DFCC83A6ADFBD669A2F278082BB2A64349A13994E84D80CA6D5752097BD2161AFFFBCB911D36AC61A7DB8ABA7A51EAA50A63B7DEDC58E9369FF6BCA1B891581D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."......t...........4.........@..........................................`.........................................p...\............P.......P.......B...)...`..\|...,...........................(.......@...............X............................text....r.......t.................. ..`.rdata..X............x..............@..@.data................t..............@....pdata.......P.......b..............@..@.gxfg...p,..........................@..@.retplne.................................tls....q.... ......................@...CPADinfo@....0......................@..._RDATA..\....@....... ..............@..@.rsrc........P......."..............@..@.reloc..\|....`.......,..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1581984
Entropy (8bit):	6.272223856034065
Encrypted:	false
SSDEEP:	24576:E3t4YtXg8FevUYsR4s/Cfjk/9+TSLGSsfZDVS:+tz1kUYsRt/C7kFPL2M
MD5:	05817E4297C72B8C58634C62531D5824
SHA1:	3ABCB7CA3CD5EA65E99CA9656901ABF803DE2C71
SHA-256:	7250E23D9B7F2CE62ABEEB90D62F7F8B4367379A581A50E3E59EB0AD5A51BD05
SHA-512:	E59D2AB48969E4B4F2DB3091A7C6C90FDD808C235E6A00F5976C67D5DA3508E964266DF5252200BE6A0706C7B0427E29628ECA435AC576569D7A25DCCC137BB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."..........0.......\|.........@.....................................v....`.........................................%...k.......P.......(.... ...}.......)..............8...................p...(...@...@............................................text...?........................... ..`.rdata..............................@..@.data....{...........~..............@....pdata...}... ...~...h..............@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...(...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.599413437969437
Encrypted:	false
SSDEEP:	24:+iCNV9ue/BbGNo7H6lah8keReriJ8gLIcO5v4Duvw5HjgTa/mnLBw85:+iCHMepSN078kfipLIckwFj8a/ym85
MD5:	03FB5F8A506C575AF145746E143B7037
SHA1:	DB496675C500572286A1AAC73C095874EA4862F4
SHA-256:	A12F2E6FDB9F97595C4662800298AAABB3BBF99C0DEE54F685578AD4A03D9719
SHA-512:	C445C29C78CD4741D0E7311FABD6A14A184317AA63C823F51C815DA35EE0B2E1DFC5C75C7D351A7FC37A44BC70A073A238F62CDF9DEBB5D94C520D76DC213B3D
Malicious:	false
Reputation:	unknown
Preview:	....0...0................K)..3...[.40....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%...H........wdzierzanowski@opera.com0.."0....H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U\|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	17684833
Entropy (8bit):	7.888675802364428
Encrypted:	false
SSDEEP:	393216:Srr5DWkkrzAdMwfSfMck4hxCxsJqcfoWAZGADxG9:0r5DRkzKTqOxsJspI9
MD5:	05583A5E509B54532A08960EEE295B65
SHA1:	3801EA430DDE4018CACE7E775E53E7C4A250AA16
SHA-256:	E83BC6816C8EC4E44398D1A6535BF8F77F3FFC8F17BB17166C88125BC605062E
SHA-512:	90856AF7EF6F82CEA9DD5D5773ADCC3E23299530AA26FDD0D363CFF88D59105247D59E02C13C4F58903B19C8CB85DD648B40FE4A4BEB88ADED787C2F26A86BF8
Malicious:	false
Reputation:	unknown
Preview:	..........#.f.\H..{..R..\|..U.....Y.....[.....h..........:.....a...........1...............................................?....A.....AS....AG...,B>...-B.1...B.4..6B.:..7B.=..8B.>..9B.?..:B.B...C.E...C.G...C.N...CQQ.. C[X..!C.[.."C.^..#CTp..$CEr..%C'w..&C.x..'C.~..(C....)C(...*C.....C.....C4....C.....C.....C.....C.....D....D.....D.....D.....D.....DU....D.....D.....D.....D.....Du....D#....E.....E.....Es....F.....F1....F.....G;\...G.h...G.q...G.u...G.w...G.....G.....G.....G7....G.....Gn....H....H.....K.'...KL)...L.8...L.?...LEG...L.I...L.P...L.W...L.Z...L5....L.....O.....Ol....O.....O/....O^....O.....O.....O.....O.....O.....O&....O.....Oj....O?....O.....O.....O.....O.....Od....O]....O.....OF....Q.....Q.....Qr....Q.&...Qa(...Q.-...R.;...R ?...R6C...RcF...R.G...RqK...R.M...R.N...R.P...R.S..&R/V..'R.Y..(R.\..NR.g..ORpj..PR.o...R.s...R.x...R.y...R.z...R.~...R.....R.....R....>Sk...?S....@St...AS....BSc...CST...DS(...ES....FS....GS....HS....IS:....S.....S.....S.....S.....Sn....S.....S.....S.!

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.visualelementsmanifest.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.998309867995081
Encrypted:	false
SSDEEP:	6:ejHyaVic4subiL/bWHMjjTDhkQwYZXXKmBakQwYEbghuPYEpwhugVF6n:eF8iDbWHMjoO3drghuP5whuQF6
MD5:	A19B4BFB5A4CC4F482C00E4CE4566066
SHA1:	45399F2B595FE986510AC49DB12708684657B1D8
SHA-256:	DEB8410BF403C8C447E20BE621504420A7B8DE62A83B3624A81B2B8640566F70
SHA-512:	399A1C1F18CCB2338B4B8FB9049A37622DF90C226666B59B09EECEDD7A7CFA1D42D5E81EADC581F4CEAF2BA947AF8976BC5104DE15EEFE096D88EDBF35EBA203
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#FFFFFF". ShowNameOnSquare150x150Logo="on". ForegroundText="dark". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1056625
Entropy (8bit):	7.959596721787576
Encrypted:	false
SSDEEP:	24576:pBvOoO0TODS0a+gcXKrYyj/8nv75iFW1M5QUCAXll7deAIS:TvOBKODS0BX6YyYv7xUbXllY6
MD5:	AC850EF61FB8412DC2D535D5B32CCF37
SHA1:	C0C3550B0D07E79C2F90FA5E96CA718DD0372944
SHA-256:	033EAB64BE8A2DFFC5D7A28206644FF68FD9D758BEA1F2331B5DAF8A73069E98
SHA-512:	C2955B972794C8BA5424E285B7810846653A2F2E9D9CBFEFC76158F843F218D80EAF354A1BAF9239651ACA9E40AF41681A9500DB1DFABBFCE3A3E33848B65507
Malicious:	false
Reputation:	unknown
Preview:	..........1.........O....w.....w.....w.....wy....w.....w.....w.!...wj$...wd&...w.)...w.,...w}/...w.1...w=<...w.G.. w.I..!w.N.."wjQ..#w.T..$w%U..%wRX..&wBZ..'wr\..(w.`..)w.c..2w.g..3w.h..5w.j..7wk..@y.l..AyA~..By<...Cy...Dy[....{.....{.....{`....{H....{A....{t....{.....{O....{....H{....I{...J{g...K{....L{....M{@...R{...S{2...T{x....=........1...........L.....$...................................i.....K.....#.................F...........$.................b.................-.................j.................n.....8.................6.................i...........l..........., ..... ..... ....L!.."..!..#..#..$..,..%.....&.02..'.]7..(.mB....D..,.RL..-.)S.....X../..]..0..d..1..f..2..k..3..n..5..x..6..{..8.....9....;.\|...<.....B....C.....D.M...E....F.....G.#...H.....I.*...K....M....N.....O.....P.}...Q.....R.....S.....T.....V.....W.\...Y.....Z.....\.}...].....b.}...d.R...e.....f.....~...........................................o.............................6.......................G.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_125_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1117708
Entropy (8bit):	7.955986403492703
Encrypted:	false
SSDEEP:	24576:aP6edh+WS0a+gcXKrYzYIh0gf53N95QUCAXllIdeAIS:aPjr+WS0BX6YzZugh32UbXl2Y6
MD5:	925D223F7D151C2CF3833A45534821D6
SHA1:	015C86FBFFF59BB83B0C94E05D64FAA5E20B6D6C
SHA-256:	4BC1D21B6BB73A7504D93D7513D2A784F7C63DAFFC91A45BA40676ABE5F5BDC2
SHA-512:	D891C2CEC277E8B30186483A49C01B8E8442568A23C3C5311AA16208BFCBD19B1DF57D7FE27EB22745ACE21BE63C44F2499AB0F7282336B08ED36130B52E6975
Malicious:	false
Reputation:	unknown
Preview:	..........)..................2................p.......................$.....$.....3.....d...........s ....Z!....D"....."....c#.....#....m$.....$....\%.....%.....&....v'....w(....3)....N.....+....&,.....,.....-.........../....r0....[1.....2.....3.....3....34.....4.....5....w5.....5....O6.....6.. .Y7..!..7.."._8..#.n:..$..C..%..E..&..I..'.9N..(.UY....[..,.Rc..-.5j.....o../..u..0..{..1..}..2.^...3.G...5.....6.....8.o...9.`...;.....<.P...B.....C.6...D.....E.....F.....G.....H.....I.&...K.....M.....N....O.....P.....Q.%...R.....S.[...T.....V.S...W.....Y.....Z.....\.!...].....b.9...d.....e.....f.....~...................(.....0.....@.......................o.....i.....Q...... ..... .....!....."....S#.....$.....%.....&.....&....T'.....'....a(.....)....p....Q+.....+....q,.....,....&-.....-.....-....-.....M4....C8.....8....[9.....9....:....;....;...H<....<...==....=.../>....>...(?....?... @....@....A...[A....A...KB....B..."C....C....C...mD....D...AE....E....F...kF

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_150_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1247344
Entropy (8bit):	7.9588592145472745
Encrypted:	false
SSDEEP:	24576:W16edh+zS0a+gcXKrYteMe3gDcG8n1RfFSmWTcQg5QUCAXllIdeAIS:Qjr+zS0BX6YwxgURQmWceUbXl2Y6
MD5:	CB325C22FFADD5253D629F5A6A879594
SHA1:	8DB6B4391CE326A9157AD08E6D83CF5D0C52188A
SHA-256:	BF2FDDCDB1858DFD0C280C017A91A6E14D4CBA7DF1001F5AA4D4C53F20A8633B
SHA-512:	7B8D60C0E19B74422D39DF00FE79C549452151731767579CE3C01FC4DBC6CC61ED0EF8C0CA6332374220FE862C98D5DDAF283C93436D86D7B6F0E4E941572442
Malicious:	false
Reputation:	unknown
Preview:	..........)..................5................r.................h.......................n...... .....!.....".....$.....$....%.....%....0&.....&.....'.....'.....(.....)..........+.....-.....-....5/.....0....o1....F2.....3....z4.....5.....6.....7.....8....F9.....9.....:.....:.....:....b;.....;.. .l<..!..<..".r=..#..?..$..H..%..J..&..N..'.LS..(.h^... `..,.eh..-.Ho.....t../.+z..0.....1....2.q...3.Z...5....6.....8.....9.s...;.....<.c...B.....C.I...D. ...E.....F.....G.....H.....I.9...K.....M.....N.=...O.....P.....Q.8...R.....S.n...T.....V.f...W.....Y.)...Z.....\.4...].....b.L...d.-...e.....f.....~...................;.....\|...........D...........;............$.....$.....%.....&....X'....-(.....(....0....2+....3,.....,.....,....P-.....-....1/.....0.....0....Q1.....1....82.....2.....2....J3.....3.....9.....=....?>.....>....Z?....?....@..."A....A...UB....B...&C....C....C....D...8E....E....F...sF....F...DG....G....H....H....I...fI....I...VJ....J....K....K....K

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1637634
Entropy (8bit):	7.965682297939268
Encrypted:	false
SSDEEP:	49152:HvKdjrOK9S0BX6Y5158ZOLaA+3YqUbXl2Y6:P2uK9S0BqY5kZOeA+3Ab+
MD5:	433CB30B5EBD90A2FBF8A3D658E6A4A3
SHA1:	19479DCEF665605B59F5558C095112CF6ECE194E
SHA-256:	7C4D9C35B5D3FA45237A8BF6A700DB0C7E7156CB738B34082057CEA155D8F92E
SHA-512:	01F6647BF935A2CAB80A489156F8FB29532349313BADDC9AE48EB9D552EF3605C84AF44619256E436F236A1CA00ACF1CD12122AA39D67398742387D38BBDFA01
Malicious:	false
Reputation:	unknown
Preview:	..........1.........V....w.....w.....w.!...w.'...w....w.+...w.2...w.7...w.:...whB...w.F...w.N...w.R...wUg...w.\|.. w4...!w...."w...#w....$w&...%wq...&w....'wX...(w\|...)w....2w?...3w....5w%...7w....@y....Ay....Byl...Cy....Dy.....{.....{v....{. ...{.#...{.&...{.)...{.-...{.1...{}5..H{S9..I{y:..J{.;..K{?=..L{2>..M{.>..R{w?..S{...T{.........W...........................P................L................u................o..........`..........@.............................d...........].....n.....(.....R........... ..........)...............................(.................l...........D...".....#.V...$.....%.....&.....'.!...(.=........,.:...-.........../.....0.....1.....2.F...3./...5.....6.. ..8.W)..9.H-..;..6..<.8A..B..E..C..G..D..O..E..X..F.RZ..G.r]..H..a..I..h..K..i..M..p..N..u..O..y..P..\|..Q.....R.....S.}...T.....V.....W.....Y.....Z....\....].....b....d.....e.....f.....~...................D.................v.....8.....&.................O.....E.....h...................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_250_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1377578
Entropy (8bit):	7.958947736021921
Encrypted:	false
SSDEEP:	24576:f6edh+nuD7nbEdUhSxqVQDb5sCQ7m817nnhbBCtv5QUCAXllIdeAIS:fjr+uHbjhGqmRQd17nntOqUbXl2Y6
MD5:	F76E0C7CF5F07A43A46B6BCAB682F097
SHA1:	265649250CF4FFCAD2101CFBDB2E1B2F77EEC7F5
SHA-256:	82C19BE92FE8CD069774065C7BF82F1B471B890E8812E59654282B43DA61B759
SHA-512:	5C14CE36CE27F61CC639800205B7B75F8B5DA4A4183558E7AB77B116AB93DF786818B6CCB24B20A07ED20EF81EC4E6CDC703247112D0D7BA0F6E6E62DD98AF1D
Malicious:	false
Reputation:	unknown
Preview:	..........,...v........................n.......................=...........z.....m!...._#.....%.....'.....).....+....h,.....,....L-.....-....0............/.....0.....0.....1.....2.....4.....6....E8....x9.....;.....<.....>....@....3A....!B....RC.....D.....D.....D....^E.....E....6F.....F.."..G..#.'I..$.iR..%.rT..&..W..'..\..(..h....i..,..r..-..x....]~../....0.....1.}...2.....3.....5.....6....8.(...9.....;....<.....B.P...C.....D.....E.P...F.D...G.....H.....I.....K.....M.....N.....O.....P.n...Q.....R.....S.....T.....V.....W.....Y.....Z.m...\.....].X...b.....d.....e.~...f.....~.......l.....Z.............................T".....$.....).........../....W0....-1.....2.....2.....3.....4.....5.....6....67.....7.....7.....8.....9.....:.....;....4<.....<....2=.....=.....=....D>.....>.....D.....H....9I.....I....TJ....J....K....L....L...OM....M... N....N....N....O...2P....P....P...mQ....Q...>R....R....S....S....T...`T....T...PU....U....V....V....V...(W....W.....X

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5668768
Entropy (8bit):	6.519805313177513
Encrypted:	false
SSDEEP:	49152:sdmPGLAKSE+2u76LS0+68wEUS1JHKfdnWqd8k8VJFoULbngpZIqADSRI9kRxcW4/:Q5ucO64ZB/0Iq5j4EersR4tCZdNhW
MD5:	4187BE7AE04E22F0D399C55C28F0313E
SHA1:	05DC5D3C32583FCE4F9A61F2AD3D4D48158A364D
SHA-256:	AE987C8915F7B160557E602C933D2EEDCABA42BD553E7B3B837D5B9E9DABBB71
SHA-512:	9B42B28B7E456127CC76B3341A6D65DB611A9354E2E434BE2310C7D66983D4CEF400D13598630932549256A96369FB4D61F60DF1F07CDF675DFBA2DCC51F27BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f..........".......F..2.......!0........@............................. X.......V...`...........................................P.Y...<.P......pV..W....S.<7...VV..)....W..@....O.8.....................O.(....3F.@.............P.....X.P.@....................text...E.F.......F................. ..`.rdata..H.... F.......F.............@..@.data....B...0Q.......Q.............@....pdata..<7....S..8...0R.............@..@.gxfg...04....U..6...hT.............@..@.retplne......V.......T..................tls....a.....V.......T.............@...CPADinfo@.... V.......T.............@...LZMADEC......0V.......T............. ..`_RDATA..\....PV.......T.............@..@malloc_h.....`V.......T............. ..`.rsrc....W...pV..X....T.............@..@.reloc...@....W..B....V.............@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe.1713386541.old (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5668768
Entropy (8bit):	6.519805313177513
Encrypted:	false
SSDEEP:	49152:sdmPGLAKSE+2u76LS0+68wEUS1JHKfdnWqd8k8VJFoULbngpZIqADSRI9kRxcW4/:Q5ucO64ZB/0Iq5j4EersR4tCZdNhW
MD5:	4187BE7AE04E22F0D399C55C28F0313E
SHA1:	05DC5D3C32583FCE4F9A61F2AD3D4D48158A364D
SHA-256:	AE987C8915F7B160557E602C933D2EEDCABA42BD553E7B3B837D5B9E9DABBB71
SHA-512:	9B42B28B7E456127CC76B3341A6D65DB611A9354E2E434BE2310C7D66983D4CEF400D13598630932549256A96369FB4D61F60DF1F07CDF675DFBA2DCC51F27BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f..........".......F..2.......!0........@............................. X.......V...`...........................................P.Y...<.P......pV..W....S.<7...VV..)....W..@....O.8.....................O.(....3F.@.............P.....X.P.@....................text...E.F.......F................. ..`.rdata..H.... F.......F.............@..@.data....B...0Q.......Q.............@....pdata..<7....S..8...0R.............@..@.gxfg...04....U..6...hT.............@..@.retplne......V.......T..................tls....a.....V.......T.............@...CPADinfo@.... V.......T.............@...LZMADEC......0V.......T............. ..`_RDATA..\....PV.......T.............@..@malloc_h.....`V.......T............. ..`.rsrc....W...pV..X....T.............@..@.reloc...@....W..B....V.............@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.licenses

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14004
Entropy (8bit):	5.037159328058129
Encrypted:	false
SSDEEP:	384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
MD5:	2528B26988213FE5C0EE9CE75ACC2935
SHA1:	D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
SHA-256:	42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
SHA-512:	F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
Malicious:	false
Reputation:	unknown
Preview:	This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.licenses.1713386541.old (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14004
Entropy (8bit):	5.037159328058129
Encrypted:	false
SSDEEP:	384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
MD5:	2528B26988213FE5C0EE9CE75ACC2935
SHA1:	D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
SHA-256:	42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
SHA-512:	F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
Malicious:	false
Reputation:	unknown
Preview:	This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.version

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:SWhv:SW5
MD5:	0589F66713BC44029A1A720B9A0D850D
SHA1:	2FDF7D04F0372055C9D77CA43D9A3C08798905F3
SHA-256:	64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
SHA-512:	31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
Malicious:	false
Reputation:	unknown
Preview:	1.3.0.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.version.1713386541.old (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:SWhv:SW5
MD5:	0589F66713BC44029A1A720B9A0D850D
SHA1:	2FDF7D04F0372055C9D77CA43D9A3C08798905F3
SHA-256:	64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
SHA-512:	31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
Malicious:	false
Reputation:	unknown
Preview:	1.3.0.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	220288928
Entropy (8bit):	6.700613505644308
Encrypted:	false
SSDEEP:	1572864:XNSoORm2kK8RBybzefvv5FgDaIkWzI9yxXzBn00nSGPcnItwlJqLxgAu56g6Skw1:XYVROFGD/ZDiIrrcZ
MD5:	43D5750FD77E9611019D859F91FB7988
SHA1:	89050DC6EBB2D4BA16B7F2AD89BD22C03F375DBB
SHA-256:	EDEE72643E33D96DB2BC6DF14F56D83DD68B2BC71489C2ECB0FBF2203B6E8C4A
SHA-512:	86F12CB22962F65DEB0ED9914E099B24471A58173622B1714591F2D24F8E5944D4703B870FDD078A8E6DA4C69354890A920B3A3E661D8C7346C1E9D6BA74A2D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ......@..........M.......................................@y......;"...`A...................................................\|.....b......p....N...!..)....b..N.....8......................(...."A.@........... ........J..@....................text.....@.......@................. ..`.rdata..PQo...A..Ro...@.............@..@.data.....b..`.......>..............@....pdata....N..p....N................@..@.gxfg...`C... a..D..................@..@.retplne.....pa..........................rodata.......a..................... ..`.tls....I.....a.....................@...CPADinfo@.....a.....................@...LZMADEC.......a..................... ..`_RDATA..\.....a.....................@..@malloc_h......a..................... ..`prot..........a.....................@..@.rsrc.........b.....................@..@.reloc...N....b..P..................@..B................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.594593197813344
Encrypted:	false
SSDEEP:
MD5:	EA31DDBA060771B2F264616E2D42A638
SHA1:	6E8403C486B837C7456CE02681F2A088EAD0EB8D
SHA-256:	8539920F53D07870BBC4F0FC0DDFF5DC4832BAE7D7C340F5C09F390FF1F52BA0
SHA-512:	F3CBD4632E7755AE64EF6346E39184F15DC8D70E56A5815895B28CDD440653FCC7A92330ED9A76B392DBF0D081819CFE3C58F695BEBF1CD76638B71AF538A918
Malicious:	false
Reputation:	unknown
Preview:	....0...0................K)..3...[.40....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%...H........wdzierzanowski@opera.com0.."0....H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U\|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1981344
Entropy (8bit):	6.458168286855757
Encrypted:	false
SSDEEP:
MD5:	C02DAFED652C3A2BA3AD49B47CD24358
SHA1:	F094B52F9B5A19990DCCC042D36BCBA5DFEF2EC3
SHA-256:	8D0F62DBDB2D7916E10A98409959090190487A36754FE39F11A4E87D313F3D47
SHA-512:	A36DE6D88A509A1A39FBFFFA342E8D85B061C788BE5B7A47C6CDD50881D16289D5ECF7993D16E8B4203475743D5A11A5F2C2D57AB2F218BE0E4FCA6FA4DE6915
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f..........".......... ......0".........@.............................@.......r....`.........................................[2..\....2....... ..X.......0........)... ..<.......8...................p...(.......@...........8<.......1..@....................text...5........................... ..`.rdata..L...........................@..@.data...............................@....pdata..0...........................@..@.gxfg...@........0..................@..@.retplne.................................tls................................@...CPADinfo@...........................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...X.... ......................@..@.reloc..<.... ... ..................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1125280
Entropy (8bit):	6.456083351073946
Encrypted:	false
SSDEEP:
MD5:	D923CDDE7B1FB12DF3796C4286B7560D
SHA1:	FDB556738AC2C6F88C205254BD67A33321893A50
SHA-256:	F268BA313F93561AD52F80D9B035E0897D2AECA4CB063ADE9460590CA5036120
SHA-512:	A4CAB9330F80B16A587172B1C6D616F6777A4D84F6BF7AE501A15B95A4C1FEB1D65564AB56F5E729593FEE241424AC1A46A26591441D3E56E60D339F592A168F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." .........X......................................................)J....`A....................................................(...............Hx.......)..........,...8.......................(...@...@...............0...0........................text............................... ..`.rdata..............................@..@.data........p.......P..............@....pdata..Hx.......z...>..............@..@.gxfg...0,..........................@..@.retplne.................................tls....i...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1645984
Entropy (8bit):	7.109510245290592
Encrypted:	false
SSDEEP:
MD5:	82F27E48289382C6A4A06A447D75A55D
SHA1:	885A36D72765EAA4A90B1D72C3DAEB15930E348D
SHA-256:	11A7125A35CC204FFB4F7434D44688D420202605CA1A893CC77BEDA38B85637A
SHA-512:	BB5F43D3D2D4510AB507E0C0C4830FCD9931AF3582766FF8ECB7B6BF0799AE350A9D3DCC9170B6A12DE6E67E9848A933790EA09AE5D30CC569D20D338A9B3937
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."............................@.....................................p....`.........................................K...X...............0.... ...z.......)..............8...................`...(.......@...............0.......@....................text............................... ..`.rdata..............................@..@.data...`z..........................@....pdata...z... ...\|...j..............@..@.gxfg....*.......,..................@..@.retplne.................................tls....i...........................@..._RDATA..\...........................@..@.rsrc...0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.286080774872623
Encrypted:	false
SSDEEP:
MD5:	91A97B1678EA6F166A6ADF4370BEC2E6
SHA1:	2D4B52234F490887463B75DB53983F7133C6E46A
SHA-256:	1AC6DBE3F6EE18BAA94EF8660B41528F7B8EF79148BC7B58C21485B85476A9A9
SHA-512:	9D0855444968B4F4A777CE690776EAB00BF0DAA6AFD01B52BE96DFF2305572C133E1141FC79C07BC8DD4C739EC330813A7A737D7A7BAECEB46EBC35D33AB834A
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?...?...?...?...........?...?...?...?...?...@.......@.@.?...?...?...?...?...?...........?...?...?...?...?...?.. @. .>...?...?...?...?...?...?...........?...?...?...?...?...?...?...?...?...?...?...?...?..+K...........?...?...?...?...?...?...?...?...?...?...?...?...?..........Uo...?...?...?...?...?...?...?...?...?...?...?...?..+K..........c{......r....?...?...?...?...?...?...?...?...?...?..............9W...........?...?...?...?...?...>...?...?...?...?..........+K...?..........9W...?...?...?...>...@. .?...?...?..Uo...........?...?..9W...........?...?...?...@.@.....>...?...?..........+K...?...?...?..........9W...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.560345262666608
Encrypted:	false
SSDEEP:
MD5:	74FDAC19593602B8D25A5E2FDB9C3051
SHA1:	81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
SHA-256:	F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
SHA-512:	8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................\|S..{R...z...z...V...\|...\|...\|.......\|...\|...\|...\|...\|...\|...\|...h...V...\|...\|...[...~...~...~.......a...a...a...a...a...a...~...\|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................\|...............................................................................<...............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	2.247918084411713
Encrypted:	false
SSDEEP:
MD5:	CA6619B86C2F6E6068B69BA3AADDB7E4
SHA1:	C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
SHA-256:	17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
SHA-512:	30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.17081824784348
Encrypted:	false
SSDEEP:
MD5:	64AD26B9B9D8E4DA8CD564FE4843E65F
SHA1:	9D1D05134F36EBA77ED18F725BC0CA2121FA2686
SHA-256:	E5DCCC694E7F34DAF334B3A48B68DA450D5B34FE8A4E06842D864E99F400770A
SHA-512:	5F77BF6EC0D46C99E02A268E63587C9CD552B61FDB55ECE3955B50CC470EC103B06B2360EDA86BD49AA45458E1885F7A4E8256DA7B47DC8B8B343BCEF5CDCEA1
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@.......................................................................................................................................................................LVZ.G\e.................................................3u..PPP.PPP.PPP.PPP.:m..........................................Bbn.3w..OQR.PPP.PPP.PPP.NRS.+...................................PPP.E^g.....4t..PPQ.PPP.PPP.PPP.G\c.............................PPP.PPP.Cam.........9n..PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.............6r..PPP.PPP.PPP.........................PPP.PPP.PPP.........LUY.PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.....1y..PPP.PPP.G\d..\|..............................PPP.PPP.PPP.....?gv.(...........................................PPP.PPP.PPP.....................................................PPP.PPP.F]e.....................................................PPP.Cal.'.....................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.6549496934735806
Encrypted:	false
SSDEEP:
MD5:	0342F103B6960E1565D24EABD5A6079D
SHA1:	7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
SHA-256:	F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
SHA-512:	E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.1885512297205745
Encrypted:	false
SSDEEP:
MD5:	2C40ED190AA02EB3A2CDC38B89F4458D
SHA1:	F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
SHA-256:	FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
SHA-512:	1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.2795862597625223
Encrypted:	false
SSDEEP:
MD5:	93E4504D4C585CFDA1979B37E75FE39A
SHA1:	5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
SHA-256:	69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
SHA-512:	072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.6318458632047665
Encrypted:	false
SSDEEP:
MD5:	9796ED786D95606D51BE9DAB54FB5350
SHA1:	6EE48A6F912384D8F9CCE8BF7931BED779DC1D9D
SHA-256:	74368197CB53191E522E3A73AAB974D53EAE8E38DA694A1ED2CFA06F39176E58
SHA-512:	E9D14BA4486E73AB0FBB30F0C505E8AB2D8D5F55A3F87EC33AAE994F3B796EA415564136E70812B6ED09595D1BEAB345FEE1B7199694CE3F12118307065330D1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .....&......... .h.......(... ...@..... ...........................;.p.5.o.6.o.6Dd.0.........................................................................................d.0.o.6Do.6.o.4..;...;.p.3.o.3.n.3.q.3.n.3.r.7.n.5.o.6up.8Pn.7)i.2.................................m.3.n.6*q.8Po.7tn.5.n.4.n.3.q.3.n.3.n.3.p.3...;...;.q.3.s.4.s.4.v.5.q.4.r.4.q.4.q.4.q.5.q.5.q.5.q.4.p.4.r.5.p.4.q.4.q.4.q.5.q.4.r.5.q.5.q.5.q.5.q.4.q.3.r.4.u.5.s.4.r.3.p.3...;...;.t.5.w.5.v.5.y.6.u.5.w.6.x.7.x.7.w.7.x.8.y.8.y.9.z.9.z.9.v.7.w.9.y.9.z.9.v.8.v.7.v.8.v.7.v.6.v.6.v.6.z.7.x.6.v.5.t.5.r.3...;...;.u.5.x.6.{.7.y.6.y.7.z.8.\|.8.}.9...;...<...<.~.<...<...<.{.:.\|.;.}.;.z.:.{.:.\|.:.z.:.{.:.{.9.{.9...:.{.8.\|.8.w.6.t.5.t.5...;...;.v.5.z.7...9.}.8.}.9...9...;...;...<...=...=...>...>...?...=...>...>...>...>...>...>...<...<...;...<...<.\|.8.~.8.y.6.t.5...;...;.w.5...9...;...;...;...;...<...>...>...?...@...A...A.................@...A...A...?...>...>...>...>...=...;...<.}.8.v.5...;...;.z.7...:...<...<...>...

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.1032077050059135
Encrypted:	false
SSDEEP:
MD5:	BD5865B6A3787241931895B562D1AAF9
SHA1:	AB4636F3D534E11F8FCFDEA8A5070CD5D203F9C5
SHA-256:	A81AD17502B90A50BB491911F35D44BEF0A855BDA2F9BFCD7D98868AD0678718
SHA-512:	247766FE6585C0E965E7861AEDC48511CF825812B4C72345CB6FDBB148C3ED6A654C70D216187B4095770FB3BE1B5A18CD5A7289F5EE3BE0E6D01CB2AA12F40A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................(H. 'D.p'D.#C..'D..'D..'D..'D..#C..'D.'D.p(H. ........................................................................(D.@%E.'E..'E..'E..]s..]s..x...........k...5P..'E..'E..%E.(D.@........................................................ @..'D.'E..'E..%E.(E.`...............................(E.`%E.'E..'E..'D. @..............................................%E.0'F..'F..'F..(D.@.......@.........................'F.%E.0....(D.@'F..'F..'F..%E.0....................................(E.`'F..'F..(F.....&F.P#C..........F.d.F.d....s.z........3r..<...3x..&F.P....(F.'F..'F..(E.`............................%E.0'G..'G..(E.` @..'G.'G..B[.........F.d.F.d.E.Z.F.d.F.d.F.d.F.d.F.d.>...'G..'G. @..(E.`'G..'G..%E.0.................... @..'G..'G..(H.` @..'G..'G..'G..\p.........F.d.F.d.E.T.F.d.F.d.F.d.F.d.F.d.>...'G..'G..'G.. @..(H.`'G..'G.. @..................'G.'G..(H. P..'G..'G..'G..'G....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.0366948059247445
Encrypted:	false
SSDEEP:
MD5:	3264B65E59E51CA4943AE076748BFCEC
SHA1:	59AD003192DB03CA1E089924955FDCE0E25D159D
SHA-256:	65944B9D2003DCB988A8E3E03D29074A8C142520431EFBA1CC115036A8072F47
SHA-512:	7D81E6EE46A4389274C11178CB8E4CCF04BAAF1EEAD91BA44F27D7AF0290C55F55FBA2E7EC9E72DECA58D5138BA13238DCFB0956974E82059FE5285994090192
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................................7M$..(........................l......n.D.%.`...]R..P...A0 .4.%.'.)..................].........-.m...u...h...[...M...?.!.2.%.%...B...........v.........]w.G...........f...X...K...>.".0.&.#...........<....................................H:..;.#.-.'. ...................$..................................8a#.+.(..}.................................................... .6.$..).......uj.i.......`........................................kG..*..........[.p}....U...........................................]fw./......:....oo...............................................4...........-...?...............................................'...........?...O...^.d.......................................1.E.........S...b...q.....f....................................................t.'...............n...FE..].........................................................0.......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.867292544398476
Encrypted:	false
SSDEEP:
MD5:	7868D43BE5BE8978E247DA73B69A50AC
SHA1:	8F30676FF39D8A5DA69D2DCC624A6279FD323A13
SHA-256:	FA6C55B1C6F924242A2EE556859BB935A2427320AFC7D2C911AD4192727662A2
SHA-512:	52C174144A81B0218695FBB8F9152EEC917D914CD5DF2662A03706E161025FA962CDF4E952B42D990C254377B0B1A4B5B4B01AAF4E62AC6072847CE947252767
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................................%...1...7...8...8...8...8...1...$.......................*...........................................................,.......@....Z...Z...Z...Z...Z...Z...Z...d.........$.................Z...Z...Z...Z...Z...Z...Z...Z...Z...Z.........1.......'.... o...Z...Z.. o...................Z...Z...Z.........8.......1.....Z...Z...Z.......................Z...Z...Z.........8......./.....Z...Z...Z.......................Z...Z...Z.........8.......#....@....Z...Z...d...................Z...Z...Z.........8.................d...Z...Z...Z...Z...Z...Z...Z...Z...Z.........8...........%........p... o...Z...Z...Z...Z...Z...Z...Z.........6...............B.............................Z...Z...d........./.....................d..................`....Z...Z..P..........#.....................Z...Z...Z...Z...Z...Z...Z...Z.............................`.... o...Z...Z...Z...Z...Z...Z.............-..................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.1885512297205745
Encrypted:	false
SSDEEP:
MD5:	2C40ED190AA02EB3A2CDC38B89F4458D
SHA1:	F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
SHA-256:	FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
SHA-512:	1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.560345262666608
Encrypted:	false
SSDEEP:
MD5:	74FDAC19593602B8D25A5E2FDB9C3051
SHA1:	81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
SHA-256:	F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
SHA-512:	8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................\|S..{R...z...z...V...\|...\|...\|.......\|...\|...\|...\|...\|...\|...\|...h...V...\|...\|...[...~...~...~.......a...a...a...a...a...a...~...\|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................\|...............................................................................<...............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.638581632319262
Encrypted:	false
SSDEEP:
MD5:	15CC60C14626AE2549F3305C25B249F7
SHA1:	A5DB46CDB09B46FD644BE78D2E3B798AE1C3DAEE
SHA-256:	2D2E6EDAD6C27FD6BC79F2B02E15C1F8B227C1621536F902F065673FE03D0667
SHA-512:	75BC0B4C13D40C253B796FEF48AAF4F9BF8C5981B20D287E740AD9950CD95CBAB32456E57804A907D68475C8E0E2B174A4964C9014849B6A84EAB658052E6812
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...................pn..b..%U.1#M.B!H.L!G.O!G.Q!(9..%&..%".......................)._]w..P...I./.E.>.D.H.C.K.G.E.N.;.^. .]u,.............. ...4...F.oEz..=...9.'.7.3.8.;.:.?.?.;.H.0.[...BX........... ...3...M...`.g=w..7}..5~&.4.0.3.4.5.5.9.2.C..V...(5B..........+...E...c...r.e8w..5\|..5.5.5.=.4.;.5.6.9./.B.$.N\|....o..........6...W...v...\|.e7{..7.?.8.W.8.Y.8.S.:.J.<.>.F.,.Dl$..........#...A...i.......\|.c8.F.:.i.;.w.;.w.;.q.<.h.>.^.D.L./\_.............M...s...}..:w.s9._.;.s.5.m.6.m.9.r.:.n.:.e.:.U.0M_..........+...O...i...k..{xW.5.P.0o..)i..(n..x..,...,...-...{j...b...c'.fVU.?J..(I...9...lW.+K./)N..h..q..s..)v..'...3v...e...o.............{....)....)G./+b..,w..,{..,y..+v..$u..E^z..h...l...z...................k.1/~..1...1...0....... h..]XF..i...k...r...~...............3..15...7...7...5...1....^..t^ ..h...j...m...q...t...w...x..v..8..1:...<...=...<...5...4q...`...e...i...l...m...l...k...k..j..4..79...<...=...=...:...K...~m'.}l&..k..v

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	6518
Entropy (8bit):	2.407909805152941
Encrypted:	false
SSDEEP:
MD5:	5E5293480F2EE9B15767E01F4D5DBAF5
SHA1:	4AF378AE27C39DC0128EF2094A5E6B657ADB60B0
SHA-256:	87CFD63B77DA23BF2B7C342F666138C3C35CEC7F2AABD51618447913AEE97DA3
SHA-512:	3CDE31C1641B945BF1007AAE8468E815E29B1712AB877AAE2FE9C94A4AB3C1BF39F027A4FD113F962B466903E2550D52AD88E9AA5826BC66D96F43CA4AA8F3DB
Malicious:	false
Reputation:	unknown
Preview:	............ .(...&... .... .(...N...(....... ..... .........................................................................................................................................................................................................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d.........................................................................................................................................................................................................................................................l...................o.......................................$......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.6159828216175358
Encrypted:	false
SSDEEP:
MD5:	58605FAE7FE4E695F5FD358A7465565B
SHA1:	F47615D987B3F2D8FCE40DC93D55DEE71A78CDDC
SHA-256:	831CC92E9F60D151B3446E5125AF5A8C45E613636D384324179AE565DFEC08FC
SHA-512:	C045AC34FC39BBF1D7B108EB85165C57E551B47239D8A6515F7EC843C2AAE0CAEDA9E3E1CB919F1AED2FF9F98FF8D34934ED961ECEBCA1413A1FCBDA4F09343F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@......................................................................................................................................*..........................................................h.......:...............z....................................................................................................................................................A...........,.....................................R.......T...............M..............................w..............7...............Q..............................7...............0....................................................................<..................................................................u...................................................................................................................u...............w..................................................................................................E...H......................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.994300674852024
Encrypted:	false
SSDEEP:
MD5:	D2F1F9CE53773F7F51412AFFFEE0D97A
SHA1:	748398747AAA25473BBB58353FCBCCB424E78849
SHA-256:	00764980C4713198CBCDF7BD6A657BBAFFE15AE3BAA4E09A8EF19F32606BB6F0
SHA-512:	010734637DCE084DBADD5C8D7A5ACC73FF262F37331AF4C9FD318310A12986917C647FFFFABF97C102C97A496D07CBF7F834DD358901D65DBC6CD77CD1F827D3
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@....................................<...<.k.<...=...=...=...=.k.?...N...U...................<...<.t.=...>...>.d.=.?.=.?.>.d.>...E...[...V...G.4.........<...<...>...>...................................E.j.A.1.........<...>...?.......D.+.G.].H.y.H...G.y.E.N.D.......?...=.......<.+.=...>. .@.o.C...H...L...N...N...L...H...C...A.<.?. .>...<.+.<...>.......B...H...L...O.Y.R.4.S.6.S...O...H...C.......>...<...=...>.;.....E._.H.......... `.. _.F.\...U...M...F.......>.<.=...=...=...............X.0!b..%j..%j..!b...X...P...J.B.....>...=...=...=.......J...P...X..!b..%k..%k.."c...Z...S...........>...=...=...>./.....G...M...U...].."b.."d.A!`...........H.......>./.=...<...>.\|.....C...I...O...U...W...V...S.'.M.e.H...D.......>.{.<...<.@.>...?...A.Y.D...I...M...P...P...M...I...D...A...?...>...<.@.....<...>...?...B.).D...G...I...I...H...F.^.C...@...>...<...........<...<...>...?...........................?...>...<...<...............<...<...>...>.}.>.0.>...>...>.0.>

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.2795862597625223
Encrypted:	false
SSDEEP:
MD5:	93E4504D4C585CFDA1979B37E75FE39A
SHA1:	5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
SHA-256:	69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
SHA-512:	072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.2795862597625223
Encrypted:	false
SSDEEP:
MD5:	93E4504D4C585CFDA1979B37E75FE39A
SHA1:	5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
SHA-256:	69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
SHA-512:	072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 6 icons, 16x16, 2 colors, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	34686
Entropy (8bit):	1.1787188557524333
Encrypted:	false
SSDEEP:
MD5:	5337074698C608F4996D7F6AC571DBB9
SHA1:	66CB3910242DDA40A4E17C76FDC73829C8DB99BD
SHA-256:	B3C8A7AA2BC429AA15A764574D7C7D54F2672628DFF75CA830A5DB4CBC878B3D
SHA-512:	D48AF3344304FFE613511529C227F0CDE3443C6409F14058D3E381754D6FE9295B71332840BBE8D55EFE40C893AB0513B15C70EC36008844508BA4FCC8E492DB
Malicious:	false
Reputation:	unknown
Preview:	..................f......... .h............. .....~... .... .........00.... ..%......@@.... .(B..VE..(....... ...................................3........................................f..8........................................'...........s...1.............................(....... ..... .....@...............................................................................................................................................................................................................................................................................................3..n3...3...3...3...3...........3...3...................................9...3...3..o............3..43..)3...............................9...3...3..p................3...3...........................3..,3...3...3...3...............3..q3...3..>................3...3...3...3..O3..Z3...3..*........3..$3...3...................3...3...3...........3..93...3..X........3...3...3...........3...3...3...............3...3...3.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 8 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5686
Entropy (8bit):	3.499087745233182
Encrypted:	false
SSDEEP:
MD5:	CAE06CD4B5B7BE327CCB00A6DD6F588C
SHA1:	91AB18740E8C44D89F0C66485DEE5E616999921B
SHA-256:	0031AC87D8B67D608BF586EE097204782580EE645891C5D3D05591AE00F47953
SHA-512:	AD0DEEB131E9D78A58E0C61F0433F06332F0116129EA55F16739FF2C6A3767F5082500152B98273140296B8A8F1A7CAF984289AF5D562969B2515143E75E48B6
Malicious:	false
Reputation:	unknown
Preview:	..............h...&... .... .........(....... ...........@............................2)......7..............le..TL..............vo..e^..........g`......}w..........zu..............E=....91......YQ..[T...........z..........>6..OG..ic..........]V..b[.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.6549496934735806
Encrypted:	false
SSDEEP:
MD5:	0342F103B6960E1565D24EABD5A6079D
SHA1:	7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
SHA-256:	F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
SHA-512:	E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.5312914343989297
Encrypted:	false
SSDEEP:
MD5:	192A42730EEA5A6A3238F50285F01010
SHA1:	28FC94448C726E0D62375942866A1FAFC916F61A
SHA-256:	4515919BA9C8A1AE19DEAE230F2FDFBB94DE5C29753DC3FB7C2A877B474F4F0F
SHA-512:	B680B643CC66B7687108C34ADBE80996851A5B24BEAE2E7EA58C8C8AB86D4900DF12D5A4E8380186A53D7A46F923B6A4D7DB46555C5BCB0F90021DDA10D4568A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@..........................f............j...=...................................................<...s??....................g...!...............................................*...q.................N.......................................................\|..........._.......................................................v...........................................................%.......................................................M..................q...............................9.....................................................J..............................i.................................................n...;...............................{.......................4.........................................................................Y...........................C..................................................................Q.......................................................................K.................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.560345262666608
Encrypted:	false
SSDEEP:
MD5:	74FDAC19593602B8D25A5E2FDB9C3051
SHA1:	81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
SHA-256:	F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
SHA-512:	8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................\|S..{R...z...z...V...\|...\|...\|.......\|...\|...\|...\|...\|...\|...\|...h...V...\|...\|...[...~...~...~.......a...a...a...a...a...a...~...\|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................\|...............................................................................<...............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6877369236023396
Encrypted:	false
SSDEEP:
MD5:	4CA6A47462D19D539F9A32B702B10177
SHA1:	1F53B02309B901C8E7CC20F8640187F4F185F393
SHA-256:	1BACA3300AEA9840985CFBFBAF1622BE00922BA193168C1FC4246BDB8898F217
SHA-512:	E08A0013A7D8664CBBD88EAA1235A27704DBB4BD13D849D45B3A529F7373844D67C11A2B13881823EF6586840980B670C8FB278CF220D1093976CD00148CA2B6
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................u.].X.:.W.9.r.X........................................q.W.S.4.S.4.S.4.S.4.S.4.S.4...Q....................0........p.W.S.4.X.:.................D..A...f.........................K.H.V.8..........................F..B.....................6.......................................B..............................................B..B..B..B..B...s..........................................B..B..B..B..B...z.................5.................................................................../P..9G.................................................0........Wb..5C..;I..................P\.....................0................Wb..5C..5C..5C..5C..5C..5C..kv..........................................\g..:H..9G..[f....................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.9160268464631507
Encrypted:	false
SSDEEP:
MD5:	72460DF2C3C16ED7FFFA3988F5E86CBA
SHA1:	B17DACC408D124A0AEF2650A92F3C0AB2F9D4F54
SHA-256:	8D2A443307CEBA1D996D0DDAF5FCE63B838B5DAFA6F09AAEFF2D83127F38DE01
SHA-512:	516720411D964823FD88A63BB1B0AD49F8A98BEE03D13CCDF23EB5775C8B4A02E743D099A481573C02B311B27E447F646DEEA5AEB6066FABF38EFFE96E712876
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................................................................................................................................................................................................................!.......F?..................................MG..............................OJ..................................................................ZT......................................................( .............................."..................................."................................................................................{..........................................UO..................................................................ZS......................................................93...................................&.............................. ...........................!.............................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\ab_tests.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	5.047385472369135
Encrypted:	false
SSDEEP:
MD5:	90F8100F88DF86F39693C8FBDD603266
SHA1:	69639D465FF63C788946C2612EFBCE04032E3FA8
SHA-256:	13CF18AA1D1688E752AE3FF62ABB78D12B80043328B737FDEB2FDE231158E9C4
SHA-512:	F9342E44547C56ADE7A97E8A0F87364D504A76A7E1D4D466BF04A1583F7A9A0BA326DF005B915AE2A970CF787C1997FFF49EFA10F0DC6AC45D860DDCE2F130D6
Malicious:	false
Reputation:	unknown
Preview:	// LqB4bYs1bKE9FIxMiZTm9qCsCkrRDguWXcDM/REjEl2516tCdEkezQpm0MXVrfNnms16wMKtMhqebRLLRwTxEGfJv6wyHIx/bysUY13SW+whubsXmYiqdtx+CrqlMlsWyyvVPZmKxvzCzd/U/QHD5AS0PbtSNWvYc97rKqDAkG9WX8zI14s4A5n/sUng9FrDt1LlK/DH5TmqyjeVkSBmkrfA+WKZ0OJKzANLYhR6B+WhkDoKqUW8bhmqEvbvtD434R10ZQvxwpKMWCJUAOFtoBSdtSAG9ONycaH4FfQANr1rqag0qwOHmoqQL2Z3DPMo0zBVIePKA0eTkfAjmPuvDg==.{. "version": 202309131,. "tests": [. {. "name": "GROW-2836",. "total_test_percentage": 100,. "country": [. "gb",. "us". ],. "test_state": 1,. "test_groups": [. {. "name": "GROW-2836-ref",. "preferences": {. "ab_testing.cashback_badge_variant": 0. }. },. {. "name": "GROW-2836-test-1",. "preferences": {. "ab_testing.cashback_badge_variant": 1. }. },. {. "name": "GROW-2836-test-2",. "preferences": {. "ab_testing.cashback_badge_variant": 2. }. },

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\automatic_search_engines.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.371667528222213
Encrypted:	false
SSDEEP:
MD5:	58AD4E58AFC0A60CF4D2E0A0A8FB0F69
SHA1:	9DFDB7474A6B5394D43CB70AA2BE924B6C36ED24
SHA-256:	08AD136B7B6B740387DAA9D569F782BE79783A212F3F818CAF223290FE68EDF7
SHA-512:	9670D981F479180DE8841BE7140CC7873262443255B78B93D140D28D705B680BED25EA35D07042253AD5F1CC510BCAFABFAD5B2438BDA61398C4A67C4DC041B4
Malicious:	false
Reputation:	unknown
Preview:	// tXHz9LP7IOVTS3TuCQ+igwHqUH9/b6tobmZ1taOdtF+e8wII9cyJgUbie7WTa1JXFlPbOTqzVHJ6WDcNUK+wDrvUZPx6cy3da3q1TXwXzv1jafVlh9FUp7CskGM/Xo3O6NcKGsYXbdMPCcEEGyRmErLcvLTrhtmh9hTnXpSNX9MQ5Y1UXVhrZeK/ueKCnhGJw6qzDfRb7aUNa2kCOF5MkJ5Fi/wz3ZOO7KUKPVhxLz+oQ1jyEG0v8HmZewJ9OPy47jaaMTuCw7wTAyvzXrwi76C/g7sQ4RswIxgs1+BbqiWneA08q2PiBnRr/WqfDSaSLUdVOIgv+IAWxnkd+oikcA==.{."version": 3,."list": [. {. "url": "https://redir.opera.com/amazon/",. "short_name": "Amazon",. "color": "FFFF9900". },. {. "url": "https://github.com",. "short_name": "GitHub",. "color": "FF000000". },. {. "url": "https://istockphoto.com",. "short_name": "iStockPhoto",. "color": "FF000000". },. {. "url": "https://twitter.com",. "short_name": "Twitter",. "color": "FF000000". },. {. "url": "https://youtube.com",. "short_name": "YouTube",. "color": "FFFF0000". }.].}.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\browser.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	C source, ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	22649
Entropy (8bit):	4.0694982305625595
Encrypted:	false
SSDEEP:
MD5:	D29B99B515DDA560BF858DA73466466F
SHA1:	F00DECE861CD0245AC29A3B3D6FCEA2ED68A45A1
SHA-256:	B27AD842F7484E73F503FE0EAA7ED144E1EAC192952F77CF943C7D5F6DC7B463
SHA-512:	582340C064DB35C171A7105F835A77187D2B34FC3C2CBFD2B1DF9FF75220EA8157421B4E99CDA3F643529FCB14C4A6754CCD0AFDC6A60637A4E051D85D8B14CA
Malicious:	false
Reputation:	unknown
Preview:	// SlyQgsAU/sbiPsEpycLE6apc2FhaXw/MgUJIMTa8mZEJGaiIA98XrwIpGdLjWZsyD0euqtpxDrqVEwYEdjOY0vdJl20BYdkvf5KYIKSmDCFZGe2rp7RvDdpXUm7OQzLSjx73D9zb5iGgdq8w10kuoy2U1jGQJOy7IFRpEgRkXD0zFVjxqHoSXaRdtuFEuPfns4o4iwi5KW3we569Vx9nybA0mtyc8mhemL9GKrmNhadflwkJ4AjS/zFDTyuEHYh9XOJ9ipQnjL692h8JvZZBj1NllqZ2it+nDFG2bLRJXC+rfu5dOdQr6HRAaPEeeOgEpkFQPrLp6byunm8vywgetQ==./. Copyright (C) 2024 Opera Norway AS. All rights reserved.. . This file is part of the Opera web browser.. . This script patches sites to work better with Opera. For more information see http://www.opera.com/docs/browserjs/. . If you have comments on these patches (for example if you are the webmaster. and want to inform us about a fixed site that no longer needs patching). please report issues through the bug tracking system. https://bugs.opera.com/. . DO NOT EDIT THIS FILE! It will not be used by Opera if edited.. . BROWSERJS_TIMESTAMP = '202402231442'; // for versioning; see DNA-54964. **/..'use str

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\continue_shopping.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (1971)
Category:	dropped
Size (bytes):	151577
Entropy (8bit):	5.936873123153331
Encrypted:	false
SSDEEP:
MD5:	ED5164759EBD66C9F333F846FC8F46D3
SHA1:	F2927063BB4FEB92959C424A706F1263E91793A2
SHA-256:	1844B4EFE56705FF2C5148339C050BB4CD2E7BB491B40256CF77DE60AE5713B3
SHA-512:	6EACC3227EC5BF0E3AA504D493221AF489AAA33918C1C449221AB4F73430A86414D26599CC3EC50B7CBC02FDFE429F3132DAE693FE8D12C76604CE9CC14FBE7D
Malicious:	false
Reputation:	unknown
Preview:	// umaUh2+0pXorqogH9N/Wx3U4LF0W3iLvxhEok7aGX87IUFsE6+sMKT0Z7zKwnwhTfmJhZTGbvmV3VgY4zDrKO8Hrlk2Oe3bKeS4xwEWKk2EOUPSaz9LN+GE1tuW38u8Uebg5Ux+cknxXeI/oLSpt5Aq1C38768geT1bVBaXoWgebsRR/zyc6pApDgbCs16eKUdffDUOSvmGqmIjholQ0fYpytXQ1wVBhFIZFj1QsuAuG1jXJka40/tfKFvBD17EoP7OJrBlN0UpYTAzmwl3p0H3NGqzkSUaADc0tvmkf3cTdp20DQbVKpvQdVQEcwdRu7sq+SWZ5WXboevwkQiedTA==.{. "version": 7,. "partners": [. {. "partner_id": "aboutyou_at",. "partner_domain": "aboutyou.at",. "product_url_pattern": "\/p\/.*",. "product_history_pattern": "\"aboutyou.at/p/\"",. "partner_icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAclBMVEUAAAD////4+PgYGBikpKQmJiYLCwvi4uLb29tLS0v09PTp6emCgoJra2tcXFxJSUnr6+vJycmKioo6OjojIyP8/PxfX1/6+vrMzMyamprf39/S0tLR0dG9vb28vLxDQ0MfHx8aGhrd3d2GhoZ3d3dFRUWvj4E8AAABVklEQVRIx+1VV5bDIAy0wcbg3kt62b3/FTeUZ+EW7Yt/M5/SSIyEEM4Xn4L5lRCVz/7Hpq13jEJCwujotRSl1yVv3BENL+v3/OThzsCTd2o84i5AvE1dt/NIyoMgH4PPt438F8Mu4syn1M/iwsRc1s/wtLdP2dje1JTkrdbbqfSDne0a6IBupf

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\default_partner_content.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (347)
Category:	dropped
Size (bytes):	250778
Entropy (8bit):	5.961858163197512
Encrypted:	false
SSDEEP:
MD5:	990E35AB66BBB477B15DF6231D82AB33
SHA1:	A4AAF6800F1A20D34CF764CE2504B632E5C5F98D
SHA-256:	EAFD0EDB1F514B93CCFBEFD126667B79E7864C02D5EAD6AC4DA0831A3BB5973D
SHA-512:	DE3B2AC3A9C8DA93BD87641DFCF9404A41D18003BF6BD9A85CCB2340307088376D2C16D43205F0A6F88FA74BBD835A3EC0D11ABA95DFF52BA4D495FE572EC87C
Malicious:	false
Reputation:	unknown
Preview:	// sMxpi91lH0J1aG+gfm3IqGRi1kqpR0dDoOaBbahhYaSc//xB1A/Zd19Btazi3f+3TWe6JWqY63Qpeal+2PZ2fbbaqOCJtZjra+m0Uvs/Cv3yOtkUzhjc3AdES+WmEi+ZpwT5BsiTf+xiAl/fiUEBPXgytVDTNldqnoFR0w26uTVE5Q9Mdxcux34MchCGUzNnksOpT3RNfYkVtto+ixuN9c6NXMjhUBVKVipzmP4VZ3xosnXlPins8NaDF5/qBjFROtZYVjAQNrRnq01HE99xODYDUYrX1JCz9Tv0OI7lFbziLGCaw5B8PyusWUZqVr63vEBiGQAmFO9RSxuhU3KKRA==.{. "version": 134,. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki",. "booking_com",. "google_maps". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki",. "booking_com",. "google_maps". ],.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\doh_providers.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	801
Entropy (8bit):	5.495629414250427
Encrypted:	false
SSDEEP:
MD5:	4F98A7320537B24179D9860246E2D840
SHA1:	B727FDB4D25AA07E02464EAB8DAAE4DC663ED298
SHA-256:	574421B40CF123844F55A0A72AD5EC0BC9DEA3C8D823F8B7EC065D7B7C346175
SHA-512:	3F6273688F25D375974A18E554339B7F3E2F0BCEE19F31E265DD6256C3514A23B4980D4F2182A69AD5ADA95A2CAD8F94AC04B510A26954392626EBD28F54E5B4
Malicious:	false
Reputation:	unknown
Preview:	// ia96yydt8bWv3y5ivc46+PdnIQFXt6cwopEjrrZk+GzzrDKmMzcyxK7YvTbpmIQjCw/QjXke1u1o3WiWeFr5+90QlOeWBJnZjzqILeh/ogmgCbB7hcNIVL31zrGZF+EyVVFZVRDsBx6pLCX3DEHKGrXNOb9epqcY2EwwM0goOtSqFoc+wlNrDRNwVOVT4GQ05GKThcHzHWSMu0DzC8Yd2II64XSFBsDM9U+HlrlASNhELQ31db0HJL0EWMcQc4sFM/DixX7TPvU/oKX35liQk8HEVxVrxhm612/tW8rZ54zab/O3RW1LE/23aLHU5jslgAI36CGRvXFeXlfeA51jJA==.{. "providers": [. {. "url": "https://cloudflare-dns.com/dns-query",. "ipv4": [. "1.1.1.1",. "1.0.0.1". ],. "ipv6": []. },. {. "url": "https://dns.google/dns-query",. "ipv4": [. "8.8.8.8",. "8.8.4.4". ],. "ipv6": []. },. {. "url": "https://dns.quad9.net/dns-query",. "ipv4": [. "9.9.9.9",. "149.112.112.112". ],. "ipv6": []. }. ].}

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\domain_suggestions.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11626
Entropy (8bit):	6.0888959569937775
Encrypted:	false
SSDEEP:
MD5:	2F5136C14D7DC6E3CC79C6B54510680D
SHA1:	5187CE8D7897FBD9392B566576998DFFF33A3E6A
SHA-256:	6AF202C1D4FF3D20505814D3018748562BD67A44615D686DC316088A77229119
SHA-512:	A9398C09D70D14A09682778BFCC5415EA3539F960A44FC6B4FAA2F7C3F4E1C368525EE889696E6428297DCFB1F33B188AC12578352F725E81F0DB6938BC11F8B
Malicious:	false
Reputation:	unknown
Preview:	[. {. "url": "https://bestbuy.com",. "audit_id": "T57wbw2aOJR9jxXRgj+sZKk8FsoXHqe4TZddvID+93o=",. "title": "Bestbuy",. "favicon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAcCAIAAAD9b0jDAAADaklEQVR4nGL5//8/A7UBE9VNHDV0WBr6////f//+EaOSBUL9/Plz7YbNL169YmRgFBERdrSzuXr9xpVr1yGyUhISRob6W7btfPHqla62FjcX14NHjyBS3FxcoUEBwkKCWAz98fPn0lVrbt++qyAvd//hw2MnTjEzM23ZtlNZWZGLk0teTnb77r2Hjx5XkJf79OmzhLjYkWMn7ty7LyggoKej5e3hhmYowvuMDAxc3FxGhvpsrGzMzMyMjIwsrCxG+voOdtZRYcE/fvxgYmLU19WOCgsuLchtqq3k4uR0tLed0t8lLSWJL0y/f/t++85dFhbmr9++ffny9c+fv5evXjt1+uzff3/zszOsLS327DtYXFl35vwFLi4uBkYGNlZWHm4eJib0iEHh8/Hx+nq6S4iLHztx6vHTp2xsrK7ODiGB/r9//3n58pWxob66msqr16/v3rtPVEQxMTGJCAu/fvNuzoIljEyM3h6uDAwMnz59WbthMyMjo6KCvLCg4JHjJ3/9/mVhZmJvY/Xz5y8JcXF+fj5GRiyGMkJKqX///r189frSlaunz5xjYWWVkpSQl5X99//fkWMn9HS0FeRlT54++/nLlzdv3lqam/p4ul+/cWvj1m3Wlhb2Nlb4XCopIb573/7ZCxaLi4n++PGTn58vwNdr/uJl+VnpUlISE6bOcHGwf/P27dETp6QkJWfMmX/56nUfT3es3kcJU0jRamVhrqyk+Pnzlx8/fv4HeQQM//3n5+dPSYh7/+FDaXX94WMnwoL9tT

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\0d406bdcf61e6d381f23.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4691
Entropy (8bit):	4.498721276528976
Encrypted:	false
SSDEEP:
MD5:	E9718882364FCF881A5FF3570E6C42EC
SHA1:	5A1375AE8501C59CBD2BDFE0F54D9D7D2014825E
SHA-256:	9797AB0A14B11C618ACC0EC07C54B2B1C91AC8DC7FF4814796439D5FBB76ECF1
SHA-512:	B58B892ACC41C9CA1C72C83E24CE1644EFE15416C5287DCEB3171C80A05428294B2C6DDD4E7DE3433D6C369E9867FD0C2DE19466C61F34E888A2E1B9024E3052
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<rect width="16" height="16" rx="8" fill="url(#paint0_radial_2915_26599)"/>.<rect width="16" height="16" rx="8" fill="url(#paint1_radial_2915_26599)"/>.<path d="M5.79121 2.70393C5.22374 2.7307 4.83621 2.82126 4.49743 2.95438C4.14682 3.09102 3.84964 3.27438 3.55396 3.57113C3.25828 3.86788 3.07619 4.16526 2.94051 4.51641C2.8092 4.85593 2.72024 5.24378 2.69518 5.81156C2.67011 6.37935 2.66456 6.56186 2.66734 8.01018C2.67011 9.45851 2.67651 9.64006 2.70403 10.209C2.73112 10.7764 2.82136 11.1638 2.95449 11.5027C3.09134 11.8533 3.27449 12.1504 3.57134 12.4461C3.8682 12.7419 4.16538 12.9236 4.51738 13.0595C4.85658 13.1906 5.24454 13.28 5.81222 13.3048C6.37991 13.3297 6.56263 13.3354 8.01054 13.3327C9.45845 13.3299 9.64074 13.3235 10.2096 13.2965C10.7785 13.2695 11.1638 13.1786 11.5028 13.0461C11.8535 12.909 12.1507 12.7261 12.4463 12.4292C12.7419 12.1322 12.9239 11.8346 13.0594 11.4833C13.1909 11.14

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\11bbdce584eb010669fd.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	68087
Entropy (8bit):	7.97091916222825
Encrypted:	false
SSDEEP:
MD5:	2EEA6E00053F88F4A1CEB69C4AE358EB
SHA1:	B188D3EE49D40ED47522202A9A0B1BE4EF5BF4F9
SHA-256:	14D3FDCB884252A8B29B336ACAF27C48DEFBFAB6309DAB8D2CB368CF836746F8
SHA-512:	BE0A4522A1E61E6F12FE96C5C9BB97F507A5109F6E6E25F105A35CB0997AD9C3270073331DDD67B219123DC1A328DF460BB4C08FB707EAD2489B9406CEF5A5D4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.......................................................................m.d............................................M.........................!1..AQ."aq.....2B..#R..3br...$C....4S....&'c.DTds...................................B..........................!1.."AQ.2a...#q...$3B....R.4.S.CTb.%r.............?...5}`G+.H..]}.Uk..x.Z.:-&.....P.,/..J..6..Ok.n.R..0#pt.vj9[...xNr%@.A.c.5]....@=.N[.Fu.VT....Q..r.$..jCt.0.1.....m.... ..S.d.....t.k...rSy...-.`r.,.........2.....6..FBaE@r.).Z.L.tJ.....I..R...U&6.....+.4...!.<.N..#.g...F.j).dS....D.>.)P.@.U...!..Y..B.........%$.Q ...KTyD...!(D`..P....Q...P. ..`P....J$....r..`..#za..R&........j.R..Q......<...5Jk\OF....j.d'....5.'..aU]d.....;V5F.k..0...C.....z.H;..0..m.D.mX.:FA......r.?u..*.- .....w.u..........B..xj.c.I..-oa..6..ZbF..'[..Z.U.H.3U]G..M.:k:...&...kP....Jj3..E.j<!._Z@....ZM..r.P..ip.=".(B...Q.....Q...

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\28823de3046af6be5504.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	4.383015673791238
Encrypted:	false
SSDEEP:
MD5:	DCFCA9CE424F28682149D99C0BB5EDD7
SHA1:	6BAC3DC253373EF713F178AC47D5B1E934E41464
SHA-256:	60303F48B5DBCCBF9F0E7780E695CF376F1D851868CDB40745577CF91F131AB3
SHA-512:	FB20733DB63531BBD58B160F8B5A538E72526511B252ED58780E0B9B2C2CBED274DC8FC227D4747194E06639E3639519A007D2E62E8132B0585A099DD546A5D5
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<g clip-path="url(#clip0_2442_28000)">.<path d="M8 16C12.4183 16 16 12.4183 16 8C16 3.58172 12.4183 0 8 0C3.58172 0 0 3.58172 0 8C0 12.4183 3.58172 16 8 16Z" fill="black"/>.<path d="M6.93868 6.85595V6.42128C6.79201 6.40262 6.64535 6.38928 6.49601 6.38928C4.67735 6.38928 3.20001 7.86662 3.20001 9.68262C3.20001 10.7973 3.75735 11.7839 4.60535 12.3786C4.05601 11.7893 3.73068 11.0026 3.73068 10.1359C3.73335 8.34662 5.15735 6.89862 6.93868 6.85595Z" fill="#25F4EE"/>.<path d="M7.01603 11.6507C7.8267 11.6507 8.49603 10.9973 8.52803 10.1947L8.53603 3.03199H9.8347L9.83203 3.02133C9.80536 2.87466 9.78936 2.72266 9.78936 2.56799H8.00003L7.99736 9.74133C7.96803 10.544 7.3067 11.1893 6.49603 11.1893C6.24536 11.1893 6.00803 11.1253 5.79736 11.016C6.06936 11.3947 6.5147 11.6507 7.01603 11.6507Z" fill="#25F4EE"/>.<path d="M12.2773 5.47732V5.05599C11.7787 5.05599 11.312 4.90665 10.9227 4.65332C11.2693 5.0533

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\28ba6531a8d10a17962b.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	199190
Entropy (8bit):	7.988543851155108
Encrypted:	false
SSDEEP:
MD5:	712F4BDDDF1CDEC924C096A5DEC5EA7B
SHA1:	EC324002C28706AFFDD4FC24CB2E35D79982379B
SHA-256:	71B519A32B86AC8C47B6C65B5E0DB8C52CB18DFC407A78A2F4B2B4E08B803FD2
SHA-512:	EB5D1FA1966D0E4EA87F5CA8C9B09226657DF9EB06EC9379AB2245BC97C156DCDDCB433497F9C3D93A87FBD544A62A1701C3EAAEE595CF771FDBCB5E65793A08
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H.....C....................................................................C.......................................................................m.d..............................................S........................!1...A."Qa.#2q.B..Rb...$3r.C.....Sc....4...%DT..&s..5Ed.....................................Y......................!...1AQ.a.."q....2.....#B.3Rb...r.$...4CS..%...5DTc....&Us.'EV...............?...z.......k.."..........?O.a".5...y..2..7/..(..../...:.g.B...7...(.......r..=Q.....}^.~..o...)...}.v.g............#..!dbS.......R.\...Q.....{..M..L..a.....$..g.z..k.H(.9.h?_]....^...^.z}...S.X.s.....Rv.._5............,..<K..w.a....A!J..Y.........r{o.9....t...4..2.\.^.G..............W_ak.h......u9-O.=\7\|;D..../3Rs.....f*Ic...o..<.....7.4Z.w=.....0.:.C..v0..(.P..Pf...kh..\...A>C>_=...i....;.O.3B.&...$..<..qn.i.....UT...G`{..8x..Q.>..R.uVC.........].....2..Q.p!N8{.p..r...].....b......!.....r..T.......{zp.(.V..3~m.s.Y.......~q..i...

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\2d0dbf42750207f78ffa.ttf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	TrueType Font data, 15 tables, 1st "GSUB", 8 names, Microsoft, language 0x409
Category:	dropped
Size (bytes):	74036
Entropy (8bit):	6.3075073521141105
Encrypted:	false
SSDEEP:
MD5:	57EDF69F1C233274888ABFE52252BCE2
SHA1:	00E05B90B55C1BF9B5FAC4B80F91BE84B565A433
SHA-256:	196974ACB6FB369B0754A1DAEDF1B538B55643259F9FE021948301C68C541A28
SHA-512:	28806F4209627E454F638B5D79847BCFD3C785527F8D9197C5DA25ACBFC1602A1896257849DB28C11D1B993ACAF62C6B64D2A0F0DDF114D3A12956BD7A23123A
Malicious:	false
Reputation:	unknown
Preview:	...........pGSUBOfoc.......LOS/29..........`cmap)7..........cvt .S(.........fpgm?...........gasp............glyf~..'..;h....head.&2....H...6hhea.......$...$hmtxU]Vc........loca.,r.........maxp........... name'.Bq........post..t7.......prep//0....h.................j.k...e.......>.w...............`.....d...............................B..Ap_.<..........l......2.%.......`...............d.........X...K...X...^.2.)............ ...............CF .......`.....`.i .............. .........................................~.~.x.x...........8..............8....N.N.H.H.Y.:...._.3....N.N.H.H.....R........R..........K...RX....Y.......cp...B....".....B@.B.5.)........B@.C.<./........B................B....@.@.@.......D.$..QX.@.X..dD.&..QX......@.cTX...DYYYY@.C.7.+.....*..........D..d..DD........f.........^.0.................................2.......................t.P...........4.........4...h.t.t.p.:././.s.c.r.i.p.t.s...s.i.l...o.r.g./.O.F.L.S.p.a.c.e.M.o.n.o.-.B.o.l.d.V.e.r.s.i.o.n. .1...0

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\313dd08924b1b4a517bb.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	11092
Entropy (8bit):	7.818947790117608
Encrypted:	false
SSDEEP:
MD5:	685C96B95AD426DCC37590219F764575
SHA1:	BBC283C64BDD52CA681F3313AA79D9E8C7E985F4
SHA-256:	5158E4DB33873EF41D60ACF10909E70B711FD45F1E27F512F850E5B4732286DF
SHA-512:	B89800894DF2EEE42474784AA74AD3A713A01CBDF94A1FC146A33259BD27AE27419B60AB687B4A23ED62FE7788586B22A5BD68631C38E8E5F23759E728DB1C1B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C.......................................................................m.d.."........................................%......................!1..aAQq..2B............................................................!............?..;..VG.Y..O.._.M...Ud_Y...\.....Uf_Y...\.4..1W./...b.Tgh...e...M.."..Y.]y...b.......7".QJ.5%w....~jZ.U%5<!U".>R)..(..R.)....B..]2R...CZ....`.)o.F4.@..~..mr."..1..}.hp..p-..M3....1.a....0.7.....8...8.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\37d24412e02af82ffc5c.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.409290224048193
Encrypted:	false
SSDEEP:
MD5:	045D3299D41D9F07A801FF0627C5F336
SHA1:	C6844BFA633B6635D0E12FE34A6B63151FCDF652
SHA-256:	5000E145CD066FCF9E23452A52BE87DB5BB47C55C64D7EAB9CB128B03EAFFFA4
SHA-512:	8DC434107CC047420DF55294EA1E2C34EB58D3D7103B1439A234ECE8CD0F344AB49A97216A1A31F5A9822CB4C2101931273B5E88F587AC84A05064DA8D1AA725
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M0 7.76C0 3.30112 3.49336 0 8 0C12.5066 0 16 3.30112 16 7.76C16 12.2189 12.5066 15.52 8 15.52C7.19053 15.52 6.41392 15.4131 5.68424 15.2125C5.5424 15.1734 5.39157 15.1845 5.25696 15.2438L3.66907 15.9448C3.25371 16.1282 2.78485 15.8328 2.77093 15.3789L2.72736 13.9558C2.722 13.7805 2.64312 13.6166 2.51245 13.4997C0.95584 12.1076 0 10.0923 0 7.76ZM5.54572 6.3011L3.19572 10.0294C2.9702 10.3872 3.41001 10.7904 3.74692 10.5348L6.27121 8.61899C6.44196 8.48939 6.67793 8.4887 6.8494 8.61731L8.71852 10.0192C9.27937 10.4398 10.0798 10.2921 10.4537 9.69902L12.8037 5.97067C13.0292 5.61286 12.5894 5.20966 12.2524 5.46534L9.72817 7.3811C9.5574 7.5107 9.32145 7.51139 9.14996 7.38275L7.28089 5.98094C6.72001 5.5603 5.91953 5.70798 5.54572 6.3011Z" fill="#00000080"/>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\3df11e64133f9949a6b2.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	10841
Entropy (8bit):	7.8216909168142355
Encrypted:	false
SSDEEP:
MD5:	6E2035E3C28FCC23FE4B78F1580E78FA
SHA1:	111D757F8021975EEA0DA0AC50D6A317F3326C5E
SHA-256:	7358C3F3CC46EBD4077EBBF66E320D620B58EB34548B26F6B228918D718B9B0A
SHA-512:	F192B5E58B8C945B907E5E956E52300673B4C83A0724C19BB5468B9E1ECB0BB591557D2141E84EC36BF2E76B99A18CA5FCF25E98765261DD3EF9FAD016238B08
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C.......................................................................m.d..".......................................(........................!Qa1Aq......Rb.........................................................!............?..A.d..vq../%...'"e.C...8/...!..V.~.B..u.V.~.+P. .!...B.B......g.p...s.p...<..........!Y...$..!2..L. ..9..x............................f4D&I..Sdo..[y(..Z..e......RD~....A7..`J.}......R.?......H.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\405e207014bf75cd59c6.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3939
Entropy (8bit):	3.8818839560076843
Encrypted:	false
SSDEEP:
MD5:	4B36C190CAB8DFF3A46AF6B9D00C5892
SHA1:	2400C95959D0C38CE8905516FD22091774263AC9
SHA-256:	FB723AD00D30E49F158FFDF30AA67D2530ABC15B305530C7048AB1DAAD872B65
SHA-512:	6EE6CF6BA8363E85B6CDD9CDBC9DFF3F27529C73C8D42CA4D7CDDD78961788085BEB6B1495BD920CC5F518780CE4BF002E234894606E6503FB4E88D32C6D95C3
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="17" viewBox="0 0 16 17" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M8 16.6404C12.4183 16.6404 16 13.0587 16 8.64038C16 4.2221 12.4183 0.640381 8 0.640381C3.58172 0.640381 0 4.2221 0 8.64038C0 13.0587 3.58172 16.6404 8 16.6404ZM4.49741 3.59476C4.83619 3.46164 5.22371 3.37108 5.79118 3.34431C6.36004 3.31657 6.54138 3.31039 7.98982 3.30761C9.43826 3.30484 9.62098 3.31113 10.1887 3.33567C10.7564 3.3602 11.1441 3.44969 11.4835 3.581C11.8348 3.71625 12.1326 3.89812 12.4293 4.19412C12.7261 4.49012 12.909 4.78698 13.0461 5.13759C13.1791 5.47669 13.2694 5.86293 13.2964 6.43168C13.3234 7.00043 13.3299 7.18197 13.3327 8.63009C13.3355 10.0782 13.3296 10.26 13.3048 10.8292C13.2801 11.3965 13.1908 11.7844 13.0594 12.1236C12.9238 12.475 12.7419 12.7726 12.4463 13.0696C12.1507 13.3665 11.8534 13.5494 11.5028 13.6865C11.1638 13.819 10.7784 13.9099 10.2096 13.9369C9.64072 13.9639 9.45842 13.9703 8.01051 13.973C6.56261 13.9758

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\45763c696a4442585bb4.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	5.008386604593593
Encrypted:	false
SSDEEP:
MD5:	C8A4E5C54F9DF08D553B04D8B142C562
SHA1:	E09F44E36EFD988C769E12124EAFA383AE276079
SHA-256:	09491461D970DD187105E58DABE58C79FE75E39359D28077ED04256E816D24B4
SHA-512:	F620A29DEB3A02EF8AA2DD2C44E172E8F25546F23669862C639F208C2FABB51EB7E4368601EB025781052FC4B12179A6964EDB90C1A0C4FA7E8BC9F87986248A
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M8 0C3.49336 0 0 3.30112 0 7.76C0 10.0923 0.95584 12.1076 2.51245 13.4997C2.64312 13.6166 2.722 13.7805 2.72736 13.9558L2.77093 15.3789C2.78485 15.8328 3.25371 16.1282 3.66907 15.9448L5.25696 15.2438C5.39157 15.1845 5.5424 15.1734 5.68424 15.2125C6.41392 15.4131 7.19053 15.52 8 15.52C12.5066 15.52 16 12.2189 16 7.76C16 3.30112 12.5066 0 8 0Z" fill="url(#paint0_radial_2442_27993)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M3.19573 10.0294L5.54573 6.3011C5.91954 5.70798 6.72002 5.5603 7.2809 5.98094L9.14997 7.38275C9.32146 7.51139 9.55741 7.5107 9.72818 7.3811L12.2525 5.46534C12.5894 5.20966 13.0292 5.61286 12.8037 5.97067L10.4537 9.69902C10.0799 10.2921 9.27938 10.4398 8.71853 10.0192L6.84941 8.61731C6.67794 8.4887 6.44197 8.48939 6.27122 8.61899L3.74693 10.5348C3.41002 10.7904 2.97021 10.3872 3.19573 10.0294Z" fill="white"/>.<defs>.<r

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\5481ba37652e144d94d4.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3149
Entropy (8bit):	7.820294346407631
Encrypted:	false
SSDEEP:
MD5:	E086921E6740266DDB5834935C04AD71
SHA1:	3CD5C0FA043390BC91A3AA6FA35D76D1B018E8CF
SHA-256:	E9A847B89E5A437DEBEE6ED15E82EDBB8F65A5185F4FC8160D0BFD116ECFD841
SHA-512:	0179C528092141D36C77F1129F7204D70321E456C6DA129F08ED9EAFF460C7AA2FA829309D2A22A6496C99322B7F34D150DF94F98A66AF8185BEC4676BFB8AE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......F......PLTE....8...H..I..B.E\..C..1.!m..J..F.....p..G..r.#e..q..q..E..I.m..q.RA..q..H.b...;..p..L..E.....q..s..N..K.....%.Nx..G.d-..3..M........Q.8...;../..S..r.h).R8..U..@.]\.B..T5.xY..3.8...-..)..3.[].6..D>Y9..A@.K;.>B.H<.3L.P8.S6..n.;D.5H.8F..k.N9.Y2..g..I..<..F..9..E..E..C..B..7.;.._/..L.V5.:...G..>....._.1Q..B.....3.c,..I........b........I..0..s....C..p6.g..$...s]...A..:..,....W..H...h..8..7.x7.z.....Z..@.ZB.b5..k(..'.u"..Y..P..K..J..8..4.P.\|\.hV..{R..K..J..C..6..2.p%..!....K.>.k[.`T...ZN...B..@.^8..4u...p.!Y..K..<..:YH..'T.g9..4.g3..0.M.;.tR.mJ.0.p>.eC.h8..%.j/..-P\|T.0.bL..`V..Q..M..D..6..,.E.A.B.{I.4.:..5`.mW..<..:.E.9.y2.k@...Py?..o..._.T[..*....O.;...J../..#.S....;.m.I.A....H..Gu.b.rW.MP.C.K.[..F..C..km.Hf.].x.y..r.W.eL.R...,....AtRNS......,+$.u..s....d.....ld..M...jH=........F.......W7...=.......IDATh...ML.q...?...A...YS7{~X..Z....N5...,p.BF1.6.Z..-...A.f.;E..y...,.5.lq...<h.{......TB.b..{........Pn..V...T\M.o

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\61a42bb99a92e9c1352f.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1441
Entropy (8bit):	4.174695530898883
Encrypted:	false
SSDEEP:
MD5:	87DCB5F2CD4A7606E167E26EA4ABBC0C
SHA1:	489391F445B146C293AD285CBF2F8BFBB40BF066
SHA-256:	7EA4DE2BD0E414D8E04E55364DA87EC2E581AF661373911503AC3CEC75565BF3
SHA-512:	B2A4F1AB9145242687E463C2F90EB23E4AA6637E58E55E79C6E9B61AEF280B1DDD2CB0C7BD5720637316F5B52C9B4B47112CAEE7194E498EED2F1953518D97AE
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="17" viewBox="0 0 16 17" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M8 16.6404C12.4183 16.6404 16 13.0587 16 8.64038C16 4.2221 12.4183 0.640381 8 0.640381C3.58172 0.640381 0 4.2221 0 8.64038C0 13.0587 3.58172 16.6404 8 16.6404ZM8.28698 6.54625C7.50886 6.8699 5.95372 7.53977 3.62156 8.55585C3.24286 8.70645 3.04447 8.85378 3.02641 8.99784C2.99589 9.2413 3.30078 9.33717 3.71595 9.46772C3.77242 9.48548 3.83094 9.50388 3.89092 9.52338C4.29939 9.65615 4.84885 9.81149 5.13449 9.81766C5.3936 9.82326 5.68279 9.71644 6.00206 9.4972C8.18107 8.0263 9.30589 7.28284 9.37651 7.26681C9.42633 7.25551 9.49537 7.24129 9.54214 7.28287C9.58892 7.32444 9.58432 7.40318 9.57937 7.4243C9.54916 7.55306 8.35239 8.66569 7.73306 9.24148C7.53998 9.42099 7.40302 9.54832 7.37502 9.5774C7.3123 9.64254 7.24838 9.70415 7.18695 9.76337C6.80748 10.1292 6.52291 10.4035 7.20271 10.8515C7.52939 11.0668 7.79081 11.2448 8.0516 11.4224C8.33642 11.6164

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\61c87b77a034799680ad.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.178274094331675
Encrypted:	false
SSDEEP:
MD5:	0AF125B1C0A89268BC43185800B6680D
SHA1:	25665503FB388046D5BFCA9B011FB99B4102FD2B
SHA-256:	4641B5D1784685A075B7079F0B241C6C10D5EE5545ADA837CAE22164CF0B0DC7
SHA-512:	ED095FE57D22E7DE7D3990D04C1C2EB56311B6A3399B66702B1291FED87B862690AAB8ED11FD53FA51409D76399199F10489F7AE3F150660F0912534454210B4
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<circle cx="8" cy="8" r="8" fill="black"/>.<g clip-path="url(#clip0_2915_29666)">.<path d="M8.71678 7.42672L11.5192 4.23669H10.8553L8.42099 7.00599L6.47812 4.23669H4.23669L7.17533 8.42475L4.23669 11.7696H4.90054L7.46962 8.84449L9.52188 11.7696H11.7633M5.14014 4.72693H6.15999L10.8548 11.3034H9.83474" fill="white"/>.</g>.<defs>.<clipPath id="clip0_2915_29666">.<rect width="7.52661" height="7.52661" fill="white" transform="translate(4.23669 4.23669)"/>.</clipPath>.</defs>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\72036430436803bb8a27.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1568x882, components 3
Category:	dropped
Size (bytes):	444938
Entropy (8bit):	7.981440626046167
Encrypted:	false
SSDEEP:
MD5:	9A2EF3267A6A6F22A73B3CB6CE489B36
SHA1:	4E4EBBCADFDA040E696D5F320A79522239D8C783
SHA-256:	8E2F437B2A366B641C063D9961B82FB6DC570E3C4331CDF073DC0CD3B9F2659F
SHA-512:	54651D8938E900FD078F40FF141E9E6580185CCCBB6BA1D0428F7C1C3B9B75B20B8E99682F24100714496E6961336412ABC35C1F2283BE09AFD744058F849CAF
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.......................................................................r. ............................................N.......................!..1A.Qa.."q..2....B..#R....3br.$.C..4S%5Dc..s..67.....................................R.......................!.1..A.."Qa2q....B.....#R..3b.$r...4CS..%...5csD..&ET..d.............?..=m(.G..+f.v.ISNRC..]]-....P.I...K<._.4Z.A2W...1.2`.3z$.l.x....L...;.T..u...HU......$.H.u.......p..TaS.5]B...$.....p...%.`.H....!.........B...~{G....9u....q;....:.d..eY(3...X.mN..Z.....U.`.eM9p....`}.`.......'b.....c......4i[...O,?...?....8.k...d?...r..j..WJ.y.P.H..L..+.j.Qq....\|....>.......+../.q..t./_.G.8.>.+.....^:.Z.....&f.N2.U!6n..m 6]2.....ZX..........%E>.0.G...iCJ....s...y....U-.w../."=!...k...]....x^\|."\..0.'mG...}z2.]....+ML....?).v.1uM<...XN.I..5Z.....9.)..I!>...8.4....LOH....r].D.$..2.N..Fd...o..44sr...X.c..5(..'....6z}@ ..0:.Y.8W....)..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\7bbffe1e039c3f8f477a.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	550
Entropy (8bit):	4.746669618077714
Encrypted:	false
SSDEEP:
MD5:	6E4A59DDD57B143016D4D885F8730C1C
SHA1:	855131300BF31600D22A142ACCCFED2A093F0F43
SHA-256:	5696477FCECEE56F1CCCAB0B8854BDE84C0DE28C631D7617DECCFFA3BC18C00A
SHA-512:	E786B60B29324886E199B7F5D7F0DDD155B0EF5765F8B66A5E5DD877C8F7F425639811396D441965DB823BFD485C9F7902AC20CBEB3C778B27AA6FDCA5782976
Malicious:	false
Reputation:	unknown
Preview:	<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M12 23.5C18.3513 23.5 23.5 18.3513 23.5 12C23.5 5.64873 18.3513 0.5 12 0.5C5.64873 0.5 0.5 5.64873 0.5 12C0.5 18.3513 5.64873 23.5 12 23.5ZM17.0588 6.5901L13.0304 11.1758L17.4097 17.4186H14.1877L11.2376 13.2138L7.54451 17.4186H6.59023L10.8145 12.6104L6.59023 6.5901H9.81228L12.6052 10.571L16.1045 6.5901H17.0588ZM9.35498 7.29482H7.88893L14.6374 16.7485H16.1038L9.35498 7.29482Z" fill="#00000080"/>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\7d53fec23372c39c9d12.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	46715
Entropy (8bit):	7.973891698359137
Encrypted:	false
SSDEEP:
MD5:	72A28334E97C06644113D9ECBE7B4E82
SHA1:	1EA64C9261A37BDD37D08C5FD747AE51675F0E68
SHA-256:	B85B7A610F531AF7FF1664BE5589FA88ADAC567D690D1A2A15B182C64B60DC8A
SHA-512:	3D8D22FC04F93B44A580302C825F6F509E5F3D8DF15C0A4264B4C744B4A2531CD78F9D08BE8C486A1229FFD8588058D3903E47F8CAC59323D72187D9A8E24F3F
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.......................................................................m.d............................................?.......................!..1"AQ.a.2q..B.#R.....br...3....S..C..................................+.......................!1..AQ..."aq2...............?.. .r. $.H. ....... ....H. ....H.$K.J.R...d...&DH. \|....G#.m........~.....).@.]..!-. 1#.LC....K.R.."j..~.eN.2....s.SHEn.;.(...Ze......Q....C}n..J-.Q."'.t.GVVjn.B.h.r.$N.'.........R...U'd...k..\|.%.k..'$.6K..44.ED..ip\.r$..!...........J...(..Qo.?. <..<...A....1 ....$.H.X..@......@....H. .....Hc....O.g..Qc.kY.H. ...1......@..$...@.R.T)LT7.!....D.P.t.c....:.$...&....c.. .#...................$......RHEe...:..<)$F...pSHe/..V(.:o..T.....S....MD,.....S..+5<..@.y..J....r.Q;ly...@&.v..H..(9$Z..30.r...Ov{vU.2.1.1.........Cc...iQ{).....K..Z......'.)X....*....)... ..@.....,(H..! b@...."@..$..g.C.....P.,......x!+%H.....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\83572bda21857cccf821.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2160x1300, components 3
Category:	dropped
Size (bytes):	30567
Entropy (8bit):	6.456265451149977
Encrypted:	false
SSDEEP:
MD5:	17ABA99CF1E55D638B347EF7B401BA38
SHA1:	53A07F340275EC3C079F431AE292995908340403
SHA-256:	87B97CD51A3E77E05050BBBDE970A541A8244289E8CCF34C2A893919705E2011
SHA-512:	41F5D5590342D821382101207DB024D649735D104A4F4800847D1664006B028EB6AD533BFA3F1778DD31B3CA2707D2F2DA036E61894AB58BA2E82400E6ADC5E6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C............................. .....!%0)!#-$..9-13666 (;?:4>0563...C...........3"."33333333333333333333333333333333333333333333333333........p......................................................................................................!@.....U.........`..J.%X...".............................................................................................................................@.........................................@............bP.................................P.R.bP........................................................................AV%!V.......................AV......................R......................................................(...................................E..........................................................B....................!@..............................X..............@........................... ......(.....................P.................................................................................%

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\88a9d8b720fa47faa0f7.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.872812209640985
Encrypted:	false
SSDEEP:
MD5:	44329D67478EE2DD417C2D34412AD8A3
SHA1:	DAF8365D3615116CAAEDA9318BAE53ECE4A7E404
SHA-256:	F5267FCC77802B42114D9E3BFD01539F702C79BEAE2E1A7BEDBA2989A85B1A67
SHA-512:	72F1FF81A7F7CCFD113A36215863295F5A7C1716FF135FCE7AB6412BBA86A40FC518551299373C97F40B90FABACB3FBB63EEDE0584D2B76BF524BB0118DF152C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......F......PLTE....l2.eV..B..O.QF.q3.h1..?..?..X..S .K.M@..V.[O..?..B..S.i].=.j[.y..V.f1.TH..@..`..V..R..@.[P..@.cX.;.h_..Y.h^.h^.;.fZ..R.C..=.WL.RE..>.XL..T.>..S.[Q.XM..`..L..I.K.;....\..U.TI..T.SE.=..>.<..S..B..T.<..Q.aU7.u..v.{e.pJ.=/.G9..W..\..O..S..>..B._U..e..b..Qc.a.SG.aW..O.;.h](.i..S.jZ..X..@.D7B.......9..7..=.>0..<..;.=..<-.;,.C6.B4.@2.?1..T..V..K..?.8(..R..>..8..6.:+..L.A4.7(.6(.1..O.9.6'.5&..N..A.H;..Z..M..D.3.2.0W..M............P.2.8)q....5.1e..:.M.MA./.4&.......j`..X._U..I..4{..b..L.............q...b+.U..O..L.8(i.........G..3.p.X..U..Rd.Q+.K..INwI.QEajCp`>.J2.........................U....O.z;.v.zq..p..U.S..S..R..Q..N.H.N@..>.P5.:...........................Q....th.sd.r..n>.i'.h.T..T..Tk.R..NB.M..B.C6.D0.-.>,...u...btRNS..........-....]O?+)...........x]\\O==%#..........PN?2#........~wuub`%............xxtliZIB?70.f......IDATh..eXSQ..1EQ.........f3Td..Ce.a.. .(.(.vwwwww....n.z............y..\2.$._.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\8d979c64297ebab9c9d5.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	3.95930433565537
Encrypted:	false
SSDEEP:
MD5:	E56420E0E02ADD2FD029776D2C2E62F0
SHA1:	0B65D471DD75B41539C06F4F3367FF8A96B394C6
SHA-256:	E32D406337908FD8BB7199BB69F1646DF87539D9FD30DA0074A03FAD224A8647
SHA-512:	3C36EC1E66FDD52A236C8F95E65B1EF3332981F005D7CC5927CD49C0D075DD847397E823D0C9FF4790A4DB764845F9467300805962BA94CECCE100BD6D1ADD9D
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M0.0379944 16L1.16266 11.8913C0.468661 10.6887 0.103994 9.32533 0.104661 7.92733C0.106661 3.55667 3.66333 0 8.03333 0C10.154 0.000666667 12.1447 0.826667 13.642 2.32533C15.1387 3.824 15.9627 5.816 15.962 7.93467C15.96 12.306 12.4033 15.8627 8.03333 15.8627C6.70666 15.862 5.39933 15.5293 4.24133 14.8973L0.0379944 16ZM4.43599 13.462C5.55333 14.1253 6.61999 14.5227 8.03066 14.5233C11.6627 14.5233 14.6213 11.5673 14.6233 7.93333C14.6247 4.292 11.68 1.34 8.03599 1.33867C4.40133 1.33867 1.44466 4.29467 1.44333 7.928C1.44266 9.41133 1.87733 10.522 2.60733 11.684L1.94133 14.116L4.43599 13.462ZM12.0273 9.81933C11.978 9.73667 11.846 9.68733 11.6473 9.588C11.4493 9.48867 10.4753 9.00933 10.2933 8.94333C10.112 8.87733 9.97999 8.844 9.84733 9.04267C9.71533 9.24067 9.33533 9.68733 9.21999 9.81933C9.10466 9.95133 8.98866 9.968 8.79066 9.86867C8.59266 9.76933 7.95399 9.56067 7.19733 8.88533C6.60866

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\9703c15b184d8259a452.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3062
Entropy (8bit):	4.139337668979157
Encrypted:	false
SSDEEP:
MD5:	1E62D3BD4A36D84E7B39A64620245607
SHA1:	D92C545BA644B535F5635544B288C2375BF5C0E9
SHA-256:	28532E280E22CD946C3EBC38599B7F6A0EA736265AD1AD1EB96B05DC6445C167
SHA-512:	7B14055699471FF36F767DB9F4622B0C557AB92F5CD266CB9119671F86038A275AFC4F661F0B14054FDB363960E2141B928F5182E04037F0647F230DD7641830
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<g clip-path="url(#clip0_2915_29058)">.<path d="M4.22894 13.7033L4.49052 13.8326C5.58045 14.479 6.80118 14.7806 8.02191 14.7806C11.8585 14.7806 14.9975 11.678 14.9975 7.88587C14.9975 6.07599 14.2563 4.3092 12.9484 3.01643C11.6405 1.72366 9.89659 0.991089 8.02191 0.991089C4.18534 0.991089 1.04633 4.09374 1.08993 7.92896C1.08993 9.22173 1.4823 10.4714 2.13626 11.5487L2.31065 11.8073L1.61309 14.3497L4.22894 13.7033Z" fill="#00E676"/>.<path d="M13.6896 2.32699C12.2073 0.818755 10.1582 0 8.06551 0C3.61858 0 0.0435974 3.57667 0.0871947 7.929C0.0871947 9.30795 0.479571 10.6438 1.13353 11.8504L0 15.9442L4.22894 14.8669C5.40607 15.5133 6.71399 15.8149 8.02191 15.8149C12.4252 15.8149 16.0002 12.2382 16.0002 7.8859C16.0002 5.77438 15.1719 3.79213 13.6896 2.32699ZM8.06551 14.479C6.88838 14.479 5.71125 14.1774 4.70852 13.5741L4.44693 13.4448L1.91828 14.0912L2.57224 11.6349L2.39785 11.3764C0.479571 8.3168

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\9b08ddabfa1c4baac551.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	9651
Entropy (8bit):	7.26082910341276
Encrypted:	false
SSDEEP:
MD5:	D6DAB11879DE8ECD7DD7B5816461BE47
SHA1:	0272AB9423ACA5C76151723C97A466F2F0026E61
SHA-256:	FE29F0E3DDCE0CA33ABB309321DEF5846A5C03F889558DBAC0DE9ADE2B226C64
SHA-512:	2FAC74DFC55578879511FDBE9934FEF0BEC2B413CB17BF9B819B74BA52965A94C0A695E0B4ABAE23C591B2519BBAAEE6AFA7EADA8AE87D3F67A8C11D102948BF
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............LExif..MM.*...................i.........&.................d...........m........ICC_PROFILE.......appl.0..mntrRGB XYZ ........... acspAPPL....APPL...........................-appl......).82!.g.O................................desc.......$cprt.......Pwtpt...d....rXYZ...x....gXYZ........bXYZ........rTRC.......(bTRC.......(gTRC.......(mluc............enUS.........s.R.G.Bmluc............enUS...4.....C.o.p.y.r.i.g.h.t. .A.p.p.l.e. .I.n.c...,. .2.0.2.3XYZ ...............-XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[...........bhttp://ns.adobe.com/xap/1.0/.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>....C................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\a298a0ac59f09aeb64eb.otf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	96916
Entropy (8bit):	6.3019351867770785
Encrypted:	false
SSDEEP:
MD5:	9CD8189186D13A06F790D5464049866A
SHA1:	1A0D394F4699EC688825E2BF44A91291107B850A
SHA-256:	29903DA4C67B90841921236A3F3E254ABC959205CE6FFA2BC904C2AC9AC52514
SHA-512:	CB895FEEBFD67DFE861557AA1BE3E70850AEBB7044F53F705E8B64CF067C3FEA5BACCBBBF09F322F7F048F2AE236F36B774E16B6D0F9D68480045CB91C638B29
Malicious:	false
Reputation:	unknown
Preview:	OTTO.......0CFF ..'....,...8GPOS-..e...d..a.GSUBs..H..w$...nOS/2m..........`cmap..w....P....head.;.y.......6hhea.c.F.......$hmtx*..........maxp.1P.........nameS"....D....post...N....... ..P..1...........\.._.<....................u...$...................4...t.9.t.:.t.9.t.9.t.9.t.9.t.9.t.9.t.9.t.:.t.:.t.9.t.9.t.9.t.9.t.9.t.:.t.9.t.9.t.9.t.9.t.:.t.9...............y...y...x...y...y...y.......>.......>...............................................................................y...x...y...y...y...y.......>.....9...3...9...9...9...9...9...9...9...9.K.9...9.1.9.....@...@.4...4........................./...................................x...x...x...x...x...x...y...x...x...x...x...x...x...y...y...y...y...x...y...x...x...x...x...x...y...x...........x.-...-...-...-.....Z...Z...Z...Z...Z...Z.......k...?...?...?...?...?.................................V...V...V...V...V...V.......................e.A.1.F.1.F.1.F.1.F.1.F.W.F..."..."..."..."..."..."..."..."..."...x...x...x...x...a...a...a...a...a

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\a62d89cd4deb8790f1a2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	7.927062877919605
Encrypted:	false
SSDEEP:
MD5:	2369051FB927B6A06241EC4B3B28A9A9
SHA1:	48245122E99C281CFEC5335CD100010EEB012235
SHA-256:	D8218341CE6DA314A72C14ACC13D342191FA12D0E26A8DBB661059699A4E296C
SHA-512:	6281F73FD0ECAFF0A609ED507BA853E06F0949E86D06B907D25B1D5510BD1F167CCDB6C31EE266A06E8FF5244136C3C5F1AB9DA5BD409155F4BB57BE1F500096
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....2 Q.T.....IDATx..{.\.}.?.so..43...!!4...!.A....@.c.........q......,..6Yo-&.S.._....l.qb.`.6xY......5.FH.@..y.t.=....n........kj...s.....w~.sa..X."...E,b..X."...E,..N..&#.;..4.F'.I.M.X..f.`..10!.R.%.2.s..Z...u]'........@.......`..2..2.h...j....f..,...2i.%3.....".......s..r...@...A.C...... .#...X..E..X..P.E.M@'..Q.w:..@.....v..0...WKx.I.....N,.N...^.".9o..x.p..V............g<..y.K.R.x..q\....s...d...M.!.\p-p..z.f%`....0xEp..t]....e.J.9.5.n........8.l.Z;at..o;~.8.........!.e.....I...../..1....8..e..#I....9bKX..I..`l.z'.y@.4C.....I.#.......F.h.~.^...1.H...?.\..&]...@..9.&..\\R.e....U(....r.p...#.D..X.,'.v....{..8..._..``...c....%..".F...7...\......].)D........AnX..5....Q..g15....0.bp/.!.a`.?Q...y.... .Z.OA.G.h..\|..[.........0..<M.al.$..(..y>..K...Lq.Q...'....T...h.a....7.%...p*k.....+.f(tA..\(q...T.......#..d$Q:....\>.k...(..q.......

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\a9a94f26040d1d617ba5.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2845
Entropy (8bit):	7.8753293542461495
Encrypted:	false
SSDEEP:
MD5:	EC6BBA7148D0791832ABBFBBAD565FE1
SHA1:	7D3532D6F92F118F10663E2A8ADA624297D1619E
SHA-256:	2F5AEAF5F3F980E0DC2A1D9F553726AF2E25A75B663A3824ADAFFDF561DC3A2C
SHA-512:	66CBB48E7372A460068F71382BCC40099B6E9702A75670CAB9071F206493155C760D1FC383C963CA262177072AFC1087C836CAE3B2A9F0DD402B021FA9DC9CCC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......F......PLTE...(...F.B.u3.w(...O..J..M..{..../...y..z..I..M.G.p@.\.~..G..z..].N..Q..z.....M.1..;.UD.2..<.a.L..W..J..x.2.\|.{.6.R.O..x..M.V.w*..4..Y.q.z.1....<.\2..2.._.q.S.7.\-..w.6.1......R.-.-...~.-..-.4..B..z.S.q.y....].p2..y.8.W4..1..L.d2.+......s.-.....].u....p........z..~.4...P..R..N..\|..T..U.......+...L./...R.1..2......y.......3...L..N..V....,...O.-..0..-..+..+........,..6.R...,...I.^.qb.p......T.\|F.L.R.....u.5.\.uU.p......?.B.5.]......3.=.A.N.P.W.zY.wY.q5.c6.W...,...z.1.-....}.;.=.D.D.v4.m.v.I.G.3.\|K.g@.Z.{.0...u..y.6.9.0.E.~3.rQ.mL.m4.h;.V......0.2.M.z;.wF.e4.....,..{./..s./.5.1.>.Q.u?.d....p..r.1.U.vL.sF.mE.^....z..o..z.8.9.A.?.n:.`....w.9..J.9.J.D.M..:.l .....7....+...h..[.8.)..+......b.%..%...]....'.........ZtRNS......7"t:(#.../.ucU......{tgPH......`PA...............taXV:..........jfNA............1&.E...{IDATh..UX.Q..gWAE.......[..UW......n..[.............3.....>....>.....3..G.q.g..'..u.?.R..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\b2a202d6774b9d9503f9.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 612x365, components 3
Category:	dropped
Size (bytes):	8821
Entropy (8bit):	7.23867843039562
Encrypted:	false
SSDEEP:
MD5:	0C4E5F2D70CA9D358C6CFE10FC40C4A2
SHA1:	B39DA42E65BADBD1465B69B4B0478DDA7C733D8E
SHA-256:	B41B3A86014E524F21EC0AC0E35C581AA97C57F52D6FAD97D36B85CC3442F74F
SHA-512:	40AEBEB927A3D573A7D12DA7F96213D4D839A2AC93E8C70C8D16F27548DC48D9ADBB203528166A24A758001A652E16C338E1DC064B7DB5FDB6C2D08E07B2E8BA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............LExif..MM.*...................i.........&.................d...........m........ICC_PROFILE.......appl.0..mntrRGB XYZ ............acspAPPL....APPL...........................-applnz..x...-.z.~.2.................................desc.......$cprt.......Pwtpt...d....rXYZ...x....gXYZ........bXYZ........rTRC.......(bTRC.......(gTRC.......(mluc............enUS.........s.R.G.Bmluc............enUS...4.....C.o.p.y.r.i.g.h.t. .A.p.p.l.e. .I.n.c...,. .2.0.2.3XYZ ...............-XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[...........bhttp://ns.adobe.com/xap/1.0/.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>....C................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\b774f4633fe09bd8bd1f.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.257843705236864
Encrypted:	false
SSDEEP:
MD5:	0E1D1BC98B9119C574A43A8DBEE8B461
SHA1:	AC53647DE1FA4AB48058391E80A62D34886D96ED
SHA-256:	15D16FFB9589C4B2B38DCD9A9913F5D0523408FE7F9B8340A58AE1B96C0B660D
SHA-512:	59037FA17E13C218E3EA6F252A63BF86F21295826B5BC5F0F005B2D5893E7B968D06D99B74410587106E5628C155F389C7A44BB7119EBB5E862D219782954723
Malicious:	false
Reputation:	unknown
Preview:	<svg width="26" height="26" viewBox="0 0 26 26" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M25.5 13.0156C25.5 16.7204 23.8831 20.0517 21.3334 22.3556C18.1306 23.9122 15.1455 22.8226 14.1505 22.1376C17.2911 21.4527 19.6853 17.6233 19.6853 13.0156C19.6853 8.40786 17.2911 4.57847 14.1505 3.89354C15.1455 3.20861 18.1306 2.11894 21.3334 3.67561C23.8831 5.97947 25.5 9.31072 25.5 13.0156Z" fill="#FF1D53"/>.<path d="M8.89553 5.94832C7.52737 7.56725 6.62563 9.99564 6.56344 12.7042V13.2958C6.62563 16.0044 7.52737 18.4328 8.89553 20.0517C10.699 22.3867 13.3421 23.8499 16.3271 23.8499C18.1617 23.8499 19.8719 23.2895 21.3334 22.3244C19.1256 24.3169 16.2028 25.5 13 25.5C12.8134 25.5 12.5958 25.5 12.4092 25.5C5.78607 25.2198 0.5 19.7403 0.5 13.0156C0.5 6.10398 6.09702 0.5 13 0.5C13.0311 0.5 13.0311 0.5 13.0622 0.5C16.2338 0.5 19.1256 1.7142 21.3334 3.67559C19.8719 2.71046 18.1617 2.15006 16.3271 2.15006C13.3421 2.15006 10.6679 3.64446 8.89553 5.94832Z" fill="#FF1D53"/>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\ba5622550ada9b5ff2cd.ttf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	TrueType Font data, 15 tables, 1st "GSUB", 8 names, Microsoft, language 0x409
Category:	dropped
Size (bytes):	77728
Entropy (8bit):	6.316050387907762
Encrypted:	false
SSDEEP:
MD5:	383A4213F47BA8F771E60B83C3EEE739
SHA1:	8DC695C55D1065C7BEF69A6529618513AB9BDD7B
SHA-256:	05DC51174936D420B8B66F8DB7C944C3C38EF4EEC110BDB7B85F62F83CF70D69
SHA-512:	21387FB3057C8D0C6635FAD0C6258DE67E6DC4B85AC1F17D84D93EC8699F9795AB428FE4A0AAB253AAF29428B8CF5A16C55370B317A3739C5A2DC272BE36CAEB
Malicious:	false
Reputation:	unknown
Preview:	...........pGSUBOfoc.......LOS/29\|.........`cmap)7..........cvt ...?........fpgm?...........gasp............glyf..}..;.....head.B10...H...6hhea.......$...$hmtxd.dW...,....loca.s..........maxp........... name).E\|... ....post..t7.......prep6.65...l.................j.h...q.......>.w...............`.....d.....p.........................B..BF_.<..........l.......2.%.....p.B...............d.........X...K...X...^.2.)............ ...............CF .......`.....`.i .............. .........................................P.P.J.J...........8...............8.....9.9.0.0.?.Y.9....._.3.....9.9.0.0.?.....>.........>...........K...RX....Y.......cp...B....".....B@.D.6.)........B@.E.>.0........B..@.............B........@.......D.$..QX.@.X..dD.&..QX......@.cTX...DYYYY@.E.9.,.....*..........D..d..DD........f.........^.H...........4...........&.........8...........$...........t.V.........".4.........4...h.t.t.p.:././.s.c.r.i.p.t.s...s.i.l...o.r.g./.O.F.L.S.p.a.c.e.M.o.n.o.-.R.e.g.u.l.a.r.V.e.r.s.i.o

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\cda076c0b79d73963c46.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.925711264694474
Encrypted:	false
SSDEEP:
MD5:	728E002BFCC21E13762B048D85197EDF
SHA1:	E17C0AF729DC1D958F75DA0CB5548078FBE18DDF
SHA-256:	522BFDC29D84245A5308E3065180050D3DA73F45336CEC0B4BB29B4236B74678
SHA-512:	AB7E292A3A91F461598E1290553FF95D67D0D768890A7AD097A35643189A8F5FCF18429E54411F39DB774B2222834A95629D005EF78A62A3A4DF7165509FCEB9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......F......PLTE.........................................................###..............jjjGGG...................................................yyy.......................ggg....................................................................................}........QP....==........................&..............................................................&...............W........O..,..<.....F......+..O..$........-..w.....6.....r.."......6....h..`..u..>....1.....+..........{..Z..0..E..?..S.....MLi..........@@E........FFU..Y..D..a..q.....s................1..\|..Ch.:..g.....4..".....S........j.0..Ex..[..W[.IS...g...../...y.g...p...`...\|.....o..mv.cmF..%..........O....................WY.EH.BG.../....q.VUpgYj.[b[.....a{....l..*......S.s[k^......AtRNS.......("..x!.];7..@.+.lZI....}L.......wuuU+......]:........aMY.....IDATh..Yh.Q..U.t.P.ObQAP.E...u..........S%.`...@6..Zc.TS..$V...ui.`7.TT......].....%m].\|.<........oG.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\d3098ef471597fe3c2ed.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.967688036238778
Encrypted:	false
SSDEEP:
MD5:	F1042C9866ABBC9FA7CFADB5A67233EF
SHA1:	D7234B0B61EEF1CCC3A8C68E37B78200E1B7E469
SHA-256:	49C0B1091C10E27DB9468F9F3873FD483B5FC864BD6EF1A33FEB3E173B3940BE
SHA-512:	964EEF34505D6D5228B069CFE9587275045CFDEA8130D4350A76193C53081097F1C71159690D26B46307E9D61E872D950A2DAFE89F61F993A823AF233F43C553
Malicious:	false
Reputation:	unknown
Preview:	<svg width="8" height="6" viewBox="0 0 8 6" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M3.04146 5.42392L0.770752 3.15321L1.41109 2.51287L3.04146 4.1387L6.48839 0.691769L7.12873 1.33665L3.04146 5.42392Z" fill="white"/>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\e393a69f0d2e035d1c42.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	4.407055299718969
Encrypted:	false
SSDEEP:
MD5:	D6F3C1BCFE30A8B8CE8DD335B65C2E32
SHA1:	85B01A93A54912C83B8D92CC8AD59CB15C55A457
SHA-256:	EE61AB043B762A96B1E64D116B7D182C615048F6406E3B0BE8C24E33E3DE126B
SHA-512:	567CD5232161C4669713E733AC5149408806C782E2F2F5DDF579CF1FFD1ABCD2D564FBCAE853CFCBC88CAA6035DAD2279BE30A493BAC44D1484C43FE20658A46
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">.<circle cx="8" cy="8" r="8" fill="#24A0DD"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M3.62155 7.91547C5.95371 6.89938 7.50885 6.22952 8.28697 5.90587C10.5087 4.9818 10.9703 4.82128 11.2712 4.81597C11.3374 4.81481 11.4853 4.83121 11.5812 4.90899C11.6621 4.97466 11.6844 5.06337 11.6951 5.12564C11.7057 5.1879 11.719 5.32974 11.7084 5.44057C11.588 6.70556 11.0671 9.77535 10.8021 11.1922C10.6899 11.7917 10.4691 11.9927 10.2553 12.0123C9.79077 12.0551 9.43799 11.7053 8.98803 11.4104C8.28392 10.9488 7.88615 10.6615 7.20269 10.2111C6.41284 9.69062 6.92487 9.40454 7.375 8.93701C7.49281 8.81466 9.53973 6.95282 9.57935 6.78392C9.58431 6.7628 9.5889 6.68406 9.54213 6.64248C9.49535 6.60091 9.42631 6.61513 9.37649 6.62643C9.30587 6.64246 8.18106 7.38592 6.00204 8.85682C5.68277 9.07606 5.39358 9.18288 5.13448 9.17728C4.84884 9.17111 4.29938 9.01577 3.89091 8.883C3.38991 8.72014 2.99172 8.63404 3.0

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\f6aa4959ac4e5f072210.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.842472331322764
Encrypted:	false
SSDEEP:
MD5:	6B80525D680CCC4238131B72298F286A
SHA1:	4187D78C784238FAD6C927ECCA78703E11D4A4E9
SHA-256:	A8F02AA548F977EF4E43D5AC6BD5580E172AEBCBCE6A1026DA8D665F297FB406
SHA-512:	F44E7D8F126A6C2C1468815CEA1DD81E49C56C1FAEC038E6EF749E6EFBAF341EB907EC7C8F9351AA68313A90E36AC46A920DA3536037DEC7038B831295E1A4B5
Malicious:	false
Reputation:	unknown
Preview:	<svg width="6" height="6" viewBox="0 0 6 6" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.60066 5.50077H3.40031V3.40655H5.50073V2.60519H3.40031V0.50029H2.60066V2.60519H0.500244V3.40655H2.60066V5.50077Z" fill="white"/>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\fcffb6ccd23559274e62.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.437341728071749
Encrypted:	false
SSDEEP:
MD5:	D01720054CB4D1C98F46D432AA9533F6
SHA1:	0BE3492BD2ED9E623A72CD70D62B4B114BDF4496
SHA-256:	FB11BE63CA43D10C12A809815889F505182951F5F3C007C21F818B6D3319DE31
SHA-512:	B2D09E6B5225218C2E8293EFE56CD4A22C18C71143F4D4EF1D561C0C44CDB646CDF80A97EE9AD6B1F7FF439A7BBD537548044BC2B304D5DB2CB762062AD37875
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="17" viewBox="0 0 16 17" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M16 8.64038C16 13.0587 12.4183 16.6404 7.99998 16.6404C3.58171 16.6404 -1.52588e-05 13.0587 -1.52588e-05 8.64038C-1.52588e-05 4.2221 3.58171 0.640381 7.99998 0.640381C12.4183 0.640381 16 4.2221 16 8.64038ZM9.66373 3.15283C9.66373 3.15283 9.61277 5.49726 12.28 5.75209V7.51891C10.6661 7.48493 9.72101 6.66948 9.72101 6.66948V10.5261C9.63572 12.2821 8.18716 13.662 6.4291 13.662C4.60888 13.662 3.1333 12.1864 3.1333 10.3662C3.1333 8.54599 4.60888 7.07041 6.4291 7.07041C6.61373 7.07041 6.79805 7.08593 6.98008 7.1168L6.96321 9.07156C6.79964 9.01208 6.62693 8.98165 6.45288 8.98165C5.62816 8.98165 4.95959 9.65021 4.95959 10.4749C4.95959 11.2997 5.62816 11.9682 6.45288 11.9682C7.24587 11.9682 7.90057 11.3484 7.94393 10.5566V3.15283H9.66373Z" fill="#00000080"/>.</svg>.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\icons\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3419
Entropy (8bit):	7.890114273010544
Encrypted:	false
SSDEEP:
MD5:	F72C3821A4C1214F5F0C48B22D6B25BC
SHA1:	7ABC1690E61323CB75DD4FDE06ACA821F640C646
SHA-256:	6FBB2CC9223564AA1C22FE06D162F9C925BD571F3FC74827CDEA64DF8D24430B
SHA-512:	74A46B751A4FAAF59F4C8B853AF8624DEB68EAFC000A61699272D473F410B6DD882F92E3CB7E3BB250C4F7A2202A23C08638F0903BC9FDF4EB7113AA0CC663E2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............g-....pHYs..,K..,K..=......sRGB.........gAMA......a.....IDATx..]r.G..3{fx]........O..... ...........H.@..<.%b.h.....6.....6B.oH]UY.....H.....WUe.(..(..(..(..(..(..(..(..(J_@P...i.g0..r.....?r ... .W.C,....3K@..U..B..KP.`..d...9l.....Yq..\ .EHF./.F..rp...[.u...[..oZ.x..X....-X`....b0.............%......W.0.z-@..U. ...Ew5...8..U,...R...{._....}....3z%....2.?...{!....2..D...........!....e...W..Uk...m...:};v5...n.c.N..R...2...b#.......0./oZ^qe...1..8...sj...c.u...N..X.[c.rH.^.........k.....Y.#...#......:.;#@.bQq..%.T0..Xt..E.-.;.CF._...2v..vB...[...B...4x.......:SM.X{v.........f]....n....L.w..ys...p...a......zA.i..YxX.v..ML7k...,.k..1.$;..lf.X...y...........H4..-9.z}.Y..[............q.X...&)@.....6[ ...d<o..R.g.%d..\|._.e....&'.t.=..n...&.4.)..$Dm-N..g.^.k.XoU..(...b?[..'D2.....{&..r..x}....$.:;.A..,a..LB\|..B.0....e..dIF...LD\|K(Y\|..\.D....E.....p...d..3..+...&..{..l..2k....%4..`.-....][H....3......./2......V'b..p..O.@....

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\icons\logo.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	4.462809342862785
Encrypted:	false
SSDEEP:
MD5:	B0170BC9386860490CA7AE36DBABFB38
SHA1:	CA9A37816C6B9D7478840A33C2E1767E397286C1
SHA-256:	A738CC5FF87927448101B73BB23733DA18AD76FC06DF67B52C27C4663D494066
SHA-512:	1C6A6C9A69C65A62035CB833347040E614D3C687F649AEC7B97152F3FAD3197F4E3DFFD807F846059E3EBF9F7B1B4CB0DB1DD8346E9B4548AA47F3E50895A2AB
Malicious:	false
Reputation:	unknown
Preview:	<svg width="40" height="40" viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">.<circle cx="20" cy="20" r="20" fill="white"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M11.7612 19.1214C11.8408 15.6544 12.995 12.5461 14.7463 10.4738C17.0149 7.52491 20.4378 5.61208 24.2587 5.61208C26.607 5.61208 28.796 6.32939 30.6667 7.56476C27.8408 5.05417 24.1393 3.5 20.0796 3.5H20C11.1642 3.5 4 10.6731 4 19.5199C4 28.1276 10.7662 35.1413 19.2438 35.5H20C24.0532 35.5 27.7563 34.0197 30.5706 31.5212C30.6026 31.506 30.6346 31.4907 30.6667 31.4751C33.9304 28.5262 36 24.2622 36 19.5199C36 14.7777 33.9304 10.5137 30.6667 7.56477C26.5672 5.57225 22.7463 6.96702 21.4727 7.84373C25.4926 8.72044 28.5572 13.6221 28.5572 19.5199C28.5572 25.4178 25.4926 30.3194 21.4727 31.1962C22.7224 32.0564 26.4249 33.4156 30.4366 31.5836C28.6175 32.7278 26.5113 33.3879 24.2587 33.3879C20.4378 33.3879 17.0547 31.5149 14.7463 28.5262C12.995 26.4539 11.8408 23.3456 11.7612 19.8786V19.1214Z" fill="#FF1B2D"/>

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	HTML document, ASCII text, with very long lines (311), with no line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.790797622298017
Encrypted:	false
SSDEEP:
MD5:	38782AD73C9FDEB4C86E92DFF70578D2
SHA1:	316BE51B1345ED1786F8D96BA8881B41527CD581
SHA-256:	5EBB0E0A5168FA52C4EDE3D3CD0C25AFC5DCBE7BAD47B9BC3BAA5B470B249A30
SHA-512:	C5004CC3716A3AD95256621AA97565E145C6FC4E25C91C2694954C3BBC2D02A3E2AF7BBAEB87A9E377C9584D9CBE09483FFAEB3C3147061BA88D26222D76E92C
Malicious:	false
Reputation:	unknown
Preview:	<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><title>Opera One</title><link rel="icon" type="image/png"/><script defer="defer" src="index.js"></script></head><body style="background-color:#000"><div id="root"></div></body></html>

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (65473)
Category:	dropped
Size (bytes):	417856
Entropy (8bit):	5.755598980837726
Encrypted:	false
SSDEEP:
MD5:	4F71614A0DA45BF41CD4D233E2456F64
SHA1:	B6A69114B9A880EDF82406846264B3A18E1AF334
SHA-256:	3C2B1D39A7DD689E7FFDDBA4DCB884D3EE06B2BBB49982380B974463CD3B2C22
SHA-512:	DB03F8295944ED89253B410B86ED41C15FD86D47A4758E944252B9B9B2639B79E1A802929B39EBE9F995E8E29B1513C6C07E95A9BFFF31CD60E4B4907B50AB3F
Malicious:	false
Reputation:	unknown
Preview:	/! For license information please see index.js.LICENSE.txt /.(()=>{var e={4963:(e,t,n)=>{"use strict";n.d(t,{Z:()=>l});var r=n(8081),a=n.n(r),o=n(3645),i=n.n(o)()(a());i.push([e.id,'/* Intro */\n\n@keyframes appear {\n from {\n opacity: 0;\n }\n to {\n opacity: 1;\n }\n}\n\n@keyframes disappear {\n from {\n opacity: 1;\n }\n to {\n opacity: 0;\n }\n}\n\n@keyframes zoom-out {\n from {\n transform: scale(1.5);\n }\n to {\n transform: scale(1);\n }\n}\n\nmain.welcome .masthead {\n animation: appear 0.5s ease-out forwards;\n}\n\n.contents {\n clip-path: var(--from-clip-path);\n}\n\n@keyframes enter-portal {\n from {\n clip-path: var(--from-clip-path);\n }\n 99% {\n clip-path: var(--to-clip-path);\n }\n to {\n clip-path: none;\n }\n}\n\nmain.setup .masthead,\nmain.setup .get-started {\n opacity: 1;\n animation: disappear 0.5s cubic-bezier(0.33, 1, 0.68, 1) forwards;\n}\n\nmain.setup .contents {\n clip-path: var(--from-clip-path);\n animat

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.js.LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	871
Entropy (8bit):	4.690083762297829
Encrypted:	false
SSDEEP:
MD5:	DF32743ED051AA784D347B8223C278A1
SHA1:	6614F0CE1E430B960E0A4ED5A0DAB97F1A6C4DBA
SHA-256:	1D438FDDC659F353FB3DB7AB82216A55E71F6AA3AFA2539849E68192037EA627
SHA-512:	C1297C68DC205CF24EEA15AF69FAF14345815E67FC488CC187BD270984A921530F541B4BDD29831305A43D6704BABBA17534E3F7B2648F2B7633F48BA8228F08
Malicious:	false
Reputation:	unknown
Preview:	/! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE /../*. @license React. * react-dom.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /../. @license React. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /../. @license React. * scheduler.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	5.330498035741759
Encrypted:	false
SSDEEP:
MD5:	54D8CF35DED860E8E45099C063726924
SHA1:	D2EC354E779F1FA04D563517763917FC9B327E13
SHA-256:	933C76166C03A37D9C3810D1906D26C4E3BD7C693A2FC9E63B3B5C6F7DA12008
SHA-512:	8D55E5FAA8F16FDC6C196618B48A8F4E9B2B997823C3953EF5AF8A56EF8BF96B897A1FB012BB473ECEAAC0E387D671562A4BE581155D9F6CE05A95D5E9F86A61
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "opera-intro",. "description": "Opera Intro",. "version": "2.0.6",. "author": "Opera Norway AS",. "developer": {. "name": "Opera Norway AS",. "url": "https://opera.com". },. "homepage_url": "https://opera.com",. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+xjWveBjNqYOzYGpJ1CWHv94bna667U1AF9rsbX9k5JhpjNCcCYYEtsMP8h1gCPzFanclndbrZHUgmgX3FTw7nRBTLEwMfGwWjjvUYWBPdfd8jDh6MPBHEEMpHwWo01/IE4ec/WAx1WF660r8WVqfEqzY9zFYhjWWk+R313NbvAxXGnlScgwye+1PUWZil4O+VdP7yP62J2I+xHzI1VavXg9tyVXRCURZH7F7/u2UvnLzZw0jgYueQBFspb1MzxYYS3LGocmI8KpK3uRWZE6aEGyO0OwiG74sJtbHz9WJCTdBzpkFBSy2sy/LJoHyfUOznIaM0P5ZdlDVo/TZIrijwIDAQAB",. "manifest_version": 3,. "permissions": [. "browserSidebarPrivate",. "adblockerPrivate",. "addonsPrivate",. "contentFilterPrivate",. "defaultBrowserPrivate",. "importPrivate",. "introductionPrivate",. "operaIdentityPrivate",. "palette",. "settingsPrivate",. "statsPrivate",. "storage",. "tabs",. "wallpapersPrivate".

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\partner_speeddials.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (347)
Category:	dropped
Size (bytes):	659032
Entropy (8bit):	4.95953368134472
Encrypted:	false
SSDEEP:
MD5:	478A2A0C5A05815D9A67B0A0610D2438
SHA1:	B01F61D38C38B27BB831F7DAFCC247BA162D88FA
SHA-256:	06E7802401A1CB4A271ABEC2B268A5CCB2DB5FF6D1A1D5903231DF32D1F8345E
SHA-512:	9BDBC046DE921B1ED5C46B80F1C955B9C920481B4779F58A8FCB27DE53138DC9A8535B9E18DBA75446E0F684BE2E583A47100955920D48AC4A827DBF2B375C69
Malicious:	false
Reputation:	unknown
Preview:	// mekHbgsDrCMGZUOCsQSNLqW7BczeXwXYwOSGbie4pjT8PzyImwuV0aXWQNWhQUhlSDqSV2zhiFgRM7Zsem/4PfteeHSgir+VjYdKlCok4QmYQYelTkqQIoCluG8upmTzOJxd2JkzDzayP8GOVBvFhwX/vTokjbLWAEnhwMo2pVHtG9OcIJBcz19TRwteBBlDVHDhN40+QcHQZ5tlfa432fEL3FO0TKMgT1DLxCqWiEDAAxszlcQodYiPZaXeKvV0oX3DTi0ScRWPXn9VdvoCHjWsciszgq6KmN/Vj9EO05orbgu6WuLGJPfhFchMJiCuEkKXB3fyfr5SirqeIRkbaA==.{. "*": {. "bookmarkbar": [. {. "favicon_url": "https://sd-images.operacdn.com/api/v1/images/e1db847af0a87787f307ee6942ed7d643488d419.png",. "name": "Booking.com",. "partner_id": "booking_com_bb",. "ping_url": "https://speeddials.opera.com/api/v2/ping/booking_com_bb",. "position": 1,. "real_url": "https://www.booking.com/?aid=1546879",. "revision": "20180329",. "url": "https://www.booking.com". },. {. "favicon_url": "https://sd-images.operacdn.com/api/v1/images/19ea7f40b1ae613c104a34d808d66a2d5d42d752.png",. "name": "Amazon",. "partner_id": "amazon_b

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\purchases-schemas.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	134754
Entropy (8bit):	3.912152746351969
Encrypted:	false
SSDEEP:
MD5:	50B7EEA5800999F39B8C3D93AEBA6545
SHA1:	781B66FE6B6548CF39522E3661BD6A9ADE39456F
SHA-256:	239158E719514AC1205D1844643E24440D0833C0C7C64060AAFB6FE2378C63D4
SHA-512:	192CEA97EAE5C5148D4D5C1AC818CCB9C75F12119446BD772A9BDFC07975739A66558B580BA5B29FF47275B60DE099C954E82B91CC34DB683C63ECB42C671052
Malicious:	false
Reputation:	unknown
Preview:	// nT/e0fNNq9R2n1GNHggMQYT4GDR4XJHAsGYhnPcLb+eG0AT87u+hknCDu03zU4w1JTGc7yrHkkK17b8TIT5tk9x9KU8mgfFBqUYb39RlMQg/CzgtdoRj6qzpRGbApfZCt6JpUvp+64u5NUh1lWMayZmuKg+teFql4t1J77VVkoU5OgZxe5PGy4Hz6S+MzoiqHndxSpFPSEuIdFjOEhczMm6YPhqvMqg8IIoNGkqMcqVRM+gE/hIHPcmtvq/I8ddyvmKdB24FrzZDbUOCA704/zJrA90VqpJZYXjdYqYEH4Waa3TqqxD5HB5OJ/ps6pJS83kIVpH5qRL0pZbCnhl26Q==.[. {. "partnerKey": "etsy.com",. "onfetch": "set-basket",. "urlMask": "^https:\\/\\/www\\.etsy\\.com\\/[a-z]{1,4}\\/cart\\/[0-9]+\\/review.*",. "recordSchema": {. "partner": [. {. "type": "value",. "value": "etsy.com". }. ],. "locationUrl": [. {. "type": "eval",. "value": "location.href". }. ],. "cartTotalValue": [. {. "type": "querySelector",. "value": ".order-total-cost .currency-value",. "property": "textContent",. "postprocess": "pricevalue". }. ],. "cartTotalValueCurrency": [.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\siteprefs.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	17569
Entropy (8bit):	4.094635698394074
Encrypted:	false
SSDEEP:
MD5:	85B719D0378616EA6C6417242DD7160C
SHA1:	D6A73935234523E9FB3EA6303E1E00F54B8BFFFA
SHA-256:	42484D0083296F16072DC22785148C24CC4A38470918539C5EFF6775789EF22D
SHA-512:	4695C04DEAB0F4710B8ABF55D44955416C439D4B8E82456717E6A4B69422D362CAE39C90C8EBAA86CF604E01B9208CF1BE6DF1665C182A0CB90F1444FCA8A954
Malicious:	false
Reputation:	unknown
Preview:	// yRoUFcD85urOral+ZlMUOYUWFxXeoGsN3PaAJND2wG4h6M5gQigQC+jTl/lo7H2nITevm5LQXLvTFzdqzfGmNSZlFS4H0v6vRIZaRaCBOCIUveMUlv08bE+UKJEWf3pNYobwA7xVuSssTT+Uk1Xg6fsUg5gHXBmJNnDd1yWiCA/GRnrLqXJxyu+YItr7kx2vAzHPuV37qbWsyTutb+bam3OsmJoCJwBfRaE8B2E0Jt/kLSnm52L0Ry/r5lDg2gtrSTToRKac5SuXteDgyYexToryYWe+43Sy5KjBdHtf3bS8aCkI6JszsWVjni7Fs5o2JaDVpvT5oz9hxpTiOL/wQQ==.{. "@version": "2.0",. "timestamp": "202402281455",. "firefox_ua": [. "youtubekids.com",. "techtitute.com". ],. "chrome_ua": [. "lime-technologies.com",. "lime-crm.com",. "saxotrader.com",. "saxoinvestor.com",. "saxotrader.au",. "saxoinvestor.au",. "saxotrader.cn",. "saxoinvestor.cn",. "saxotrader.cz",. "saxoinvestor.cz",. "saxotrader.dk",. "saxoinvestor.dk",. "saxotrader.fr",. "saxoinvestor.fr",. "saxotrader.hk",. "saxoinvestor.hk",. "saxotrader.it",. "saxoinvestor.it",. "saxotrader.a

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\specific_keywords.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5243)
Category:	dropped
Size (bytes):	46132
Entropy (8bit):	5.476429533205484
Encrypted:	false
SSDEEP:
MD5:	34CEDACC1C62313116216EA57A16683A
SHA1:	D627058E97DCAD8F0A8737DFE2FFA195D868E5E7
SHA-256:	F04CD2A8EC2686420E9A89C454C379C76B610BE2AD62E2F2F1A9641A9D9ED286
SHA-512:	FA9947AEFFBB687B4D0D632323BAD68E5E93572398FBDD5A7665E1530F3327BFA4307C4AC8AC035E423A667C322FBBF98CCA4995AB9B8EFEBBED99761D753D18
Malicious:	false
Reputation:	unknown
Preview:	// DJk2k3pkp9cay3NljwD03+GA6BPihyqZAPyGTt49ivHi9iZ6PCltyC1kZ47WPQmo7WuEhxdSZaZN7uE+VJdTrnfzgcTe4Nz9SU60AUeW3rV7dLOmyQuCm6HExT8VxWHux47vXFsehnQYT8kx56qh1FwN96iY0bsNMLnuo4JA2Hdobl43moGSrTi/eIGdTpA6pq1oHaQgMA8tu6ztgOuMXrE85Qkl8WGanStebuBLdRfGlBkLVG8IqS2YqFyTS5E7NjDLkqOYjx/rM00TqYbFaiVdCkUl5Iu/HyF3eE0cF2dpFLScIb29KBifsTSuiJpxQNvJrGe51SoLHg5oZFQFpw==.{. "version": 1,. "should_reset_discarded_ids": false,. "de":. {. "keyword_groups": [. {. "ids": [. "booking",. "expedia_hotels",. "tripadvisor",. "hotels_com",. "tui". ],. "keywords": [. "achensee",. ".gypten",. "albuquerque",. "alf",. "allg.u",. "amalfik.ste",. "andalusien",. "antalya",. "antwerpen",. "argentinien",. "australien",. "azoren",. "bad kreuzn

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\standard_themes\default_dark_theme.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	356134
Entropy (8bit):	7.996233740974253
Encrypted:	true
SSDEEP:
MD5:	15109A4EFD591E06D36B85AEF68549AA
SHA1:	038247E7CAABA5D75AF451F142C95E028560C1DA
SHA-256:	3503008F4C20B5849B376AD62DF8FBD394F5CD3AD8E92C8EA83219A1F149D99B
SHA-512:	3FF868D0BD9FA89EF07B1C70DA9EA020A455EC23B7C3A8307A16D9C1DF12BC321FCEF66D73BEB818FC2F269C2C3BE77CA03747BF8025D826B16F77311AE1CAF5
Malicious:	false
Reputation:	unknown
Preview:	PK.........\.Vo.7B.m...t......opera-one-dark.jpg..eXS..?>F8& ...8b.Q.hPd8&.!5..f..RJ...F.t3.$....J..............>.:......}.8.........................(..=....@. .K ..L...Pv.+...z............_....r.....\.......z...%...............l :.K..4l. ..-.....>..HKsQ...h..Z:z.K...k4.Z..}...2...`....YiY/^.......x..y....D.g..8,}.\|..c.>B6..5.......7.?...... PH.I.H..]].!.e.=.K..m.m6Q..7Z..;...~.K.......Z..Y.Y.....'.9.....c....a..q..3 VX.gY........^..],Q`u........}~x.9.BB.......J.zf<s=d{.0Q..!..i+..efc.....\~.....1.&R.^....Ej.8`HF...d....`..r..Gr.a.1...t.i....nKnq..G....{.L6..e.......T<....Z...Y..a.."n. .oL...1....C.Q.op_K_+h.N.0.Yq..W.......o....7.\...rh.?{.D./...N.O..3...v9.\..O..F..........j..\...h../>...J..... T..>'.....M$.......5o...q..+N...0n,F.B...n..t..$Y..`...3.6L.T..+.$..F..P~Q...S..[..IU.6....5.HP$.[.D.....{..J[.A...C....p,'.N?...(Xh0$.`..6..=dO.#...F.9....>=.kn.0...].n.....a..bE..q.1...B/+O....u..........u...w..t*k=..V.).v.L...C....tTL.

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\standard_themes\default_theme.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	193143
Entropy (8bit):	7.99401769270444
Encrypted:	true
SSDEEP:
MD5:	07C951F3C75F573227BEF1F8CBD0B32F
SHA1:	DE6DD04C20763164964AA9DA2241373570278227
SHA-256:	EBF8773E0E2FEEB39320E396402A97A678A72EA1626C8C80EE55611822635512
SHA-512:	3BE4A1195868FAB375CAF1CB536E48EFD3E415AA1D778AC83D87213B36138BD586BDAE6014D09E95A98DA7F78C8EEBF5E6F34343B98D0F4ADC2D6BBBF9ED356F
Malicious:	false
Reputation:	unknown
Preview:	PK.........].VB.V.....3.......opera-one.jpg..y@S../.....h....'...S.0 `.0.C...N0...y...85p..bA..8..0..d..JE.......@..cm..j..]...~.}....I ..Y.Y..7.l..._/ ......` ..n._....c..U...!...+W.H..t...k.I......L...M.ML7..F...m..j..J..'..ut.+.....Q).......-h5..R......X...6d.A+0..._......YI....._...._O ....KZA./.[...3..ZkjA..C...1.K.0bq\.0......?F.._....?.\j..". .....Y....."...'..n....u.qJ..$O.Ov9..S.I. ............Y..A.....#/...Q.....!.}k..b.'..G.p.$..s...Q...cT.HG...]8"......c..r.f.x..B.Td.S..kE)1m60..tJ~a.D...z. ...."C...p../`<....-..CXF..U!.V]`&.X.7:T.....1...I.... ....T,..........<.QJ.,R.h<F............m_....-......{.0n....'A<.-....0..0V.Q.....Nx.Q..aX...P.1.T."_..2._...%.Ct.m.K..`)...O-...4..f1..+LI/..J$.....y.....kg...$.d.ua....<.......L..p.$.....=z...b.KO..b(.O/.X..q...:..ED.,1D. %.(^.lF!.`...+....x.R...".M5...R.4..+.`.b.H..n.I.....C..u...H],[.......!z.x%...r.k[.....h..[(.......C.p0..v`!"..@.pd....{..a.FX..p.xo...F^!....NU....<..K!.w.....A.....l.#A](

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\video_conference_popout.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.216969853800906
Encrypted:	false
SSDEEP:
MD5:	19BEF2D091C16C4EE3F7B9D63A48EEC2
SHA1:	E148797C1874D3DF0F9AADA3C217BAD86E07B49B
SHA-256:	A31AEB78E781F22CEE4220D24B8D62AE139902E37804BC836EADD90264AEDBB9
SHA-512:	A245BB9E697897239B449BBB35197E8033285BB7C9F101CFD8AE43FB434149102F28534C2C58D561341B72DDE90632FDAF5D73E5DECE5D453C221D67987302D0
Malicious:	false
Reputation:	unknown
Preview:	{."version": 7,."list": [. {. "urlMask": "https://meet.google.com/.",. "width": 700,. "height": 450,. "blocked": [. "https://meet.google.com/",. "https://meet.google.com/about.". ]. },. {. "urlMask": "https://whereby.com/.",. "width": 700,. "height": 450,. "blocked": [. "https://whereby.com/",. "https://whereby.com/blog.",. "https://whereby.com/information.",. "https://whereby.com/sitemap.",. "https://whereby.com/user.". ]. },. {. "urlMask": "https://teams.live.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://teams.microsoft.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://meet.jit.si/.",. "width": 700,. "height": 450,. "blocked": [. "https://meet.jit.si/",

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\root_files_list

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	730
Entropy (8bit):	4.668284777150785
Encrypted:	false
SSDEEP:
MD5:	3B491170F7EEA56B574A24876BF7451D
SHA1:	C5CC1BE375BB413978752F0210CD0A76A415FAEB
SHA-256:	D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
SHA-512:	178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
Malicious:	false
Reputation:	unknown
Preview:	Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\root_files_list.1713386541.old (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	730
Entropy (8bit):	4.668284777150785
Encrypted:	false
SSDEEP:
MD5:	3B491170F7EEA56B574A24876BF7451D
SHA1:	C5CC1BE375BB413978752F0210CD0A76A415FAEB
SHA-256:	D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
SHA-512:	178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
Malicious:	false
Reputation:	unknown
Preview:	Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	307402
Entropy (8bit):	4.293874183264078
Encrypted:	false
SSDEEP:
MD5:	FC35075FEC8883C780780DC97CC88D96
SHA1:	21BB313D4DFF8EEEC05ADC373F211E1CC46F2E1A
SHA-256:	BB34DA3D0B277FE1613B60418F7AD9E4CAC00D9CAC6DE3B64C4C76E350D1B4D9
SHA-512:	1429B2C25C2783465FD2EA74D693E0E13342DDD3B2D1F5D06FB866599496A111358D713A0B402B9F11FD2A8D56053B316A9CE14D3395BD2C65FAAA30AB7433F1
Malicious:	false
Reputation:	unknown
Preview:	.........>..l..R12.3.219.16......................................................L......*.......,...8L..a........a........a2.......ar.......a2.......a<..........R..............r.........2..............R..............r........(Jb...+L.....@..F^.=..A.`.....(Jb.../P.....@..F^..`.....H...IDa........Db............D`.....9.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	680949
Entropy (8bit):	5.1750488711145906
Encrypted:	false
SSDEEP:
MD5:	55E5E658022C01E3922558A80815F191
SHA1:	536509A942360FD18BDDE5936A0A587E786070D1
SHA-256:	0A974AA26B5C9A7D258D81DDC6F3BFD1AAEFF43725C72ABBF3B7F4CE6E55485B
SHA-512:	F0CCBDCB7DB7ACCDA13544AFF7E0A927E03F2B02675459C8276EB5B5B3407782D5F730E0E8D27BD82B1CDF2D3114B8EE81C077C432799D7310A298CFC12E82CA
Malicious:	false
Reputation:	unknown
Preview:	...........?.Qv12.3.219.16.....................................................`...%.......m...M.......,.......a........a........a........ar.......a2.......a<..........R..............r.........2..............R..............r........(Jb...+L.....@..F^.=..A.`.....(Jb.../P.....@..F^..`.....H...IDa........Db............D`.....9.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5147040
Entropy (8bit):	6.3632985372456075
Encrypted:	false
SSDEEP:
MD5:	9FF4BF2774BAAD6466C1228D163D0473
SHA1:	9ECDF49C2EC6460DE6092A396CC844582C251097
SHA-256:	CC1055A3B642E44BC83C95A9D5AA6133B459A5653CDAEFD454D43881CABE5A6B
SHA-512:	3D9816B2E5E4D970244A28D475E152E1BD641ADC3EF6395ED4BF46F699CD4AB1B9219D62A635FA7850A05F1B80B504E00FEA2A3A7F12C5D92F7F1AA8372386A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." .....`>...........7.......................................O.....3.O...`A..........................................J.....h0J.P....`O.......M......`N..)...pO..f....I.8.....................I.(...@q>.@............5J.P............................text...._>......`>................. ..`.rdata.......p>......d>.............@..@.data.........K.......J.............@....pdata........M..0....L.............@..@.gxfg....-....O.......M.............@..@.retplne.....0O.......M..................tls....Y....@O.......M.............@..._RDATA..\....PO.......M.............@..@.rsrc........`O.......M.............@..@.reloc...f...pO..h....M.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	956832
Entropy (8bit):	6.615631133137103
Encrypted:	false
SSDEEP:
MD5:	AF8AAEAA917D87B1A1EA555608131774
SHA1:	4300612CA5DDDDAC9A1C8BC3718D202C036DB216
SHA-256:	4C7B7E914F5C2522D49DA5668659C06B710D9D0DFD5000BC9DEE86A59EBE0C61
SHA-512:	47C2F0A11E97D520D04106DF81A7A373FE0FC19FA50CE67CEED7E934528F319AD0DFE5F8CD38BD5E3F6DB99C84DE407EC65A87AD99B2C7D10DBBED4DF7DDBD84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ................@3...............................................W....`A............................................<!..$...P...............Lq...p...)......0...L...8...................0...(...@...@...........x................................text............................... ..`.rdata..............................@..@.data...pL......."..................@....pdata..Lq.......r..................@..@.gxfg...P).......*..................@..@.retplne.............X...................tls.................Z..............@..._RDATA..\............\..............@..@.rsrc................^..............@..@.reloc..0............b..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win10_share_handler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1022368
Entropy (8bit):	6.4387009717967985
Encrypted:	false
SSDEEP:
MD5:	7044B2058359FA29DE11CE51B9E72097
SHA1:	A42C0793296D981D01D0EE21BD2EAC445E50B688
SHA-256:	12A3CE2A7B766D312F47721653A3975DFB8037315BA79F9F03F76E48ABB4DAE5
SHA-512:	70E281ACBFC9013757C83E7F03B5D03252F2A702123FA93AEC8E1ACB373CD74553ABCF39E89562E4157B903DD42C96FC915C5B9FBC6E8679DCD73F0CA0B9F78B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." .....F...$......@........................................p......b.....`A.........................................F......dG..x....@.......p..\m...p...)...P.......:..8....................9..(....r..@...........(L..H............................text....D.......F.................. ..`.rdata......`.......J..............@..@.data...tu..........................@....pdata..\m...p...n..................@..@.gxfg....(.......(...,..............@..@.retplne.............T...................tls....y.... .......V..............@..._RDATA..\....0.......X..............@..@.rsrc........@.......Z..............@..@.reloc.......P.......\..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win8_importing.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	611744
Entropy (8bit):	6.228107866122788
Encrypted:	false
SSDEEP:
MD5:	898B07476285458E0D253AF6C8118D39
SHA1:	7BDBE480CC67EBFEBEB8E407F651CF4F19D79314
SHA-256:	9459F461175C4599938B174C19E898A1D646290D0AFC66B5B439846AB040C40E
SHA-512:	118C3006EB33102014078BC507735B46C25980248160D133BB0CA459D7B51D24E9787F5198A931F72D15A7983EED4E6E52B79760829298B995A703CD683AD274
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ................................................................%.....`A.........................................U.......V..d............@...F...,...)..........LN..8...................0M..(....1..@............Z...............................text...f........................... ..`.rdata......0......................@..@.data...XM..........................@....pdata...F...@...H..................@..@.gxfg....$.......&..................@..@.retplne.................................tls....1...........................@..._RDATA..\...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\362f917e-8f55-4e7e-8d21-b6edc8ce12e6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	5.079487440572729
Encrypted:	false
SSDEEP:
MD5:	17B0ADCE80E7E3D81927BB44C4248367
SHA1:	766CB9174C52D8D0A164ACDC1305D64CDC7BA4D2
SHA-256:	4F30E6178971793E49B70E639144FC66C70043C67FA32C372CD4DD735EAA88FB
SHA-512:	E62A2995C149CE879BBE24A6E0BB2A7697A054D3518E4ED98573DD48EA07EB620AD4595B5C2D4580EB2487C9E22A6E66BC1481EE9A986453E254344AE96E8374
Malicious:	false
Reputation:	unknown
Preview:	{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,03b8357e5a08,06fbbd0b7bf7,1c4dddb65bac,1d24dceb937a,26000b66a01c,26f7e2d59ecf,278deecb29a1,3389f6c15eb9,3fc0872a857b,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,5a28d66c82cd,5aceda74693f,603cade21cf7,654296fe9d6c,6713f3df0bed,6a00b9093bf4,7e93fef4a11d,804beb213cf7,818c3ef12d0b,970fe421a344,9a48123ec9e3,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c25d6d8d2719:disabled,c57119eb4723,c6dc56485f2e,c73cad8a4668,c9a44eaecc11,cb479f6a3f5d,cbc43aa3cfb6,d144067b33ec,d4260daf5dd9,e29359b2d759,e2c9ffba8439,f3834d6657d8,f824dfec6894,fc82980101cd,fda8dc4bd759","import_browser_data":false,"installer-experiments":[],"in

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-100.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	7.4499555099946
Encrypted:	false
SSDEEP:
MD5:	F4D70BC86E8544D7758742C2EBA89D47
SHA1:	5DF4635794AB25E2F88BCF8EC39C19A09383A029
SHA-256:	56BCD46DCFAE3147A8B8B3D00EE5041DAD4655E83A7E829BF637377C96538643
SHA-512:	D20CBD543BF97890D64C07F9E99188604F4DC5DEF904AD74229A3B1D9D9A06FFF93AF711C99A178799E9DE472D930AA52A0C154F0D2953ABE5FFC3CFD1708AB9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................PLTE.................#.."..)..)..(..(......)....)..+....+..)....+..+......+..+..+..+....+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,._.....5tRNS.........#'/5:=@DKPTX]flrv}.........................g.R....IDATx.....:..`M.....jz?.4..?.){O.Y.......u.8H.%.4M.4M.4M.4M...8....wH.. .^..m..M.Wc.H9/]........)...ft.{n.I..u..:.fg...3.<..^q.e:h....un.L.3..I9..E......Do.Q.>^..._...n.dI.-mz3X...)r..c. ..c.%$...G....$..\:..........M..e0&.\...r....OB...n...vH......X..V$.s...Ee.}.Wz$.....p.-...`Q!...nV..9.7S..p1A.+e.......'..k......../$B.A@..a...:t....!......\.Z.y.y.0..F......_.JaAhK.......~.A.JM.W..X.P.X.f....?..g...\..7..S......m.Z...?k#..u.r/..j<.>.7W#nE. ..X..j.D.... ...M%.-...$..ru.7x.D-.;c.I.........>...?..U..Z.. L........4.T9.21..I.9....jA.8i..)h.K....>.....3J.x.A.`.2j.b.._...S..>...t................2......)....j..2....;.v.9g..$M.R8...L.o....N[$...;5.{.f..F.x>s.u.{..gl.a.F.3Te".X.I..-.4Z...v..

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-100_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	6.996664132200843
Encrypted:	false
SSDEEP:
MD5:	7F69F89F11FD675B36E8DE01DE3C29AD
SHA1:	B91E00E68889367DE138FFA5E7FB3C9DE2A18467
SHA-256:	3829DBEFE8BD528BE268F3181A902E1FE78883EB8F8AAC679C9985C2AD13C6B9
SHA-512:	06C162296C5AC62429E6E5DEC07B836E6053CB4EB0291D8ED904F71CC42352C134870ED964517D2600F03FD7CF3821EE877EA83A330C9597FD7D629F9C2A6432
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................PLTE....................................................................................................................................................................%:...5tRNS.......r...uXLC?%./.....m;.....}..hd4xQ.).H.\+.$.......IDATx....#+...j..].........D. \.].....?B.a..a..a..a..<...iy.G.....s..n.C.^kxl..E........4......S...XTM;~..../..v\|R,_............X.a..].....)[...3}...4)......+..aT..6......h3...].....K....t...MH.&.RF..3...k.z ..3."..X....Bl$.'...f..N..SfP.I.).[.D.L1......O...t...Q^.90h.}Gh[W7X....e.$G.z.w.TTT..B.w.W.%)p...s./$C.A....}.d.0..1o.....1.....Y.X.H.._(s_/x.Z.q.R..6......._....EB......SG.)5.H@...o6...?5......sk..\|91>.....1Z......$....O^..5.>K=.<f...k"nbOZ$..=l_..U.......x.E...X.Z.\|...A.}...':..Yojq...j.:..... I...o.%.......bU.pvJ14.b.W......<.D......._.....Y..Xjm^r...../.!...0h.\|.;..?.....^.s.~..0,.5\Rbr.......t.....Oa..=R&*.}.1.&{.....T.k._.T..M?.W#J...U..f..F-w;..E..lG.....k...xa'...6.

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-140.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 210 x 210, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1377
Entropy (8bit):	7.522866206704587
Encrypted:	false
SSDEEP:
MD5:	A0076D9B3DB9054267A7C86C9323AEA1
SHA1:	22B85AEEC3E3804FE1F6E91D5A9AC1C6A0153B6C
SHA-256:	2637072751E1E6398C45D2C5B22C54ADADFBBD4D3007238799F5DA63F846167B
SHA-512:	8FB750BDDEA61501F8CE2B0D0C27D29F322C9F297777F26B1401696C836C844369A9F6890BBB9827682DEB70004CD98A973A0742D2D218F12A9FC3C301F10985
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............Gnp....PLTE.....,........+..+..+..+..)..".. ....+....+..+....+..+..'..+..+..+..+..+..+..+..+..+..+..+..+..,..(..).."..+..+..+..)..)..)..(..%..+..)..+..+....+..+..+......,..V(...6tRNS......mW1..f.:.`.s.....z...M..'"...PJ,...?.6..[AT......5IDATx........................... .....9s..........K...b.n...w...r.-.P4g.Z....."...g}pUg1......w..hd..q_..E.....@40..>...]K.gum.Cu.]..inF...T..........[.O..'.e........^....m..{.....ST.+!....].I.%{x...he....f.3....v.6>.7..<ND5.....;.c..._T.B.Y......M.."E.w.B...;y.(.(.Y....A...f.+.N............:8W.sP.N....fd6A.........Q.$wA.T5....J...a&`...7@..J..nJ......<Pe... Y........#..}0.....1.l.`.k.O.j ...jk.....C...T....,.....+.U\|x.8..,@.....Q....o0.`...k...;.)..w.F....<..]..<4.n0...+qe0v(.7.....s.`X.=A..~.2..\|W..A..^.I3vC^..j..s...^.Oj0]0....T.Y.2..;.I[."...\.Y....H^.x.+.@.....2........w.5.x^.@m4^=.AM4^.u..:..`....f..VJ`:..=T@y....@....u.....2....L.U......x.j....8`N...Nb.".

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-140_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 210 x 210, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1386
Entropy (8bit):	7.150203984555013
Encrypted:	false
SSDEEP:
MD5:	F601DF01A867A51514EA89AC9BFE9B86
SHA1:	827CF9859B7B1864236CD1F03E8AA40758285E82
SHA-256:	CE3559B2EFD6D547FB822440690CFBF793EB70C98154AD4DBF3A7C0E1AF5E166
SHA-512:	2714E67298058E8FDAD4459CFA17E2C7C67353BBFD9EA850BB403E669AE085BA579C31F7D64889470A97565719342E6A30EFE2F66566783197194433AA947600
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............Gnp....PLTE........................................................................................................................................................................,.H....7tRNS......."......_..E:....bL(.w0......rgS6+.{mY...?.G.q....:IDATx.........................@o\...\|..ff.r..W..'WS...I......`>.L...M.x...w.F.{.O.....e5..z....F..v.....TSX...;....-s....W....x...U. I...U.T...i.......a..L.l...u..{....J..B.=...a.v.)/h....a2..?b...N0P...~..Ko....#........l...p........(....1e.x..$!en...~....a.......:.....L.S....l.c.(+. ..(s..bBY...F."'..N...\|..h...B..).p.(..!..SC..o........O.h....?.g.....E.._.S..:....f.%eh..(....6..,...\|.8.NQ8G>....M.C....1....N...15..C........M._....=".J.A.W...../.j.&.....mW).j..E..h......W.L.;t..s8.Q.B..e.b.....l......U)..F..9...d6.....svm....9........R./..U..-(....Z..\|...U....t..i...d..a@.....E..K.3E-.7DO..m.Q..........l...#J>.x.......g..)'..........M......7...-..)j.U.P...T.M.

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-180.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 270 x 270, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.694831501719709
Encrypted:	false
SSDEEP:
MD5:	0A76F51F6169A31402FF7C61CFD05161
SHA1:	843A32D6DC0D5B9D97C5F475F96E49852823A103
SHA-256:	7CA510381079A4B166E9D5FCF0DC005D9606197E8636621B655D6459941139A0
SHA-512:	7056949D7AA9CC4C96F9C13D656CFFFA9F9A49CA78F6BE3037CD38CC1D8712917CC235099F24723BBA26FC9FFDBA015480309D0418961C1116DBE7B65DE6301F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Oo......PLTE........(..)....)..+..+....+..+..+........(.....)..+..+..+..+..,..,..+..+..+..)..+..+..+.. .....+..+..+....+..+..+..+..%.. ..'..+..+..+..+..+..'..)..+..$..+..+......7tRNS..!4AP^iw\|pcWF<%.1........8......K...............R.W......IDATx......... ..eCT.............<....}....Q.?..k..............6R5....v....b.\....Y.k..V..x.n..+dL.i....kCd.6..`:SH?.9..qa.4.U.\|.<DZ){...!.H.;\|J..:....L....?M..Re..]:..j=T...jvo......C....W#\|...-.].....i...D}.b..T..y..V..+...`<..-...w...!.w..N....;/....,..q...@.u..N......e....k......a..O.....K^1...a.j@.W..X...n..x.Mj..h....f..(.>N....x.\....choR...O.x.+....c=....r.OQ......!...90../...x5..B.A.&.`u.9...N.;\|..l".b........)L..h.;.\`..K..Mq].0.....r.yx2.......s..._4....T).G.^...z.\|....>%}<(^. ..>)i.a%....pEI...&..]Ck.%g<.D..:S.g..l(6.#4.A..Oq..\Z..x.Pjr.........S.`.m..H.W..nm.(..Y.^....?......g..O.(X@S..v........^..(..................9%M.w[....^Q.#.!.Q......{.z.%^.Rp..f...l..%Jz.

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-180_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 270 x 270, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	7.394848436660686
Encrypted:	false
SSDEEP:
MD5:	67A0163CD9753E42360222A17173F593
SHA1:	E4EE5C2288CBD5D354AAD1905B917285A3DAEB92
SHA-256:	F7EB888CD9BCE4641FCB01088B05BE242F616DC06C3F823E51FB63B53B6F14F5
SHA-512:	87E69E15BA6DEE402DBE5A90DA864136EC2C6884C204A567AD461E0181E70514F73A7DF22A47DE63D4829FA937E56FC4C08CB6C5268313F7B9AF1E7217D81F47
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Oo......PLTE...........................................................................................................................................................................45.D...9tRNS..-Qcoy......~T1.h....#..u7...;..H..M..@......D..^X.&........IDATx......... ...].L...............\|.Km}...\|..R.i.....1+.6...3&L..c.....eX..y.'.Y..7,.R.f.e.v..o.w.6.=............W. ....#s.......o..Z,....A..W\|Q/. e.3>G...i.)1"w.........."?....C...;2..p..s~.'U.At=F......\....>C...!..^0..1C..SD.....vY2LP.....K.j.y[o./W...M..3...v..^k..`..0.\|.....9.JOh.........'.....0T.!.+>.{..oa.7.....o1....c......U..BQVv..a.0.(..$}.....8...r{..0.oS6F....Q.l.PN..........."w.3.......I......E....)...U.r..@...;+.Jx..;..u(.Y?....."..S...j..Ym..?;%.9.Z."..<J...nO..<.(h[.X."./.P2...#E'..(8..NG=..HI..r....i@A..M])..Ec3...<...1.....;..bb'7.....))AK..YV.`.CCg...^7....m)*#..%.4.%.I.K....D...8..vN.-....q.c.x........%].B.....T......f-..). &...-...6.Gh.D.[..

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-80.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.264599360772662
Encrypted:	false
SSDEEP:
MD5:	95A8F1834D8DA00AD94C0CF2AA09853C
SHA1:	7E830E3EF55B4D7B9A18EC8C151BEBB2C28F0069
SHA-256:	F287370FF8C7E2BA120407CAFE09C1FCE674AE8AF5BD5FCC0C2DD1C6628B9CE9
SHA-512:	C89BE6E503C26EFD4EEC12C77E091570E187FF64928CAB01F6F873D9CA3769F019A1724F76B57C9D4038495E29CC4106F919082913323AF1ECE7AFF820C828F1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.............PLTE..............%..!..'..(..)..)....(....)..+............+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,..+..+..+..+..+..+..,..+..,..,..W+...0tRNS........'+029=GKVZajov............................!....'IDATx......0....0..._.wy].%].w..:!..d..a..a....OqV..y3.:.:..bT..i./K..:...U\|=...X...+...g....."=.5.j.$du.>.....".....q^&..0.\|....C..g..G..........0?f.@.G.F..e..d.B..K.K....6..x.Er..nWP.{h..-....n.3X...?.@.A.d.).>.%..>..........'{J.....$.. ........0.<..&T..3..}.l.'...(.{m..T.A.......=..`J.....~.Z..]...~..3.2...r....n. .F.... "...O,^\..,.:.T.x.Q.c.)..?........N....=~..G.@..{.3..x.N......j.W.{...91....I`..[...EK`.,.E.'..O..Es..Z..7iN}@xU.6.9..OwD.j.w.....v..Y.b.&..Ucc.N.W..A.,^.h.x.......;....}........... ..a......_.u.fu.......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\150x150Logo.scale-80_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.429896741621628
Encrypted:	false
SSDEEP:
MD5:	3015766C5CA769E54009F167550F7389
SHA1:	0EFF02455A1E0FA1724BB1D4333C3D24329F9E9A
SHA-256:	0A9129BDE051C17E96E516D5BC509E1A06A1E066A5E2796627CBEF8630002B47
SHA-512:	7EA7495163E0246F78F88DFD0EE72B8584108C286227D70CEC9DE125747F21F2618F46F7197F7CB9C0F40D297BCC3582CF70F54EBF7F9EB10941FBAA6BF0149B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....IDATx........................`....u...8B)A.....3...!...............(.........!..1B9....mo....?....MNN.i!Rd.A.=..Qa.%.H1....S.p.3x.+f...T.......#./.Bd..Z.a.W............0F.cEH1.....N..y..+X.p....8.c.g....5@.'.(Q.A.-r.....Q.Nl.)....{..(0A..+.T....;...."....oH.....3..!50~.{\......-..S...q.6...\c.o.n..&...rg.._....Nn..{0..._...<...(..r.#..op?t.S42.T.........]..@}j.....#.Uu.....(.[..m...C\z../..(0.7..GC..m.>...$.....P.E..}.....u..}.........?...~..,k.s.Y`.......F...#;)J.....N.........o......n.t........T..,=l.a-Z....4I...<X[v....Mw...m..U.......=q..o.....:..M....]....Mc........bT..<.C..o3FISv./... 4..d...NG..'.1E../....gU>c..'LMPj..y..I.........k..y.a.B......"..k.hp@..[..k........[.a........................#..t.:.[.....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-100.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 70 x 70, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.2639879483870775
Encrypted:	false
SSDEEP:
MD5:	EF710F4543A25076078FBC1C09EC9E2C
SHA1:	E4EA1C2CB24CFFF03569DAB28877D11F9C6CFC74
SHA-256:	FB5662C5FDE7D49862DA2E0253AE03DC7E5F9AFD2EDC65D4EFA6DC3A3026156F
SHA-512:	FC979D06806A69DA71336533D96B1CB66B227064A224E23C6F5BF9D1FE4E85A9D9546643CE296BA5F04C025284D5CA2C445C52695AAE669735A2A5B48CE07A00
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F.....F.......PLTE........".....&..&..#..'..(..)................+..+..+......+..+..+..+..+..+..+..+..+..,..+..+..+..,..+..+..,..,..+..+..+..,..+..+..+..+..+..+..,.kW....2tRNS........!(1<BHMQY^dkoz............................f..#....IDATx...E..@..P.=.....-..h..Mh..F......V{......v.)..7........Gz7..M_..........b...'..^.yP..6^&.i=..~hH.:...._..m...i..1.....\|R.@..A.f,K..H>........+..M2...$O=.u.h.[..<&.U..cq.(....u.I}.zp...v.......p..\SAS.).:K..s..#.4...]1L8.H..(H..Cn..]...i....`$.%..P.67....b....i.?.+..8...G.}...<...B.T..Ob.qW..F^..gj8.D..h......8?R....M.X..,N...5e.q.....0Sr.......g.G...{1.`lf.....@...o.I......n.n.0!..L...00E._m..mJH...A..c..D.....D.......~...%.v....A.../...W'w.H........9sd}yy....'M......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-100_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.641591962867115
Encrypted:	false
SSDEEP:
MD5:	AE8EECB8DB4D20EFBD816B887EF75840
SHA1:	1D0CC741D0A75E5E8AB51DD8B6A99F5E679EF5DB
SHA-256:	3FA9DFC982544F3FFDA0795BEEC69C65D6C5883BE0DE37133466E643B5F3AEEA
SHA-512:	0CB71EB86AB2C5D4C70F04D7B10736AA453D51B56723ED7C9DC332F92EA428EB7861F23DA2E30416BEA8CC59877BA2C87F3032EA473028A7DF8C6A299D517572
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F.....q......IDATx...d+A...... @..@ ........<...C.!.........E (J. .8.C.7...z.....\|.(...wvow...0..0..0......c.X'....[.......k#.....J%.Q..y.7\|8T.....E.1.x..e.-Ys.L......g=....J...2e.X1].u'A[....G0......9..Cg..d....)k+.$oe.WV"...I.+0..R9m...s.tS.S.@P..K.d.S...&..m$@._.e_..Z...,..=..!.....t2s0..@.s...X.u..}....{.c...b.....X...#..3.......C.....r.,.S}.5$b$.MHP......L.j.p...._..W..rH.pKJ~..I.A....fH~..=..9"...&..kR...i.?....B..6\|".L.oG.8....x G..&.O../.-........../.c...YI../.u...g.{..B>"..V...)..k....~...6....X...pd....D.)...=~..\IA.C..$2.......]..Y'..D.....!..1.S..,.A....!....../g._.......M5..?I...........K..vv.\|h=.r..S.V....r.;./o...../.NX.O..\.a..a....[..[......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-140.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 98 x 98, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.440994235634435
Encrypted:	false
SSDEEP:
MD5:	9590B4BD9378A2D8706DCBDC630FAE8A
SHA1:	751EB2AA5CE4E83133A73FDB9EFFFC013BF37EC8
SHA-256:	84F8EBB629791E0B73CD53D7F3445D685145D0787A207E25842B237C98A8C99A
SHA-512:	B2666EFA916584C9B090E305EDA116F2A90C58862FA36A0963176B09B493A4CE5E601A178C74BE0F2E59811AD42CD1D5747E8A45EA07C3F5D52B28E177FA5603
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b......{.<....PLTE........!..#..'..$..&..(..'..(..)..)........)..+......+....+..+..+..+..+....+....+..+..+..+..,..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,..+..+..+..+..,..,..<T...7tRNS.......!&(.3:BKPSUY^bgnty..............................7H......IDATx...E..0........h..O.p....kV...}-V..H$... .bk.>^..>...z...;.O.]f%..X.....f..h..c..B....ng.^w8_;RN..%..7v....k..2B(...4H...x..K6J...+..b.B...K..$.<..;.}`.^:....R...1....e....k.]rlK..).s.7..S....C..q.7J.Z....E....8O..n?(.%.b!.....g....9..\|y9...Ghg...S....G.W.3...r.m.U).Q....c1...A.(D..h.q...D=_..gT.&.VxnAG.yj...@.BMr.......J..k.E..b....q..z....4...Y.Z.....U.X.[......h^.W..2.z.Pp)D.J{.3....>..'.v...rs...M...".GO..f..I..}...E..e...2.$q....\.V.Wu.x.W.iW.x..1%v.x....3.p..w..Y.+...%...7..#..V...C....sR...G`.....$(18Z..cKu2......Q.-P..Q.5..O..2?.g.L3...$..]b..}5c..6.mz......s../ix....F~....Q..`:...U.jJ..m.R0......../.3...s..L......c.M...?z~.H$....G.....[....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-140_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.694615159268941
Encrypted:	false
SSDEEP:
MD5:	9B103E9DFC26DD4D837DF8AB55EC4FB8
SHA1:	6F46830A3A63E0EEC923BCCFAD57D8391AC3E559
SHA-256:	99CD2B5809AB9C604613B305BC80E6F68B858C1289C07E84AADABC4C3768FF32
SHA-512:	E8023067638A9FB849AC9364A45C8BE9A6DD325FBC704D960CF270CE1075AC6C9D57B7F96CAE62985E92E5543DC2F2A43D473A2DCB0060AF067CD474AAB7E59A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b............(IDATx.../Hd[.....Z&...l.d.M0...d......6-<6Y,.&aA0..M&.I.,2.`.........}..z....&....{...............MY......#<..S...#.p..v.&......+f...?.EG...c.a...).8BK...S.0{.2.Y...X\|.....}\|..\.;.x...!.\|P..^........l..}...m.......;.+.......w.....>{...q.k.c.G.q.[....XQ-...`..o..5^......G.b.q.<...x{.q..vg.h-(..X.{...P..>..p.Ya.Rp.t.<..XWy.z.up.....v0)....Y.w.m.%..Hy.t...%r..N..C...)......?k.O..E[....7..~....)..6........4\|...0Y..{.0..t.....s......)l+z.V....9...TK%N...uV...U.\|.Y....7.xj`.WS.4T.O.w\lj.....h.)f.~7..:...N.Q...u..../...h.....8W..5...{,..z<,.X.sa .....;.I..F=nJ....."U.\...Nc...\y....Lq.^&.2.i..a...,.f.4...S.g;M....u6..a7[...9...-..A..T..-...9..K....u..s........C/IQ.4A.h.".....4...p..f.e..$W,..q..F.....H...b...uh...I.^......l..;L.".:......`.gL0.+.x.............h..oC.Lz.2.....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-180.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 126 x 126, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.574565747601677
Encrypted:	false
SSDEEP:
MD5:	7AB03A8BA1C0243B96C4124CD5341073
SHA1:	7DE490DD37EBED58337FC0DB654F12398E84A78A
SHA-256:	C5D33EE3B5E8DCB9E9AEAE5F14D0E92CF9BDC16D6245CE65DD4340C8A0BE4F26
SHA-512:	C96846F008E8AB440009BF2442A2CB9DB3D24452619C8C2B669395F971F9A316EC62693BB586A94E565F1CAB893BF665112C34CC1FA46319E571E3FB4D2FC41D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~.......U.....PLTE.................$..%....(..&..+..(..)....)....+....)....+......+....+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..+..,..+..+..,..,.w.^...4tRNS........#'.49>CGKPTZ\ainrx.................................IDATx...e............j.[{o\|.....a..?.O..L&..d...rg.<.oO......Sq...h..w..Q...4.1.uZ.'r.G~..u.9r....F.....4t.9HX..P.i9l.+.b...-.$.5$....X4]\|..].....T...i8....\AB.oJ...P.u.Ip....\|.....a.^..%..$j......K..........a..S:.....{-....).]..t`.....J.....Nm........=..O..m......jS.Bk\.L.O.Ae.~..B.F......g...b.S.x...Q^.".......tyE..2....j+UDT.r..X...9R....W..I.......r.bK.....A...F......P..z.c.....3%..g.......j0....aj@a.C.o^........m.m..J....f6.......}/..C......Q..w....Q...'./e.Qt(.,.9.DQ._...\|D.Rx;0p..@4o.y..Q.".;.".<)...%v..S8 ...zj..Rh...w...U.#.Zj..J.l....y)t...zi.9^...'0.V).R.nXL.=.~.5.0Jk..o.Lk..U..`.m..P........KL.)T.Z`.....[^.....6W,fZA!..%4)l..X....~...SJ....B+.-et.)l....4.Q...8...F.QFT.^.#.{.B.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-180_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 126 x 126, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.069967959827789
Encrypted:	false
SSDEEP:
MD5:	1521BE4B8C8F2E0CE20A89F163DE3909
SHA1:	C291448B74FC3D7060C1DF4B35026084981EE441
SHA-256:	E5112331E0E2684FFB5ADC0AC23324D9836CF067111F1F5834C77B1153A8A5D7
SHA-512:	6A0781D275DBF8FAD4EE464E759DE74399918ABDC99CEF3C74E5D66A0D555A8BED363DA964C15E2AD9AB3CDE5A17D537BBCBADB10585AA1EF50F0B614FC39A50
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~.......U.....PLTE........................................................................................................................................................................,.H....7tRNS..........!%05;?DJOTX\afmqw\|..........................\|.%.....IDATx...U..F...khfffnSi.;..cy..c%y>..]v.t...r.\._..l....+.y...Q.FF.....n....V..)...Y.B...y........o.....kWF.'..>...F.To...K@.,l...."8.....^..Dj.W.........tt\.]..~f.Z....Y.=>...."...O...-................Y....n.FB.XN....7..)..N...Cu...K$a.5...x+$."...o...7.2..R.g..Z.8..........&..D..G...8..y......e#..q..>R.Sz...q...8-D.!....2..E.....4V..q.:.81...h....{blR.tC.)...B_.8..-;bl...s.r../@...#(B..c..Q.....m.....e..h@....5.mG...t.....1n. N..,n.T.Z..)#..1..a+b8.b...4.sL~V.B. .....^.7o.(.....&....../~...b...8EDr&.....1..!.....G4...]E./...V........D.x....+...o.M...aK.....A[..!...^.)...//..WPSr.%...Z.eE..jXI..EIY....'.N.k.T.o.....$...F..8.....`.U.... .@.u.....hx.0w.R+;...o.Yp...$cC@.J!.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-80.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 56 x 56, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	590
Entropy (8bit):	6.966656188079672
Encrypted:	false
SSDEEP:
MD5:	1B4FF26A106929E3A5710900A9D984E7
SHA1:	D3E1BB4FA64083743AB56ECD89D586DF6B583BCE
SHA-256:	91BA72309E34C5336C09B8F5C787A6327082F275D5D7BFE491C5430E67C80752
SHA-512:	D8537FA3B0DA1B2EE7C8CFBE9101A7DCA624AF4532305E06F211E4DAC799AE9B533F19D3CDF052352E2A926BFE32CC908CD3944B2543010E7BAEFE52697ADD92
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8......X.,....PLTE.....+..+..+..+..+..+..,..+..+..+..).....$..+..,..+..+..'.....+..+..+..+..+..)..)..)..#....+....+..$..+..)..+....,..)....+..+..+..+..+........tRNS./........?.....!.{....49.(wU..^CpO.+<...k..l,....EIDATx..U.r.0..1......+..;j....6..E.x....p<./..]......}B7.m2.v...zw.....]H_s....'i...;../^./...9G."8j.Y...A...$5T...$-..D.AZ.=..@9.......}...9.\|......i]......k.0.~... e1Wx.!.b.0.O..{e(......,.A.<_s..8^.......9..pZ...#t.......t..K.x9.....r..a.kr...dR..../..$.^...].......[...~t....@?1gN... ...aE..'..#........0.F...K3..;.....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Assets\70x70Logo.scale-80_contrast-white.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	519
Entropy (8bit):	7.481207836176718
Encrypted:	false
SSDEEP:
MD5:	169DC90309162BBABF07AC3D954A076F
SHA1:	A4C87F029A4F34D66847271CDF8C5E73B1E48A90
SHA-256:	37B0F1FB4A08AF8A42E6D8FCE4C7380DDAE0272150D7A9BB8B1D138066A9FFBE
SHA-512:	B7633C8FAA5614EFB402C47957577DBACCA1A1B3FD0BB39CF79EB3A06EC6A55F9B8C5EE9569271EFBFD7D43AD348D275C0C6C9FAF840663268BCA2FBC6C64BB7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8.......;.....IDATx....d.P...#....B.e."0.....p.........C`....p..B@AP(..Q..}.s..[....... ..$yo_.c.,.,k...........9...D..E....`..l.'..v...9.T....S..0.=...G......7.^.\.+.o..Xb....F....sk..%]..T>nBw..&8....c..l.....j.a.9z/F#.13\|.g.)z.tC9.......s>.....W8.D....G....Z%.b8...8...y..p......P...,.R..1..r}.8xKJ.,.m.+..............g).y.\5._.l.._.v...11....~....._..s.>x..a.Y......T._t".._6.V.2...`.~.X._!....v...7,.;N.5...{S4..."a..K1...s.To..M.[.z..B.....B.,.,...?.x..H......IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera\Resources.pri (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	data
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	3.118957212117411
Encrypted:	false
SSDEEP:
MD5:	400817D0A91767CB830767AA94383F31
SHA1:	73F36C895190223F94E4D52657F14454B2BCBA44
SHA-256:	35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
SHA-512:	2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
Malicious:	false
Reputation:	unknown
Preview:	mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998752
Entropy (8bit):	6.733167119600602
Encrypted:	false
SSDEEP:
MD5:	976BC8E5FE65F9BB56831E20F1747150
SHA1:	F9E7F5628AAAABED9939EF055540E24590A9CCFB
SHA-256:	F53C916CCF3D24D6793227283DE2DB0F6CC98A2275413851807CC080643D21A0
SHA-512:	2858E7E08418B170B21B599AFB02236D0480D35A5605DE142F10976489E01DAF2AD80DF0F09C2EB38BC5A971336D1F6AA9909C520BCDB18E9C9A8E903379DCD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."...............................@.................................r.....@.........................s...\.......@....................V...)......\|...\|..............................(...........................@....................text...u........................... ..`.rdata..Tc.......d..................@..@.data...xg...@...>... ..............@....tls....]............^..............@...CPADinfo0............`..............@....rsrc................b..............@..@.reloc..\|............d..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\assistant\browser_assistant.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3968928
Entropy (8bit):	6.748605019541295
Encrypted:	false
SSDEEP:
MD5:	37D5952B8EF15BD4D9E0DC2C00288512
SHA1:	8E79A7F3A0889E3EC84776F3FC7AD6881F26464F
SHA-256:	DD3B92A48D633B81F37BBDDBC88A2E90FE4DE78ED9D62AE3D13045D045970F8A
SHA-512:	3E3801038F1887DCBCA92711EDE3A581C914E4227E0490528BF430C0EDAE57D2E7247E9E705F5047B241989E9ED0DE14EEEC2F7AC1F0B41AFED65F87C2BB04FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......./..........l'...........@...........................=.....~Z=...@.........................Kk7.Z....k7.......9.X............f<..)...`<.x....77......................67....../..............t7......j7.@....................text...[./......./................. ..`.rdata......../......./.............@..@.data....\|....7..D....7.............@....rodata......P9.......8............. ..`.tls....E....`9.......8.............@...CPADinfo0....p9.......8.............@....rsrc...X.....9.......8.............@..@.reloc..x....`<.......:.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\assistant\dbgcore.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170432
Entropy (8bit):	6.683199509575193
Encrypted:	false
SSDEEP:
MD5:	9EBB919B96F6F94E1BE4CDC6913EF629
SHA1:	31E99AC4FBA516F82B36BD81784E8D518B32F9DF
SHA-256:	FDAE21127DEB16EB8BA36F2493D2255F4CB8AB4C18E8BD8BA5E587F5A7ECD119
SHA-512:	A1B42F7D2896DA270BB3C80CF9B88C4B4F1491084E7AA7760EEEA5533B26F041DC79B21D5FFD2BBA2221FE118E0A8D912E170F24FD895C9315B1EE9C7ADFE700
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.ASg./.g./.g./.,...e./.n...N./.g...../.,.,.`./.,.*.h./.,./.f./.,.'.u./.,...e./.,.+.l./.,...f./.,.-.f./.Richg./.........PE..L.....e............!.........P......0................................................n....@A........................p...q....".......`...............J...O...p......Pb..T...............................@............ ...............................text............................... ..`.data...`...........................@....idata....... ......................@..@.mrdata......@......................@..@.rsrc........`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\assistant\dbghelp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792408
Entropy (8bit):	6.571517887718647
Encrypted:	false
SSDEEP:
MD5:	544255258F9D45B4608CCFD27A4ED1DD
SHA1:	571E30CEB9C977817B5BBAC306366AE59F773497
SHA-256:	3B02FC85602E83059F611C658E3CAD6BC59C3C51214D4FE7E31F3AC31388DD68
SHA-512:	2093DA881FA90EEC2B90D1CA6EAAFF608FE16AC612571A7FD5ED94DD5F7FF7E5C1E8C862BAB0A228850829527886473E3942ABD23A81D10CAB8F9BAAD2CC7664
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.0.Y.c.Y.c.Y.c&..b.Y.c&..b.Y.c.!.b.Y.c.!.c.Y.c.Y.c.\.c.!.b.Y.c.!.b.Y.c.!.b.Y.c.!ic.Y.c.!.b.Y.c.!.b.Y.c.!kc.Y.c.!.b.Y.cRich.Y.c................PE..L...q..`...........!.....F...\.......3.......`............................................@A........................ 9..e...Td..........P................O..............T...............................@............`..L....8..`....................text....E.......F.................. ..`.data........`...^...J..............@....idata... ...`..."..................@..@.didat..............................@....mrdata.............................@..@.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\assistant\installation_status.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	5.126831594510172
Encrypted:	false
SSDEEP:
MD5:	D74F712D4F1067567DF4AA5570AA2C14
SHA1:	0ED109A54CD5FB2B0DE16EF1F11ED5C4B5C1C1FF
SHA-256:	068F3A13647CBABC30ECEA3EA7A54524C5A01E1CE3EE05DA00765B2907A0170A
SHA-512:	2521FC45C96C20A88B57AE7811C63C4960A3DD1661C28B6DA2383EF0615E757EAD5512BC0DF923D58416363AFDD404B9814312593D372F7C0BD56E31E80E94FE
Malicious:	false
Reputation:	unknown
Preview:	{"_all_users":false,"_launch_from_install_dir":false,"_skip_launcher":false,"_subfolder":"","app_id":"1713386547","copy_only":false,"files":["assistant_installer.exe","browser_assistant.exe","dbgcore.dll","dbghelp.dll","mojo_core.dll"],"path":"C:\\Users\\user\\AppData\\Local\\Programs\\Opera\\assistant","product":"","registry":{"HKCU":[{"clean":1,"path":"Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION","values":[{"data":"00002328","name":"browser_assistant.exe","type":"REG_DWORD"}]},{"clean":0,"path":"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run","values":[{"data":"C:\\Users\\user\\AppData\\Local\\Programs\\Opera\\assistant\\browser_assistant.exe","name":"Opera Browser Assistant","type":"REG_SZ"}]}]},"version":"109.0.5097.45"}

C:\Users\user\AppData\Local\Programs\Opera\assistant\mojo_core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1300384
Entropy (8bit):	6.822627271183708
Encrypted:	false
SSDEEP:
MD5:	AC6617579B0441E7EE9FB25287011FBB
SHA1:	1597E91DF55C4534CBDC174EF879E66AD40F3C1F
SHA-256:	7FA2B189CB333C09072F14B26DDED4F9D80E968E5624954726DE1C17F1EAC22B
SHA-512:	E78FD9E810ECE0B74B95513BF9159DC695E3110605E20919A9056C13801668B7BB6F15B8DCB44E0E1AC00761DEFC441DA00807E811DC8F062102A99B11747CEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!.................l....................................................@A............................p...d........`...................)...p............................ .......0................................................text............................... ..`.rdata..D...........................@..@.data...\O.......4..................@....tls.........@......................@...malloc_h.....P...................... ..`.rsrc........`......................@..@.reloc......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5668768
Entropy (8bit):	6.519805313177513
Encrypted:	false
SSDEEP:
MD5:	4187BE7AE04E22F0D399C55C28F0313E
SHA1:	05DC5D3C32583FCE4F9A61F2AD3D4D48158A364D
SHA-256:	AE987C8915F7B160557E602C933D2EEDCABA42BD553E7B3B837D5B9E9DABBB71
SHA-512:	9B42B28B7E456127CC76B3341A6D65DB611A9354E2E434BE2310C7D66983D4CEF400D13598630932549256A96369FB4D61F60DF1F07CDF675DFBA2DCC51F27BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f..........".......F..2.......!0........@............................. X.......V...`...........................................P.Y...<.P......pV..W....S.<7...VV..)....W..@....O.8.....................O.(....3F.@.............P.....X.P.@....................text...E.F.......F................. ..`.rdata..H.... F.......F.............@..@.data....B...0Q.......Q.............@....pdata..<7....S..8...0R.............@..@.gxfg...04....U..6...hT.............@..@.retplne......V.......T..................tls....a.....V.......T.............@...CPADinfo@.... V.......T.............@...LZMADEC......0V.......T............. ..`_RDATA..\....PV.......T.............@..@malloc_h.....`V.......T............. ..`.rsrc....W...pV..X....T.............@..@.reloc...@....W..B....V.............@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.licenses

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14004
Entropy (8bit):	5.037159328058129
Encrypted:	false
SSDEEP:
MD5:	2528B26988213FE5C0EE9CE75ACC2935
SHA1:	D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
SHA-256:	42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
SHA-512:	F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
Malicious:	false
Reputation:	unknown
Preview:	This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.version

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:
MD5:	0589F66713BC44029A1A720B9A0D850D
SHA1:	2FDF7D04F0372055C9D77CA43D9A3C08798905F3
SHA-256:	64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
SHA-512:	31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
Malicious:	false
Reputation:	unknown
Preview:	1.3.0.

C:\Users\user\AppData\Local\Programs\Opera\installation_status.json

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13557
Entropy (8bit):	5.2600367889336095
Encrypted:	false
SSDEEP:
MD5:	55CC7526A61B0C603D8FCE37D60982D4
SHA1:	427A09405A7C740E005D2DBE4FF07C99EE8F9561
SHA-256:	8A706E224699E75DC65DF8334E356900B30048566D8A7437063C93AD91271473
SHA-512:	0B0E8F77B129F8F8406510E730C51511091C985DFBB2B8CCF68F82892C92749D15A2B10C9E730EB3455B9F9CD201A70C64F6B360C27D128B51F4B935D8F32EBB
Malicious:	false
Reputation:	unknown
Preview:	{"_all_users":false,"_launch_from_install_dir":true,"_skip_launcher":true,"_subfolder":"109.0.5097.45","app_id":"1713386541","components":{"assistant":"C:\\Users\\user\\AppData\\Local\\Programs\\Opera\\assistant"},"copy_only":false,"files":["109.0.5097.45.manifest","MEIPreload\\manifest.json","MEIPreload\\preloaded_data.pb","d3dcompiler_47.dll","dxcompiler.dll","dxil.dll","headless_command_resources.pak","headless_lib_data.pak","headless_lib_strings.pak","icudtl.dat","installer.exe","libEGL.dll","libGLESv2.dll","localization\\bg.pak","localization\\bn.pak","localization\\ca.pak","localization\\cs.pak","localization\\da.pak","localization\\de.pak","localization\\el.pak","localization\\en-GB.pak","localization\\en-US.pak","localization\\es-419.pak","localization\\es.pak","localization\\fi.pak","localization\\fil.pak","localization\\fr.pak","localization\\hi.pak","localization\\hr.pak","localization\\hu.pak","localization\\id.pak","localization\\it.pak","localization\\ja.pak","localizati

C:\Users\user\AppData\Local\Programs\Opera\installer_prefs.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	5.079487440572729
Encrypted:	false
SSDEEP:
MD5:	17B0ADCE80E7E3D81927BB44C4248367
SHA1:	766CB9174C52D8D0A164ACDC1305D64CDC7BA4D2
SHA-256:	4F30E6178971793E49B70E639144FC66C70043C67FA32C372CD4DD735EAA88FB
SHA-512:	E62A2995C149CE879BBE24A6E0BB2A7697A054D3518E4ED98573DD48EA07EB620AD4595B5C2D4580EB2487C9E22A6E66BC1481EE9A986453E254344AE96E8374
Malicious:	false
Reputation:	unknown
Preview:	{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,03b8357e5a08,06fbbd0b7bf7,1c4dddb65bac,1d24dceb937a,26000b66a01c,26f7e2d59ecf,278deecb29a1,3389f6c15eb9,3fc0872a857b,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,5a28d66c82cd,5aceda74693f,603cade21cf7,654296fe9d6c,6713f3df0bed,6a00b9093bf4,7e93fef4a11d,804beb213cf7,818c3ef12d0b,970fe421a344,9a48123ec9e3,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c25d6d8d2719:disabled,c57119eb4723,c6dc56485f2e,c73cad8a4668,c9a44eaecc11,cb479f6a3f5d,cbc43aa3cfb6,d144067b33ec,d4260daf5dd9,e29359b2d759,e2c9ffba8439,f3834d6657d8,f824dfec6894,fc82980101cd,fda8dc4bd759","import_browser_data":false,"installer-experiments":[],"in

C:\Users\user\AppData\Local\Programs\Opera\launcher.visualelementsmanifest.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.998309867995081
Encrypted:	false
SSDEEP:
MD5:	A19B4BFB5A4CC4F482C00E4CE4566066
SHA1:	45399F2B595FE986510AC49DB12708684657B1D8
SHA-256:	DEB8410BF403C8C447E20BE621504420A7B8DE62A83B3624A81B2B8640566F70
SHA-512:	399A1C1F18CCB2338B4B8FB9049A37622DF90C226666B59B09EECEDD7A7CFA1D42D5E81EADC581F4CEAF2BA947AF8976BC5104DE15EEFE096D88EDBF35EBA203
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#FFFFFF". ShowNameOnSquare150x150Logo="on". ForegroundText="dark". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>.

C:\Users\user\AppData\Local\Programs\Opera\opera.exe

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1581984
Entropy (8bit):	6.272223856034065
Encrypted:	false
SSDEEP:
MD5:	05817E4297C72B8C58634C62531D5824
SHA1:	3ABCB7CA3CD5EA65E99CA9656901ABF803DE2C71
SHA-256:	7250E23D9B7F2CE62ABEEB90D62F7F8B4367379A581A50E3E59EB0AD5A51BD05
SHA-512:	E59D2AB48969E4B4F2DB3091A7C6C90FDD808C235E6A00F5976C67D5DA3508E964266DF5252200BE6A0706C7B0427E29628ECA435AC576569D7A25DCCC137BB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........."..........0.......\|.........@.....................................v....`.........................................%...k.......P.......(.... ...}.......)..............8...................p...(...@...@............................................text...?........................... ..`.rdata..............................@..@.data....{...........~..............@....pdata...}... ...~...h..............@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...(...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera\opera.visualelementsmanifest.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.998309867995081
Encrypted:	false
SSDEEP:
MD5:	A19B4BFB5A4CC4F482C00E4CE4566066
SHA1:	45399F2B595FE986510AC49DB12708684657B1D8
SHA-256:	DEB8410BF403C8C447E20BE621504420A7B8DE62A83B3624A81B2B8640566F70
SHA-512:	399A1C1F18CCB2338B4B8FB9049A37622DF90C226666B59B09EECEDD7A7CFA1D42D5E81EADC581F4CEAF2BA947AF8976BC5104DE15EEFE096D88EDBF35EBA203
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#FFFFFF". ShowNameOnSquare150x150Logo="on". ForegroundText="dark". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>.

C:\Users\user\AppData\Local\Programs\Opera\pref_default_overrides

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.2929876016942625
Encrypted:	false
SSDEEP:
MD5:	F488C9F9D9D5E631484D4BF155F45442
SHA1:	0F0E624770E47BEA5186748A9DE85C677DD84FA7
SHA-256:	E6F214FF5CCBBE6E7ABCF309138CDCB46D3FE3915E9BBBE8DD3C15AFB439F708
SHA-512:	D72D1DAA86E650A0589F6991F7A7BB3B7CA3484D49BC0D0D703B28B8F399F3123DF2BF3C949A899FAB55BDE7D888736F655E462E2CD02ADE59BBF9E67DF54064
Malicious:	false
Reputation:	unknown
Preview:	{. "Preferences": {. "ui.search_box_enabled": false. }.}

C:\Users\user\AppData\Local\Programs\Opera\server_tracking_data

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text, with very long lines (784), with no line terminators
Category:	dropped
Size (bytes):	784
Entropy (8bit):	5.674092363724188
Encrypted:	false
SSDEEP:
MD5:	1B695D382EB85471F6978A64E3A0585F
SHA1:	54D35AF5C218387505B82FE78703BDFA774706D8
SHA-256:	613CD969820BB721915475DE72544B9495345E0FC0A9792C579A06A1FDC75441
SHA-512:	A80AB8D36061CFF3A78ECFBB68758DE6815D176D17F176483B084031FE00E8382A08822615466ADAAA5412D92EB6F3F9957CE661D42C082BC099E25F52C1B53E
Malicious:	false
Reputation:	unknown
Preview:	YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960944
Entropy (8bit):	7.768238813655888
Encrypted:	false
SSDEEP:
MD5:	3C51B6EED283BBE7D10772DDE9BFFFB7
SHA1:	F30269E23BCDD815EFE305E25C796C2E211EC085
SHA-256:	92092018F15CE77E2FCEABB90830762EF3273EB4BCA3673881EB3EA68855FBED
SHA-512:	F0D89788B556EE93A697C1DCCC7C79FE19E3573F2CF0485CC988FA9515D943BF43003C0F4275A0ACAAB7BFF032CA841C3E53F78325A0B6DBD2BFDCF57CBF2BBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e..........".......,......`&.@.R..p&...R...@...........................S.......-...@..................................pS.......R..............-.0,...qS...............................R.....$.R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!....I....3b.l.R.-z,..VR.&..ta.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\102.0.53-DNA-116018-opera_intro.crx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1558464
Entropy (8bit):	7.989755786519264
Encrypted:	false
SSDEEP:
MD5:	C1B0681E1041A881F378D703BCD62D3B
SHA1:	3F11F065B8329E079F8DDD4DB3F876BFED9E68AC
SHA-256:	C622D0A631A3510E149520C0B9D03BD42CEC098812A3D6161F97B0982248F9D7
SHA-512:	42EA37415C869A1368549299E4A04DF8E709C6F8C8B484DC7BCF8B0EB2E8D239D760C582240FECEA674D4023462686A37B50E5B1E3CD9A77AF7F6D8738A431BE
Malicious:	false
Reputation:	unknown
Preview:	Cr24....E.........0.."0....H.............0............c6....'P...xnv..5._k.....a.3Bp&....?.u.#....w[...h..T..tAL.01.Z8.Q..=...0.....A..\|..M. N.s...U..+.ej\|J.c..b..ZO..].n.1\i.I.0..=E..^..WO.#......#UZ.x=.%WD%.d~....R...4...y.E...3<Xa-...&#.+{.Y.:hA.;C..n...[.?V$$..:d.....,......r.3C.e.CV..d...............Z.p.........O.KU.-.v....7b...KS....N~..q.A..............h.y.y...j..eA]>.^..k3...<...NM...`UB!V.A.=.[...m^.x...qn.pL...B...v....N.S3..&..~.......Lw...\......iAJ...h$......n.J.P..@Fj....+....M.!y.vd.T.x.B......8.)}.4;)u.X..t..}d...H.>.......G.......a.......PK..-......b.Xk.s"....S.......0d406bdcf61e6d381f23.svg......................Mo.........E:.Y.....bNB../.......$A.E...U=K...C..vjz............x..py.C.-.............;X`A[.OW......n.........p........x.q{........../?.\|..8\|..._Owq.....W?._..............4........7....r.x.{.......... b...\|..l};........H..U...-< ....&..r.Xx.rZ]..W..A.{.G]..s...d5..."C..W..I5...:....=.......D...9 .6...-6.0.cgYb...S~

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\124fd49f-9a30-42f7-a4db-861fbf0cc6e7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.781131720320427
Encrypted:	false
SSDEEP:
MD5:	1711A44FF4ECE622E1E28C68EDCD2EE6
SHA1:	7865F301457D154E5E392BFF6D4E3661658FFC83
SHA-256:	5CCB47C44177CB8E7116D78F815DF030C24BE293FD521D1F9469197778A32780
SHA-512:	1273F28442812314FB0830A2F44978297E51FE28A38E2D594B4FF107B4C5BA4FBF57941028C2CF2D5EEB05A0B4C2DC40265A8CE1F739F19F52AD535441341853
Malicious:	false
Reputation:	unknown
Preview:	{"country":"US","welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/stable/windows?utm_source=acro%26utm_medium=pb%26utm_campaign=cpdf_soft"}

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\7f78f78b-c964-478d-8da9-2dc635d492a3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	4.988353436821452
Encrypted:	false
SSDEEP:
MD5:	9B49836A9019036B726D02B1D06D0A86
SHA1:	2DD5F3A831ED22030C0635A838A5660A63AD0757
SHA-256:	DD96D20D82754776692C96BB7CF2CC015D1F112D1DDC80B1B163993842EC46B6
SHA-512:	875417602F1AED19E5D654AD721FA867BC1F553CB87823E54943A52F0F1F1F403CC527B42F4DA261C4AF7CED9D7D8B9AB898D62546241F5C5EB50A396B1DECBB
Malicious:	false
Reputation:	unknown
Preview:	{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,03b8357e5a08,06fbbd0b7bf7,1c4dddb65bac,1d24dceb937a,26000b66a01c,26f7e2d59ecf,278deecb29a1,3389f6c15eb9,3fc0872a857b,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,5a28d66c82cd,5aceda74693f,603cade21cf7,654296fe9d6c,6713f3df0bed,6a00b9093bf4,7e93fef4a11d,804beb213cf7,818c3ef12d0b,970fe421a344,9a48123ec9e3,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c25d6d8d2719:disabled,c57119eb4723,c6dc56485f2e,c73cad8a4668,c9a44eaecc11,cb479f6a3f5d,cbc43aa3cfb6,d144067b33ec,d4260daf5dd9,e29359b2d759,e2c9ffba8439,f3834d6657d8,f824dfec6894,fc82980101cd,fda8dc4bd759","remote-features-guid":"07e54957-ef59-4f0c-86ff-f839f55ee19b","welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/st

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\Opera browser.lnk

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Apr 17 19:42:21 2024, mtime=Wed Apr 17 19:42:21 2024, atime=Thu Apr 11 06:46:32 2024, length=1581984, window=hide
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	4.909321732813992
Encrypted:	false
SSDEEP:
MD5:	B372FB6372011621253BFC3F603E670C
SHA1:	8AD71EA23C496CB5DB96D230908A76D540C4480C
SHA-256:	7097A0DC59283DF93F5EAD232F61B1C14A2DFD4FEA69B2E85F5E9BA26BFA384B
SHA-512:	609D8F3DFE13D11CFC7F7CDD8E8706E1A3FFFB1ACC20DB75FB7144396B2727CBE81BF7B7B39C97807EC27AC6166455160EA1F6FF69F45334CBDE034B9422008F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....@......@.....z.G_....#........................:..DG..Yr?.D..U..k0.&...&......vk.v.......y.....e..........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.............................%..A.p.p.D.a.t.a...B.P.1......X....Local.<......CW.^.X......b.....................O&/.L.o.c.a.l.....Z.1......X...Programs..B......X...X............................:s.P.r.o.g.r.a.m.s.....P.1......XK...Opera.<......X*..XK......C......................9.O.p.e.r.a.....\.2..#...X.= .opera.exe.D......XK..XK............................=..o.p.e.r.a...e.x.e.......d...............-.......c..............o.....C:\Users\user\AppData\Local\Programs\Opera\opera.exe..$.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.\.o.p.e.r.a...e.x.e.+.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.............:...........\|....I.J.H..K..:...`.......X.......849224...........hT..CrF.f4... ..........,.......hT..CrF.f4... .....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\additional_file0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2569880
Entropy (8bit):	7.994542409084778
Encrypted:	true
SSDEEP:
MD5:	15D8C8F36CEF095A67D156969ECDB896
SHA1:	A1435DEB5866CD341C09E56B65CDDA33620FCC95
SHA-256:	1521C69F478E9CED2F64B8714B9E19724E747CD8166E0F7AB5DB1151A523DDA8
SHA-512:	D6F48180D4DCB5BA83A9C0166870AC00EA67B615E749EDF5994BC50277BF97CA87F582AC6F374C5351DF252DB73EE1231C943B53432DBB7563E12BBAF5BB393A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................$(......................................b........................'..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\additional_file1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1558464
Entropy (8bit):	7.989755786519264
Encrypted:	false
SSDEEP:
MD5:	C1B0681E1041A881F378D703BCD62D3B
SHA1:	3F11F065B8329E079F8DDD4DB3F876BFED9E68AC
SHA-256:	C622D0A631A3510E149520C0B9D03BD42CEC098812A3D6161F97B0982248F9D7
SHA-512:	42EA37415C869A1368549299E4A04DF8E709C6F8C8B484DC7BCF8B0EB2E8D239D760C582240FECEA674D4023462686A37B50E5B1E3CD9A77AF7F6D8738A431BE
Malicious:	false
Reputation:	unknown
Preview:	Cr24....E.........0.."0....H.............0............c6....'P...xnv..5._k.....a.3Bp&....?.u.#....w[...h..T..tAL.01.Z8.Q..=...0.....A..\|..M. N.s...U..+.ej\|J.c..b..ZO..].n.1\i.I.0..=E..^..WO.#......#UZ.x=.%WD%.d~....R...4...y.E...3<Xa-...&#.+{.Y.:hA.;C..n...[.?V$$..:d.....,......r.3C.e.CV..d...............Z.p.........O.KU.-.v....7b...KS....N~..q.A..............h.y.y...j..eA]>.^..k3...<...NM...`UB!V.A.=.[...m^.x...qn.pL...B...v....N.S3..&..~.......Lw...\......iAJ...h$......n.J.P..@Fj....+....M.!y.vd.T.x.B......8.)}.4;)u.X..t..}d...H.>.......G.......a.......PK..-......b.Xk.s"....S.......0d406bdcf61e6d381f23.svg......................Mo.........E:.Y.....bNB../.......$A.E...U=K...C..vjz............x..py.C.-.............;X`A[.OW......n.........p........x.q{........../?.\|..8\|..._Owq.....W?._..............4........7....r.x.{.......... b...\|..l};........H..U...-< ....&..r.Xx.rZ]..W..A.{.G]..s...d5..."C..W..I5...:....=.......D...9 .6...-6.0.cgYb...S~

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\additional_file2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Google Chrome extension, version 2
Category:	dropped
Size (bytes):	7122746
Entropy (8bit):	7.999414748600489
Encrypted:	true
SSDEEP:
MD5:	2C461151F9FFFF27314EBFFFE3C4CCF3
SHA1:	B52EBA8C0AF62AF12B358A507D23175ACBDD7D8B
SHA-256:	DEA799F75750F62A4491A81DF7F2C9ADF7B4C6D05D0B0BE9060686C1231C85F0
SHA-512:	CAD5B537FC21C9913A6F53AA25AABA6176A9A62F34A47D19BB23E38CDA5F73C6CAC769C4A2D509EBEAE8ABF424F576D95F9B549122B22634E81C1150AB20E533
Malicious:	false
Reputation:	unknown
Preview:	Cr24....&.......0.."0....H.............0...........)..^.+..#.5.4o.@4.u%'.i..[....+..<.M..>....._..!....\|.k...F...xL....{.`..}..".Be....r.y..D.....%.'F.....~....b!e...0I..g.E.U3.......1...$.9....".M.T7~;..rTTA......\|.c..e4..V.).7.mE..... U.0!......y<.3...G.jC...x..O=....l..\|.y.$2..nm._1.......[X.......m..x.N...p.Z.\|9W..4.iQy..g...VL`.9...;[.~.....q.VJ........i.,SH?w.M.\U.moS.4=n?.Q5.]..m.-.:.."...;...SD.~.....[..1$.Po......8.dY.U.....2.lM6&.O..n.o.V.....xB..k.D......\.M].0..g....q...X>...a.-9..GpeA.1g.w.F9.&.q.'..T..<..1w..[.&PK.........~.Xs....^'.........aria.js.k{.8.0.....E.3.-J!..d........Nz.=^.%Q6#.TH.ck.....o.....y3.....B.P(....?.U..A.uF...........]...+V.X./a......z..?>...&.o.ye.!...n..b............m.R.s...wD..E9.].h.G..0Gh..#...X..){.].8..@...5....}._........qh.R...\|..".4%.c4:#.U......F...O..6:..X.;R......c..D?..Cg\.....Y..F....JV.H.+J.....VY......oW.....8;6..q_.&..5....j4FV.......v..qc8...N.'.TYV.C..WWw.p..r5........v..

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2569880
Entropy (8bit):	7.994542409084778
Encrypted:	true
SSDEEP:
MD5:	15D8C8F36CEF095A67D156969ECDB896
SHA1:	A1435DEB5866CD341C09E56B65CDDA33620FCC95
SHA-256:	1521C69F478E9CED2F64B8714B9E19724E747CD8166E0F7AB5DB1151A523DDA8
SHA-512:	D6F48180D4DCB5BA83A9C0166870AC00EA67B615E749EDF5994BC50277BF97CA87F582AC6F374C5351DF252DB73EE1231C943B53432DBB7563E12BBAF5BB393A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................$(......................................b........................'..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998752
Entropy (8bit):	6.733167119600602
Encrypted:	false
SSDEEP:
MD5:	976BC8E5FE65F9BB56831E20F1747150
SHA1:	F9E7F5628AAAABED9939EF055540E24590A9CCFB
SHA-256:	F53C916CCF3D24D6793227283DE2DB0F6CC98A2275413851807CC080643D21A0
SHA-512:	2858E7E08418B170B21B599AFB02236D0480D35A5605DE142F10976489E01DAF2AD80DF0F09C2EB38BC5A971336D1F6AA9909C520BCDB18E9C9A8E903379DCD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."...............................@.................................r.....@.........................s...\.......@....................V...)......\|...\|..............................(...........................@....................text...u........................... ..`.rdata..Tc.......d..................@..@.data...xg...@...>... ..............@....tls....]............^..............@...CPADinfo0............`..............@....rsrc................b..............@..@.reloc..\|............d..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\browser_assistant.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3968928
Entropy (8bit):	6.748605019541295
Encrypted:	false
SSDEEP:
MD5:	37D5952B8EF15BD4D9E0DC2C00288512
SHA1:	8E79A7F3A0889E3EC84776F3FC7AD6881F26464F
SHA-256:	DD3B92A48D633B81F37BBDDBC88A2E90FE4DE78ED9D62AE3D13045D045970F8A
SHA-512:	3E3801038F1887DCBCA92711EDE3A581C914E4227E0490528BF430C0EDAE57D2E7247E9E705F5047B241989E9ED0DE14EEEC2F7AC1F0B41AFED65F87C2BB04FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."......./..........l'...........@...........................=.....~Z=...@.........................Kk7.Z....k7.......9.X............f<..)...`<.x....77......................67....../..............t7......j7.@....................text...[./......./................. ..`.rdata......../......./.............@..@.data....\|....7..D....7.............@....rodata......P9.......8............. ..`.tls....E....`9.......8.............@...CPADinfo0....p9.......8.............@....rsrc...X.....9.......8.............@..@.reloc..x....`<.......:.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\dbgcore.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170432
Entropy (8bit):	6.683199509575193
Encrypted:	false
SSDEEP:
MD5:	9EBB919B96F6F94E1BE4CDC6913EF629
SHA1:	31E99AC4FBA516F82B36BD81784E8D518B32F9DF
SHA-256:	FDAE21127DEB16EB8BA36F2493D2255F4CB8AB4C18E8BD8BA5E587F5A7ECD119
SHA-512:	A1B42F7D2896DA270BB3C80CF9B88C4B4F1491084E7AA7760EEEA5533B26F041DC79B21D5FFD2BBA2221FE118E0A8D912E170F24FD895C9315B1EE9C7ADFE700
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.ASg./.g./.g./.,...e./.n...N./.g...../.,.,.`./.,.*.h./.,./.f./.,.'.u./.,...e./.,.+.l./.,...f./.,.-.f./.Richg./.........PE..L.....e............!.........P......0................................................n....@A........................p...q....".......`...............J...O...p......Pb..T...............................@............ ...............................text............................... ..`.data...`...........................@....idata....... ......................@..@.mrdata......@......................@..@.rsrc........`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\dbghelp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792408
Entropy (8bit):	6.571517887718647
Encrypted:	false
SSDEEP:
MD5:	544255258F9D45B4608CCFD27A4ED1DD
SHA1:	571E30CEB9C977817B5BBAC306366AE59F773497
SHA-256:	3B02FC85602E83059F611C658E3CAD6BC59C3C51214D4FE7E31F3AC31388DD68
SHA-512:	2093DA881FA90EEC2B90D1CA6EAAFF608FE16AC612571A7FD5ED94DD5F7FF7E5C1E8C862BAB0A228850829527886473E3942ABD23A81D10CAB8F9BAAD2CC7664
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.0.Y.c.Y.c.Y.c&..b.Y.c&..b.Y.c.!.b.Y.c.!.c.Y.c.Y.c.\.c.!.b.Y.c.!.b.Y.c.!.b.Y.c.!ic.Y.c.!.b.Y.c.!.b.Y.c.!kc.Y.c.!.b.Y.cRich.Y.c................PE..L...q..`...........!.....F...\.......3.......`............................................@A........................ 9..e...Td..........P................O..............T...............................@............`..L....8..`....................text....E.......F.................. ..`.data........`...^...J..............@....idata... ...`..."..................@..@.didat..............................@....mrdata.............................@..@.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\files_list

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.239080933995437
Encrypted:	false
SSDEEP:
MD5:	CB95EF9858DFDDDC30E778B8A1E4579B
SHA1:	A5BB3E986FBE3EDF1731D3B711131E460B7E513B
SHA-256:	BC80A73499325898C0864511EE9F47C085EF8265E27524250ED862EA292A2443
SHA-512:	7615766EB7A095CAD7A0365820E6DF94B65D2BE5EDA3354A63AF6477CE7F3FFCD17B5E11F06C1C8B1345FA6308619B575D4E5662BA286644B6997FB47C340B84
Malicious:	false
Reputation:	unknown
Preview:	assistant_installer.exe..browser_assistant.exe..dbgcore.dll..dbghelp.dll..mojo_core.dll

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\launcher.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852832
Entropy (8bit):	6.627690092517354
Encrypted:	false
SSDEEP:
MD5:	4DAF686ED470614C4AA2175690557D46
SHA1:	8EE56AB30CD5A54B79921E5405A9B7E1B8C15379
SHA-256:	41F7BD06701F84AE8A00BAA0E084A00FBA0DE885E8B2CE10AA8D220D8A251EAD
SHA-512:	5E6BAE0085071FB48F7ED17C313CB23CD573FD6A9BB83EA6176D367F6C0C7CE3E68085C54E33915A0A70F3C4659EFF1D39E0226C88127B0BF52EA75350D46607
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."...............................@..................................9....@.........................4...b.......T........................)......D...,...............................X...............@...T............................text...f........................... ..`.rdata..............................@..@.data....^.......4..................@....tls.........p.......,..............@....rsrc...............................@..@.reloc..D............@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\mojo_core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1300384
Entropy (8bit):	6.822627271183708
Encrypted:	false
SSDEEP:
MD5:	AC6617579B0441E7EE9FB25287011FBB
SHA1:	1597E91DF55C4534CBDC174EF879E66AD40F3C1F
SHA-256:	7FA2B189CB333C09072F14B26DDED4F9D80E968E5624954726DE1C17F1EAC22B
SHA-512:	E78FD9E810ECE0B74B95513BF9159DC695E3110605E20919A9056C13801668B7BB6F15B8DCB44E0E1AC00761DEFC441DA00807E811DC8F062102A99B11747CEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...zL.f.........."!.................l....................................................@A............................p...d........`...................)...p............................ .......0................................................text............................... ..`.rdata..D...........................@..@.data...\O.......4..................@....tls.........@......................@...malloc_h.....P...................... ..`.rsrc........`......................@..@.reloc......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\be76331b95dfc399cd776d2fc68021e0db03cc4f.crx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	Google Chrome extension, version 2
Category:	dropped
Size (bytes):	7122746
Entropy (8bit):	7.999414748600489
Encrypted:	true
SSDEEP:
MD5:	2C461151F9FFFF27314EBFFFE3C4CCF3
SHA1:	B52EBA8C0AF62AF12B358A507D23175ACBDD7D8B
SHA-256:	DEA799F75750F62A4491A81DF7F2C9ADF7B4C6D05D0B0BE9060686C1231C85F0
SHA-512:	CAD5B537FC21C9913A6F53AA25AABA6176A9A62F34A47D19BB23E38CDA5F73C6CAC769C4A2D509EBEAE8ABF424F576D95F9B549122B22634E81C1150AB20E533
Malicious:	false
Reputation:	unknown
Preview:	Cr24....&.......0.."0....H.............0...........)..^.+..#.5.4o.@4.u%'.i..[....+..<.M..>....._..!....\|.k...F...xL....{.`..}..".Be....r.y..D.....%.'F.....~....b!e...0I..g.E.U3.......1...$.9....".M.T7~;..rTTA......\|.c..e4..V.).7.mE..... U.0!......y<.3...G.jC...x..O=....l..\|.y.$2..nm._1.......[X.......m..x.N...p.Z.\|9W..4.iQy..g...VL`.9...;[.~.....q.VJ........i.,SH?w.M.\U.moS.4=n?.Q5.]..m.-.:.."...;...SD.~.....[..1$.Po......8.dY.U.....2.lM6&.O..n.o.V.....xB..k.D......\.M].0..g....q...X>...a.-9..GpeA.1g.w.F9.&.q.'..T..<..1w..[.&PK.........~.Xs....^'.........aria.js.k{.8.0.....E.3.-J!..d........Nz.=^.%Q6#.TH.ck.....o.....y3.....B.P(....?.U..A.uF...........]...+V.X./a......z..?>...&.o.ye.!...n..b............m.R.s...wD..E9.].h.G..0Gh..#...X..){.].8..@...5....}._........qh.R...\|..".4%.c4:#.U......F...O..6:..X.;R......c..D?..Cg\.....Y..F....JV.H.+J.....VY......oW.....8;6..q_.&..5....j4FV.......v..qc8...N.'.TYV.C..WWw.p..r5........v..

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\c27c1215-5bff-4bef-aece-8fcb18dd5b5d.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.705089490861458
Encrypted:	false
SSDEEP:
MD5:	CCACA0A22EFA9B854A9DB58ED0BD4BE9
SHA1:	2AB980C8E76DD7B37BE104F7BE6F5063F34AE613
SHA-256:	D2985123073063278CC29D31F34AFC4709FC1F883215D63EBD92BC28D8974543
SHA-512:	AC28EE90A9D6C5427FA61CECE70A3EC50B32B7F5A51F1C4036FB5E94AB465BADDC9FEB0062558D7DF4D8FABA7F9DCCE1B87C7FDD495404F01DED14FCB7427B65
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/stable/windows?utm_source=acro%26utm_medium=pb%26utm_campaign=cpdf_soft"}

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\extensions_files_list

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.693534763242851
Encrypted:	false
SSDEEP:
MD5:	182D229C4E4E14D966B32FDDED79FF5F
SHA1:	5C917B696C70A52C6589015F44230D75AA0390F6
SHA-256:	D0E418D5567AC652972DC870594FCF6C454C337893D316CD7D478F6FCC76BDD6
SHA-512:	F805EAA805E496CCD9F91F48ED25890FED46D0D7EEE5372B46A84F30026DD37F56EEC49296E1B8F9DF91ABD789698966967ED46158E23C42F0F77803F616075A
Malicious:	false
Reputation:	unknown
Preview:	102.0.53-DNA-116018-opera_intro.crx..be76331b95dfc399cd776d2fc68021e0db03cc4f.crx..

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\extra_apps

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	2.701375755906049
Encrypted:	false
SSDEEP:
MD5:	922927F22EF5189300DB689F0C9EF022
SHA1:	359AB18960786773969268AA8920ED284C136DA0
SHA-256:	7FFF1AE3A38ACEED8DE26FE3DE3C43FDC2526210C3F225557EE3C8411175882D
SHA-512:	015B3384CF3CF62CACCD1F1B6DB04298BBE2E72DDE2618AD66F151EFFD3BFE8B062F24AA99E6F0ACBA57120E43B811CF782860FAD5FF46B391CC57A006C39FFB
Malicious:	false
Reputation:	unknown
Preview:	assistant:assistant..

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\installer_prefs_include.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.705089490861458
Encrypted:	false
SSDEEP:
MD5:	CCACA0A22EFA9B854A9DB58ED0BD4BE9
SHA1:	2AB980C8E76DD7B37BE104F7BE6F5063F34AE613
SHA-256:	D2985123073063278CC29D31F34AFC4709FC1F883215D63EBD92BC28D8974543
SHA-512:	AC28EE90A9D6C5427FA61CECE70A3EC50B32B7F5A51F1C4036FB5E94AB465BADDC9FEB0062558D7DF4D8FABA7F9DCCE1B87C7FDD495404F01DED14FCB7427B65
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/stable/windows?utm_source=acro%26utm_medium=pb%26utm_campaign=cpdf_soft"}

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\installer_prefs_include.json.backup

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	4.988353436821452
Encrypted:	false
SSDEEP:
MD5:	9B49836A9019036B726D02B1D06D0A86
SHA1:	2DD5F3A831ED22030C0635A838A5660A63AD0757
SHA-256:	DD96D20D82754776692C96BB7CF2CC015D1F112D1DDC80B1B163993842EC46B6
SHA-512:	875417602F1AED19E5D654AD721FA867BC1F553CB87823E54943A52F0F1F1F403CC527B42F4DA261C4AF7CED9D7D8B9AB898D62546241F5C5EB50A396B1DECBB
Malicious:	false
Reputation:	unknown
Preview:	{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,03b8357e5a08,06fbbd0b7bf7,1c4dddb65bac,1d24dceb937a,26000b66a01c,26f7e2d59ecf,278deecb29a1,3389f6c15eb9,3fc0872a857b,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,5a28d66c82cd,5aceda74693f,603cade21cf7,654296fe9d6c,6713f3df0bed,6a00b9093bf4,7e93fef4a11d,804beb213cf7,818c3ef12d0b,970fe421a344,9a48123ec9e3,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c25d6d8d2719:disabled,c57119eb4723,c6dc56485f2e,c73cad8a4668,c9a44eaecc11,cb479f6a3f5d,cbc43aa3cfb6,d144067b33ec,d4260daf5dd9,e29359b2d759,e2c9ffba8439,f3834d6657d8,f824dfec6894,fc82980101cd,fda8dc4bd759","remote-features-guid":"07e54957-ef59-4f0c-86ff-f839f55ee19b","welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/st

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\installer_prefs_include.json~RF67fecd.TMP (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.705089490861458
Encrypted:	false
SSDEEP:
MD5:	CCACA0A22EFA9B854A9DB58ED0BD4BE9
SHA1:	2AB980C8E76DD7B37BE104F7BE6F5063F34AE613
SHA-256:	D2985123073063278CC29D31F34AFC4709FC1F883215D63EBD92BC28D8974543
SHA-512:	AC28EE90A9D6C5427FA61CECE70A3EC50B32B7F5A51F1C4036FB5E94AB465BADDC9FEB0062558D7DF4D8FABA7F9DCCE1B87C7FDD495404F01DED14FCB7427B65
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/stable/windows?utm_source=acro%26utm_medium=pb%26utm_campaign=cpdf_soft"}

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\installer_prefs_include.json~RF67fedd.TMP (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.705089490861458
Encrypted:	false
SSDEEP:
MD5:	CCACA0A22EFA9B854A9DB58ED0BD4BE9
SHA1:	2AB980C8E76DD7B37BE104F7BE6F5063F34AE613
SHA-256:	D2985123073063278CC29D31F34AFC4709FC1F883215D63EBD92BC28D8974543
SHA-512:	AC28EE90A9D6C5427FA61CECE70A3EC50B32B7F5A51F1C4036FB5E94AB465BADDC9FEB0062558D7DF4D8FABA7F9DCCE1B87C7FDD495404F01DED14FCB7427B65
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=cpdf_soft&utm_medium=pb&utm_source=acro&http_referrer=&query=/opera/stable/windows?utm_source=acro%26utm_medium=pb%26utm_campaign=cpdf_soft"}

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\opera_package

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108893416
Entropy (8bit):	7.999992755622592
Encrypted:	true
SSDEEP:
MD5:	5014156E9FFBB75D1A8D5FC09FABDC42
SHA1:	6968D1B5CEC3039E53BBBEDEEE22E2D43D94C771
SHA-256:	7A01E11E1830BA3C154E5A6C383DA15938B1E48F89A2FE4045CDD260924B6802
SHA-512:	BFC5C44881D0FA7BCBCCFD530D874FA624ADEC50E1A16063A72DE12876D2DB10CA5EDD6FA841EA63E9DECA3FF2ADF54065F50719FE051D41DE92BB68EDBA4016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................z~......................................b......................Hk}..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\pref_default_overrides

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.2929876016942625
Encrypted:	false
SSDEEP:
MD5:	F488C9F9D9D5E631484D4BF155F45442
SHA1:	0F0E624770E47BEA5186748A9DE85C677DD84FA7
SHA-256:	E6F214FF5CCBBE6E7ABCF309138CDCB46D3FE3915E9BBBE8DD3C15AFB439F708
SHA-512:	D72D1DAA86E650A0589F6991F7A7BB3B7CA3484D49BC0D0D703B28B8F399F3123DF2BF3C949A899FAB55BDE7D888736F655E462E2CD02ADE59BBF9E67DF54064
Malicious:	false
Reputation:	unknown
Preview:	{. "Preferences": {. "ui.search_box_enabled": false. }.}

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\server_tracking_data

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (784), with no line terminators
Category:	dropped
Size (bytes):	784
Entropy (8bit):	5.674092363724188
Encrypted:	false
SSDEEP:
MD5:	1B695D382EB85471F6978A64E3A0585F
SHA1:	54D35AF5C218387505B82FE78703BDFA774706D8
SHA-256:	613CD969820BB721915475DE72544B9495345E0FC0A9792C579A06A1FDC75441
SHA-512:	A80AB8D36061CFF3A78ECFBB68758DE6815D176D17F176483B084031FE00E8382A08822615466ADAAA5412D92EB6F3F9957CE661D42C082BC099E25F52C1B53E
Malicious:	false
Reputation:	unknown
Preview:	YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224117808.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (1733)
Category:	dropped
Size (bytes):	9267
Entropy (8bit):	5.774737315451493
Encrypted:	false
SSDEEP:
MD5:	0325AFE2A60739C8AD3D89ACA8B76386
SHA1:	6D3A760B5D2A33A02AC0777A7A7310D309905270
SHA-256:	4B0732CCDF71A1861E21D137D997536EC6E82D712213921447BEB2511BF7B99D
SHA-512:	C30142BCC94C52D10E11B4396220A951B95D956C09D3DAA68F57C80A1D568F6E105895E2CE700C9471F8FAA61AE3DC91904394255FDBB55507DC33075B81E929
Malicious:	false
Reputation:	unknown
Preview:	[0417/224117.823:INFO:installer_main.cc(455)] Opera installer starting - version 108.0.5067.20 Stable.[0417/224117.823:INFO:installer_main.cc(458)] Command line: "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --silent --allusers=0.[0417/224117.823:INFO:installer_main.cc(480)] Uninstall:0.[0417/224117.823:INFO:installer_main.cc(481)] Silent:1.[0417/224117.823:INFO:installer_main.cc(482)] Run Immediately0.[0417/224117.823:INFO:installer_main.cc(484)] Backend0.[0417/224117.823:INFO:installer_main.cc(485)] Inside package0.[0417/224117.823:INFO:installer_main.cc(486)] Autoupdate:0.[0417/224117.823:INFO:payload_manager_impl.cc(97)] Reading Payload.[0417/224117.823:INFO:installer_main.cc(636)] Tracking data: MmUwNDU1ZDA5ZDY5ZmRjNjM1ZTIzNTQ0ODRhMmQwMmUyZjcwN2VjMjE2OTQ5MmNkY2FjOTM4OThmOGFlNzM3ZTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFp

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224119169.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	ASCII text, with very long lines (1733)
Category:	modified
Size (bytes):	5927
Entropy (8bit):	5.8186683991386055
Encrypted:	false
SSDEEP:
MD5:	13CABC7E8B55292ADDCC497C991122CE
SHA1:	3B18FD77646445AD20C251917CCF9D92FB05170F
SHA-256:	D436D906F78399A962A601A3C3DFB5B1BFED8CE83E7CD14CC3FB1DAE4FE782EE
SHA-512:	01C656F215AEE534D6516AB420A75A4B361DCEB693FA77B2DFA6FAADEAC640475FF57B36175A23945DA1A5D767BC11C6E9FF79D4931EDC910A76E40566E852A9
Malicious:	false
Reputation:	unknown
Preview:	[0417/224119.191:INFO:installer_main.cc(455)] Opera installer starting - version 108.0.5067.20 Stable.[0417/224119.191:INFO:installer_main.cc(458)] Command line: "C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2520 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240417224118" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob=YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiN

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240417224221297.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	ASCII text, with very long lines (1672), with CRLF, LF line terminators
Category:	modified
Size (bytes):	5168
Entropy (8bit):	5.622337602880182
Encrypted:	false
SSDEEP:
MD5:	E84436C13A9B579913D76DDB11DDA0B9
SHA1:	C2373986861EDECF1FEF4C68C96B800F2675EACA
SHA-256:	E9FBE5E4E03CF45E9BFBF8F51FA56B177CD9F28A3D35348D937736C06D8C8881
SHA-512:	A0C397EE8CA5B0B4F68DAAB98D0C29C2A1CF7C809F5227C72647ACBC78232D33A2318AFBF616CE345626CF048ED9813AE392C731B354CF148FB01F2B8AF354F3
Malicious:	false
Reputation:	unknown
Preview:	[0417/224221.297:INFO:installer_main.cc(455)] Opera installer starting - version 109.0.5097.45 Stable.[0417/224221.297:INFO:installer_main.cc(458)] Command line: "C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe" --backend --initial-pid=2520 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob=YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4M

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041166342520.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.87812852978897
Encrypted:	false
SSDEEP:
MD5:	779C1C638E20952796675075C11F3A79
SHA1:	020B073355CE3A02122F9C6BE61E86B9973CACD1
SHA-256:	6F7EE55B9F2018B33D251B9B6F736ACA25613C9571EBA02D40F479D8799CD848
SHA-512:	0DFE740C59083080677337B3F1514CC74E715F7F65BEEC49B986BC593D9D88CE7F90A7667419AF5B2E034AFADA2229113A0E54876ECAAF20DE4A2A76F75367C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e.........."!.....`3..z......@.'.......................................K.......J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041175667228.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.87812852978897
Encrypted:	false
SSDEEP:
MD5:	779C1C638E20952796675075C11F3A79
SHA1:	020B073355CE3A02122F9C6BE61E86B9973CACD1
SHA-256:	6F7EE55B9F2018B33D251B9B6F736ACA25613C9571EBA02D40F479D8799CD848
SHA-512:	0DFE740C59083080677337B3F1514CC74E715F7F65BEEC49B986BC593D9D88CE7F90A7667419AF5B2E034AFADA2229113A0E54876ECAAF20DE4A2A76F75367C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e.........."!.....`3..z......@.'.......................................K.......J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041180917624.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.87812852978897
Encrypted:	false
SSDEEP:
MD5:	779C1C638E20952796675075C11F3A79
SHA1:	020B073355CE3A02122F9C6BE61E86B9973CACD1
SHA-256:	6F7EE55B9F2018B33D251B9B6F736ACA25613C9571EBA02D40F479D8799CD848
SHA-512:	0DFE740C59083080677337B3F1514CC74E715F7F65BEEC49B986BC593D9D88CE7F90A7667419AF5B2E034AFADA2229113A0E54876ECAAF20DE4A2A76F75367C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e.........."!.....`3..z......@.'.......................................K.......J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041185797716.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.87812852978897
Encrypted:	false
SSDEEP:
MD5:	779C1C638E20952796675075C11F3A79
SHA1:	020B073355CE3A02122F9C6BE61E86B9973CACD1
SHA-256:	6F7EE55B9F2018B33D251B9B6F736ACA25613C9571EBA02D40F479D8799CD848
SHA-512:	0DFE740C59083080677337B3F1514CC74E715F7F65BEEC49B986BC593D9D88CE7F90A7667419AF5B2E034AFADA2229113A0E54876ECAAF20DE4A2A76F75367C8
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e.........."!.....`3..z......@.'.......................................K.......J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172041189647756.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.87812852978897
Encrypted:	false
SSDEEP:
MD5:	779C1C638E20952796675075C11F3A79
SHA1:	020B073355CE3A02122F9C6BE61E86B9973CACD1
SHA-256:	6F7EE55B9F2018B33D251B9B6F736ACA25613C9571EBA02D40F479D8799CD848
SHA-512:	0DFE740C59083080677337B3F1514CC74E715F7F65BEEC49B986BC593D9D88CE7F90A7667419AF5B2E034AFADA2229113A0E54876ECAAF20DE4A2A76F75367C8
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e.........."!.....`3..z......@.'.......................................K.......J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172042207667120.dll

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5921696
Entropy (8bit):	6.635638994829727
Encrypted:	false
SSDEEP:
MD5:	298C6166F09297B22FBCF2E4E110BF34
SHA1:	DD50EC5FEEFCD23B801AFA2F6225A586DF5E41DE
SHA-256:	87B862FE32956EC92A6B258A485DC05868FEA431A130F4085B267E1CA34EABCD
SHA-512:	330E399EEB3B75012763A07E21C478DC8F04D8B858BFEA5138BBA1DBF5EB8566CD1DCE8F569DF649707B7C07C3F69FF59FAA3B8EEF3DD64F01E8A68377E909D0
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ......@..\|......p/1.......................................\....../[...`A.........................................xI.m...pxI.......O..4....L.D....2Z..)....[.<<...9I.8....................8I.(.....@.@.............I. ....wI.`....................text....@.......@................. ..`.rdata........@.......@.............@..@.data....;....J.......J.............@....pdata..D.....L.......K.............@..@.gxfg....4....N..4...jM.............@..@.retplne......O.......M..................rodata...... O.......M............. ..`.tls....q....0O.......M.............@...CPADinfo@....@O.......M.............@...LZMADEC......PO.......M............. ..`_RDATA..\....pO.......M.............@..@malloc_h......O.......M............. ..`.rsrc....4....O..6....M.............@..@.reloc..<<....[..>....Y.............@..B........................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2404172042210696156.dll

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5921696
Entropy (8bit):	6.635638994829727
Encrypted:	false
SSDEEP:
MD5:	298C6166F09297B22FBCF2E4E110BF34
SHA1:	DD50EC5FEEFCD23B801AFA2F6225A586DF5E41DE
SHA-256:	87B862FE32956EC92A6B258A485DC05868FEA431A130F4085B267E1CA34EABCD
SHA-512:	330E399EEB3B75012763A07E21C478DC8F04D8B858BFEA5138BBA1DBF5EB8566CD1DCE8F569DF649707B7C07C3F69FF59FAA3B8EEF3DD64F01E8A68377E909D0
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...zL.f.........." ......@..\|......p/1.......................................\....../[...`A.........................................xI.m...pxI.......O..4....L.D....2Z..)....[.<<...9I.8....................8I.(.....@.@.............I. ....wI.`....................text....@.......@................. ..`.rdata........@.......@.............@..@.data....;....J.......J.............@....pdata..D.....L.......K.............@..@.gxfg....4....N..4...jM.............@..@.retplne......O.......M..................rodata...... O.......M............. ..`.tls....q....0O.......M.............@...CPADinfo@....@O.......M.............@...LZMADEC......PO.......M............. ..`_RDATA..\....pO.......M.............@..@malloc_h......O.......M............. ..`.rsrc....4....O..6....M.............@..@.reloc..<<....[..>....Y.............@..B........................................................

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\EndOfTask.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	EB43845F541811F33B8888493929F08C
SHA1:	C15FC8D01B7891A5BF788D0AC2C1E682C562CB09
SHA-256:	B80D00FF2021D295C1D7AC48B7F3B9D2C3B33094FC76E5739DB883E3A2D63C3F
SHA-512:	84DCAC5F6C9B8C84B5B5E96FD91817FC58215AB04E68C5CAB5B96FD2FF379C812863F3D5147AEBA02B9AD12DA8F89D8D1FDAFDC41853EDEF92D92889DB2DF2BA
Malicious:	false
Reputation:	unknown
Preview:	..

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\FAPIconfig-FCO

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	708
Entropy (8bit):	4.7434588498172285
Encrypted:	false
SSDEEP:
MD5:	165EEBE8E6B7B1C8B272F4CED0204EBC
SHA1:	39ABFF51DE5DD4FA2754ADB6CBFF2A5077E7C1E6
SHA-256:	2549DE77A127CB2160BBC97661781F392CC490147D1D9B04719BB4D8A7DCE49A
SHA-512:	71F51BA626039377F63B2661C59FC74A1B39FA2AC5FCCA9DD1F572B1F6ACBD8281A13743170A86735711DF3AE063D71AD550158FD6C1EBDD63C232C6264F015A
Malicious:	false
Reputation:	unknown
Preview:	%!.% This is configuration file for FAPI client.../FontPath () % A default directory for FAPI-handled font files path in FAPIfontmap../CIDFontPath () % A default directory for FAPI-handled CID font files path in FAPIcidfmap../HookDiskFonts [] % FontType values for disk PS fonts to be redirected to FAPI../HookEmbeddedFonts [] % FontType values for embedded PS fonts to be redirected to FAPI...% Values allowed for HookDiskFonts and HookEmbeddedFonts are 1, 2, 9, 11, 42..% "Disk fonts" are fonts being installed to Ghostscript with 'lib/Fontmap' or with GS_FONTPATH,.% and CID font resource files..% "Embedded fonts" are fonts and CID fonts being embedded into a document...

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\FCOfontmap-PCLPS3

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5654
Entropy (8bit):	4.747691010227629
Encrypted:	false
SSDEEP:
MD5:	ADD802A0781787F41340727756DBF3A3
SHA1:	E522AE60B230C94BB0EF67E075EF1BC56B9C26A3
SHA-256:	40F09B0F0EDA358971CCDDA55D81EEB4E6156E2AB4740924F7A03A5F390B2EE2
SHA-512:	2BED7A5023E9FF80F02567BD9484EDBB19FC1A5DF169D69AF31AC0DB3B791F8EECDA59CA6C0F8A95E824779414F9EF0D7BB351768F3DDDD18E2E13F155601DCC
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%...% May add general FAPIfontmap records here like this :./Wingdings-Regular << /Path FCOfontfile2 /FontType 1 /FAPI /UFST /SubfontId 0 /Encoding /Wingdings /Decoding /FCO_Wingdings>> ;..% Mapping Postscript fonts to pclp2_xj.fco FCO members :.FCOfontfile ReadFCOfontmap:.0 Albertus-Medium.1 Albertus-ExtraBold.2 AntiqueOlive.3 AntiqueOlive-Italic.4 AntiqueOlive-Bold.5 Arial.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\FCOfontmap-PS3

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4239
Entropy (8bit):	5.02012376716601
Encrypted:	false
SSDEEP:
MD5:	E6F104A351AD64AA6C95CF27E1EC6AF7
SHA1:	C2C11A116747115B5F2530A6B94A7CF02E480DC4
SHA-256:	1DAADF5AA5246EDEC938F329F2C7DF7E7524C7D1D254A6C307D86BCF1AC2C406
SHA-512:	3615BA879F50083C838E2BC0E05D1AB51A69C1B28D5C08887AEB47822FD2341394033D5100005CCA377242B3A1F63EE22490938FA98F50440468760BBEE3EB9D
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%...% May add general FAPIfontmap records here like this :./Wingdings-Regular << /Path FCOfontfile2 /FontType 1 /FAPI /UFST /SubfontId 0 /Encoding /Wingdings /Decoding /FCO_Wingdings>> ;..% Mapping Postscript fonts to ps3___xh.fco FCO members :.FCOfontfile ReadFCOfontmap:.0 AlbertusMT-Light.1 AlbertusMT.2 AlbertusMT-Italic.3 AntiqueOlive-Roman.4 AntiqueOlive-Italic.5 AntiqueOlive-Bold.6

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.ATB

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5774
Entropy (8bit):	5.353581984271784
Encrypted:	false
SSDEEP:
MD5:	6E6866F5CBA32AFAA90076BC71A5EEEE
SHA1:	B0756D990492A18FE8189195B4CFA000CA5A9E6C
SHA-256:	A9CC725383C87ED5F81DE22A1EAABBB8FE3252972CFFF96F9F8C70EF48A22CB9
SHA-512:	285BEECD4583DB135D755B3155A29536EC7143E8E16FD20ADAAAE9C1D35B5FB4FDC090CDAF58DC6C3688F3CABA6E0FEB016EA278D3EAB818B5AB5C1767ADDF2A
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Fontmap.ATB - an alternative Fontmap for Ghostscript,.% suitable for use with the 65 Adobe Type Manager fonts .% supplied with Adobe Type Basics...% Before you use ATM fonts with Ghostscript, please read carefully.% the license that accompanies the ATM fonts; neither Artifex Software Inc.% nor any other distributor of Ghostscript takes any responsibility for.% any possible violations of such licenses...% The 65 Adobe

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.ATM

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5533
Entropy (8bit):	5.461505471720045
Encrypted:	false
SSDEEP:
MD5:	4028F5B12F17CA86C71D58394AC4712E
SHA1:	7A9DEA59E832C6626813082E7920ED3AB9101326
SHA-256:	0977191623959CF2DC02148FAE19080320115963416A5B805DE8359FA1D0CFD1
SHA-512:	C4C5EDF7631EB2B942A77D5174311D446DA6028A6C2997E8DF9D968759C47DB3BFBC5263A409218623A7F3483CC5E598BD3A6957CA64A1E0B37F32BDC677CDAF
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Fontmap.ATM - an alternative Fontmap for Ghostscript,.% suitable for use with Adobe Type Manager fonts...% Before you use ATM fonts with Ghostscript, please read carefully.% the license that accompanies the ATM fonts; neither Artifex Software Inc..% nor any other distributor of Ghostscript takes any responsibility for.% any possible violations of such licenses...% ..%.% Fonts contributed by:.%.URW++ Design and Develo

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.OS2

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7115
Entropy (8bit):	5.314765777935948
Encrypted:	false
SSDEEP:
MD5:	5FB15C094EE44DC99372D53ADE26191F
SHA1:	41B8EB776014D996369D09CFF0048ECCF605CDF8
SHA-256:	44D8897657C4FA5063F4BE23982725DFCEE8909880EA58DF4FD392C9A056C217
SHA-512:	4267E0F594F8919085A508ED263953F3E23A1DCD7C2E1AF307CC624037614A0AB2B520D9D8140B56556B8D27AC38954DD3D6507AEE9AFAA90073BB962B7C00E2
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% fontmap.os2 aka Fontmap.OS2 - OS/2 font catalog for Ghostscript...% ----------------------------------------------------------------..% This file is a catalog of fonts known to Ghostscript. Any font.% that is to be loaded automatically when named must be in this catalog,.% except for fonts that Ghostscript finds automatically in directories.% named in the GS_FONTPATH environment variable...% Each font has an entry c

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.OSF

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6532
Entropy (8bit):	5.2161438792274675
Encrypted:	false
SSDEEP:
MD5:	E8BF5448D47E4C584A69D02B6CF68361
SHA1:	AF33FB0E9087344CC818C04BE0CEFCABFA68014D
SHA-256:	19ACAF3324011834072FEAE7857D8171012CB4598A2FBA9251763AD174B2612F
SHA-512:	F8F4CBE501EA73151638EF8F1D46755DDCFDECEA29CDA9555C09D61D1D55B872E165C7BD489B65532F3B185126E153FB25B1EC9CAE60077A37BD6D4CDF30D690
Malicious:	false
Reputation:	unknown
Preview:	% fontmap.osf aka Fontmap.OSF1 - Ghostscript fontmap for DEC OSF/1 systems..%.% UNIX systems from Digital Equipment Corporation are bundled with a license.% for Display PostScript, including certain fonts. Using their font outlines.% (which on OSF/1 systems are found in /usr/lib/X11/fonts/Type1Adobe).% improves the visual quality of documents displayed on screen. To do that,.% use this file as your Fontmap file and add /usr/lib/X11/fonts/Type1Adobe.% as the second argument to GS_LIB_DEFAULT in your makefile.% in your makefile..%.% This file is Pete Kaiser's original Ultrix file as modified by.% Bjorn S. Nilsson (nilsson@nbi.dk) first for Ultrix 4.3 and then.% for OSF/1 version 1.3..%..%/AvantGarde-Book...(AvantGarde-Book).;.%/AvantGarde-BookOblique..(AvantGarde-BookOblique);.%/AvantGarde-Demi...(AvantGarde-Demi).;.%/AvantGarde-DemiOblique..(AvantGarde-DemiOblique);..%/Courier-BoldItalic.../Courier-BoldOblique.;.%/Courier-Italic.../Courier-Oblique.;..%/Courier....(Courier)..;.%/Courie

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.SGI

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13646
Entropy (8bit):	5.263514421591994
Encrypted:	false
SSDEEP:
MD5:	F4ACD4DCC4AC35EC1E81BB00960D2CA5
SHA1:	F74EDDB358AC149B3A3E2DEBE8DF5D5BEB88DB1E
SHA-256:	386C7CC0A11054D6211D48BD078FA91288A33CD00460D99E56C7EA7609118784
SHA-512:	A7737B1DAC9E4B7D975880CD6F0FBE887A0EE5A5D7984417A6B5DF65A3FA9D5397F44CBC445BAF66C0A0D050C0C54C94C1DEB18307511560E44AFF49A3EBDCF3
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..%.% Fontmap.SGI - standard font catalog for Ghostscript, modified for IRIX 5.3.% with the DPS fonts installed (dps_eoe.sw.dpsfonts)..% by H. Gohel, gohel@acm.org. 1999-09-10..% ----------------------------------------------------------------..% This file is a catalog of fonts known to Ghostscript. Any font.% that is to be loaded automatically when named must be in this catalog,.% except for fonts that Ghostscript find

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.Sol

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16325
Entropy (8bit):	5.290652754985908
Encrypted:	false
SSDEEP:
MD5:	A168EC1E5B2A68A119C2D9A3D5765B3B
SHA1:	E7504014C2FC9F1029A0F4906A583352129489B0
SHA-256:	E63645698245BE805488DDD925D5E64433A58B58B1EA1B0914C7B4A706FB7336
SHA-512:	39D36CF048A72C6829DB2797898483FF3C00C7013B48382D75EBF29589F76F3EA996D8925AE356252F23A4D24A94CBDE0C33133C164E5FC00B2D1E2B9D6A8DE4
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Fontmap.Solaris - Ghostscript Fontmap for Solaris 2.3 and above.% ===============================================================.%.% The Solaris 2.3 (and above) operating system from Sun Microsystems comes with.% Display Postscript (DPS), including certain Type1 and Type3 PostScript fonts..% Using these fonts instead of the default Ghostscript fonts greatly improves.% the visual quality of Ghostscript rendered docum

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.URW-136.T1

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20566
Entropy (8bit):	5.382038123653988
Encrypted:	false
SSDEEP:
MD5:	1A7441D520788033F8F6579750E1CDA0
SHA1:	F48CF65FCC3C74ADD642F41DA2EB762497DF15AE
SHA-256:	AA1A39CFD4C8BB9231EAB99A3E8722AC8C0A986A0729E94AD6F8989FC9DB73A5
SHA-512:	08029E44D9F06E59A6CBB426409169395760023219B4B517EF2AE2C5427DE88D2D60A566A84AB662A657A658984304F70BF825703958A461AFD5C3F28BD3409A
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% $Id: Fontmap.GS 8978 2008-08-12 23:44:53Z ray $.% Fontmap - standard font catalog for Ghostscript...% ----------------------------------------------------------------..% This file is a catalog of fonts known to Ghostscript. Any font.% that is to be loaded automatically when named must be in this catalog,.% except for fonts that Ghostscript finds automatically in directories.% named in the GS_FONTPATH environment var

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.URW-136.TT

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20429
Entropy (8bit):	5.361867463999675
Encrypted:	false
SSDEEP:
MD5:	1CBC2A8723F9C54C4A2C99D331CD7E45
SHA1:	E491B487910FC68EADABAFE233B1C822F0F71FC9
SHA-256:	8140985E9404B7C20817C36B6651B22333B75B9E531601B44DB34AE396573DF5
SHA-512:	2056216BB1CB23C000382B723CB64412F21490EC52FECB76865B47A39CD6B6881391D20C1D701F964D3B7AB174DAE128009DE5939C4D3B19921A0F7393CA0F28
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% $Id: Fontmap.GS 8978 2008-08-12 23:44:53Z ray $.% Fontmap - standard font catalog for Ghostscript...% ----------------------------------------------------------------..% This file is a catalog of fonts known to Ghostscript. Any font.% that is to be loaded automatically when named must be in this catalog,.% except for fonts that Ghostscript finds automatically in directories.% named in the GS_FONTPATH environment var

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.Ult

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5931
Entropy (8bit):	5.263295092080524
Encrypted:	false
SSDEEP:
MD5:	688E780C39502A505B201913B49409E6
SHA1:	E70B6AC8735634FE74480DB9F58EEBBB2BB9CCE0
SHA-256:	55A61E0773B763F64555CFF63B87282B2437CC24EFCB6926F14C4FD7EA94BA70
SHA-512:	ACA3AE51AF0E74609017119520006FED809A0841AB949767A28AC5D9C5A35AD06F5DE265E58917319CD2627C67256113D52250E30288A4DC0E9C13589FEF1B5F
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Fontmap.Ult is derived from the standard Fontmap file distributed with.% ghostscript; for credits and sources see that file. The modifications here.% are valid for ULTRIX 4.3, and consist of defining some fonts and font.% aliases as the licensed fontfiles included in ULTRIX for use on ULTRIX.% workstations, which give better quality than the free fontfiles available.% for ghostscript. Under ULTRIX 4.3 the licensed

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Fontmap.VMS

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14986
Entropy (8bit):	5.581366035103242
Encrypted:	false
SSDEEP:
MD5:	AA5249F3382117A599A45E542C4E10A2
SHA1:	6794A6414587B1B14B67B9DFDF79651C3F75D799
SHA-256:	07BEB1A8EE7E030B1F0D98A480102714D4C9A863C56000BE13F527A33E798D7F
SHA-512:	BB1D1749EF678FBF85CECD0501C62C9F648CA34D5A6752160E586EA1AF64F2543004DC8A3A817CE816076097C2DA50B7515418DDACB0ABB89F97EC36B88BBA02
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%.% fontmap.vms - Ghostscript fontmap for VAX/VMS systems with DECwindows/Motif..%.% Mathog, 14-SEP-2000. Modified slightly from that provided by 6.01..% Changed to use Courier font from Decwindows instead of Ghostscript.% The hershey fonts are listed, but they are not constructed during a regular.% build of the package..%.% **************************.%Uses all the XDPS Outline fonts (Type 1 fonts) provided with Motif..%

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\Info-macos.plist

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	469
Entropy (8bit):	4.927281988320457
Encrypted:	false
SSDEEP:
MD5:	4406859B1D2408C0D7A4CC1DDA1FE7D1
SHA1:	4478D56594EEF2ECCF363ED299A094F4582B0406
SHA-256:	AB80C3A33EF1C7BDC4ACC4A4BDF1BE630AEFEE91F711B885F8E9B09B8FC6BBE4
SHA-512:	217DA4B9DA74FB9D7F0507789BEE7DAF1292D512A5B82B7FA044B1C903682B9AF6770CFB3B70F67A0424C5A889A7C3E6964A1BA57EE4FD8B5C354C94F8245D3B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">.<plist version="0.9">.<dict>. <key>CFBundleIdentifier</key>. <string>com.ghostscript.Ghostscript</string>. <key>CFBundleName</key>. <string>Ghostscript</string>. <key>CFBundleShortVersionString</key>. <string>703</string>. <key>NSExecutable</key>. <string>Ghostscript</string>.</dict>.</plist>.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\PDFA_def.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	4.938684786528842
Encrypted:	false
SSDEEP:
MD5:	8D8081103CE37D764FA53AB5F4769DF2
SHA1:	F48392A8EACC8ADCC1B1CD06277B8B082207653A
SHA-256:	98586E00B294EB288AEE570ED9FF89C2F08C258A0DE98CD821C04B138AB69C1E
SHA-512:	06595928CA6677EACD7464FD66C6481F46FA9085B011A6E30CA2D2A0EFC6E0ED31AC69A91217E35DE2CABEC60C7CE702E89EEC9FFA9FD784155690AD71383725
Malicious:	false
Reputation:	unknown
Preview:	%!.% This is a sample prefix file for creating a PDF/A document..% Feel free to modify entries marked with "Customize"...% This assumes an ICC profile to reside in the file (ISO Coated sb.icc),.% unless the user modifies the corresponding line below...% Define entries in the document Info dictionary :../ICCProfile (ISO Coated sb.icc) % Customize..def..[ /Title (Title) % Customize.. /DOCINFO pdfmark..% Define an ICC profile :..[/_objdef {icc_PDFA} /type /stream /OBJ pdfmark.[{icc_PDFA} <</N systemdict /ProcessColorModel get /DeviceGray eq {1} {4} ifelse >> /PUT pdfmark.[{icc_PDFA} ICCProfile (r) file /PUT pdfmark..% Define the output intent dictionary :..[/_objdef {OutputIntent_PDFA} /type /dict /OBJ pdfmark.[{OutputIntent_PDFA} <<. /Type /OutputIntent % Must be so (the standard requires).. /S /GTS_PDFA1 % Must be so (the standard requires).. /DestOutputProfile {icc_PDFA} % Must be so (see above).. /OutputConditionIdentifi

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\PDFX_def.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.951924984524529
Encrypted:	false
SSDEEP:
MD5:	DCE885B94C5018311436A841A32BD6CB
SHA1:	46FB64E70B8B59AE47BF4F830BF1D510C7F480E2
SHA-256:	CD168F642B8589CE9FB7CF37A19FD7141EA141529BA7D077C3656C42229BE997
SHA-512:	DC0DAE10589B9C6FBEC90B649D0BB175AA5C4362CA16206F68F4251302F49EC7665F59A330A09E4CAD6E8A67B90036A61B4D0C880B8C19AD8D4BD59D78EF62AC
Malicious:	false
Reputation:	unknown
Preview:	%!.% This is a sample prefix file for creating a PDF/X-3 document..% Feel free to modify entries marked with "Customize"...% This assumes an ICC profile to reside in the file (ISO Coated sb.icc),.% unless the user modifies the corresponding line below...systemdict /ProcessColorModel known {. systemdict /ProcessColorModel get dup /DeviceGray ne exch /DeviceCMYK ne and.} {. true.} ifelse.{ (ERROR: ProcessColorModel must be /DeviceGray or DeviceCMYK.)=. /ProcessColorModel cvx /rangecheck signalerror.} if..% Define entries to the document Info dictionary :../ICCProfile (ISO Coated sb.icc) def % Customize or remove...[ /GTS_PDFXVersion (PDF/X-3:2002) % Must be so (the standard requires).. /Title (Title) % Customize.. /Trapped /False % Must be so (Ghostscript doesn't provide other).. /DOCINFO pdfmark..% Define an ICC profile :..currentdict /ICCProfile known {. [/_objdef {icc_PDFX} /type /stream /OBJ pdfmark. [{icc_PDFX} <</N systemdict /ProcessColorM

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\acctest.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	4269
Entropy (8bit):	4.578435345819481
Encrypted:	false
SSDEEP:
MD5:	8BC30F8B14AD40BACC5A893F2D676AE2
SHA1:	FFA666D88151407423FF9A6162925FF716597921
SHA-256:	4F3AA79817806DC00B5EC34309CC7613E4440941B48A097B1EE24463FE5AF207
SHA-512:	819DBDC7B48E1A62EEC634B3979FB72711158EB92E481B8C8C9C7F83A6CD83A9C24AAE83FA96C6D63A45B2C52A82624154A7969088CFB3111BB4D94405A33985
Malicious:	false
Reputation:	unknown
Preview:	%!.% Check that operators do their access tests correctly...% proc dotest => ../dotest. {. dup. mark. exch. stopped not % False if error, true if no error.. { (Allowed access: ) print cleartomark == }. if. clear. }.def..0 0 moveto % So the show commands don't bomb because of nocurrentpoint...{ [1 2] executeonly aload }.....dotest.{ (string) executeonly (seek) anchorsearch }...dotest.{ (string) (seek) executeonly anchorsearch }...dotest.{ 100 101 (string) noaccess ashow}....dotest.{ 100 1 array readonly astore }.....dotest.{ 100 101 102 103 104 (string) noaccess awidthshow }..dotest.{ 1 dict noacess begin }.....dotest.{ 1 array executeonly 1 array copy }....dotest.{ 1 array 1 array readonly copy }....dotest.{ 1 dict noaccess 1 dict copy }.....dotest.{ 1 dict 1 dict readonly copy }.....dotest.{ 1 string executeonly 1 string copy }....dotest.{ 1 string 1 string readonly copy }....dotest.{ (100) executeonly cvi }.....dotest.{ (string) executeonly cvn }.....dotest.{ (

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\addxchar.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10004
Entropy (8bit):	4.7043599336942306
Encrypted:	false
SSDEEP:
MD5:	F4839D0F4CC39AD98BA687CA6A9DC635
SHA1:	D19940C3B9205AA6F072549DCDCE326AB354A7C1
SHA-256:	22C1435FEA07B044F13C2512DF12A19523054FCF0C3366C29798CE2D8681FF1B
SHA-512:	B877F67FB7554D5FC9E1304C554E1D525B769E54ED179D7F20B655F766056E8A85ABB5BAB1F9A46AB840E6B5989555C1461AF40390DF621A452F166326722796
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Add the Central European and other Adobe extended Latin characters to a.% Type 1 font..% Requires -dWRITESYSTEMDICT to disable access protection...(type1ops.ps) runlibfile..% ---------------- Utilities ---------------- %../addce_dict 50 dict def.addce_dict begin..% Define the added copyright notice../addednotice (. Portions Copyright (C) 2012 Artifex Software Inc.) def..% Open a font for modification by removing the

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\afmdiff.awk

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	awk script, ASCII text executable
Category:	dropped
Size (bytes):	5760
Entropy (8bit):	4.461641582470072
Encrypted:	false
SSDEEP:
MD5:	C81C5317F43C397EA47BD6DDBA3936D8
SHA1:	33B8374A815805C692FE2C92AEE5A7F315E0856E
SHA-256:	10B7F8A4F13CA076F543E56357DC9E14E29BEB8A6615F4BD630D6DDFA97986AE
SHA-512:	38B284ECE3DA8334BF411F59C5550018D45C48C7773AE22FF3342ECAE92F942F740292CD566CC65DA4042E428291109C43513B600A412FDD08E9FB30355F39CC
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/awk -f.###=====================================================================.### Read two Adobe Font Metric files, and compute tables of the.### differences in character repertoire, declared widths (WX), and.### bounding boxes..###.### Usage:.###.awk -f afmdiff.awk file1.afm file2.afm.###.### Author:.### .Nelson H. F. Beebe.### .Center for Scientific Computing.### .University of Utah.### .Department of Mathematics, 322 INSCC.### .155 S 1400 E RM 233.### .Salt Lake City, UT 84112-0090.### .USA.### .Email: beebe@math.utah.edu, beebe@acm.org, beebe@computer.org,.###. beebe@ieee.org (Internet).### .WWW URL: http://www.math.utah.edu/~beebe.### .Telephone: +1 801 581 5254.### .FAX: +1 801 585 1640, +1 801 581 4148.###.########################################################################.########################################################################.########################################################################.###

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\align.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2172
Entropy (8bit):	4.835392694336129
Encrypted:	false
SSDEEP:
MD5:	5598530A10B4BDE8C5E43E816A75F86B
SHA1:	29BAAAB1CAF78E21FE21604C9406F5A9568DE865
SHA-256:	6F68A065FEA3A47CB3EE7B9B44D3EAFFAD11ED35B8835601B2671C5DB42E15C3
SHA-512:	C1EC3E894393025990789DE753A9EC1F7E34E38C7D4E928D0EB5B43D3C9766A95B7DE398ADBA0D84779D50F419521CF12899C398F34A1DEAFAB5411B09FFC850
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Print a page that indicates the proper settings of Margins and HWMargins.% for a given device. Requires a Level 2 system...% Reset the offset and margins...<<. /PageOffset [0 0]. /Margins [0 0]. /.HWMargins [0 0 0 0].>>.setpagedevice.<<. /ImagingBBox null.>>.setpagedevice..% Determine the actual page size...clippath pathbbox newpath./y1 exch def /x1 exch def pop pop..% Draw lines that should be exactly 1" in f

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8.rpd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.0314135519944365
Encrypted:	false
SSDEEP:
MD5:	561E434D8B29339E188E7EBA5EC1F414
SHA1:	FC8FF58F607E4D8600EAF5CE4C9EFED5665CA459
SHA-256:	1E6113001D6FC5DCFB94A2B06653DD69D6EDA966159627B9B7AAE659A260ED9E
SHA-512:	632CE4321519C0820564A068AD848CFABCC92E3A58415CBB5795D0B980DDCBC05425AB4C219C5B1222D27C588B39730CE6CDB725CF010FFD7DF53CEAC4EF49F1
Malicious:	false
Reputation:	unknown
Preview:	.StartEntry: U_CanonBJC8200.GSDriver: uniprint .Description: {Canon BJC-8200 (UP)}.About: { \.. Canon BJC-8200 uniprint driver settings.\. }.Resolution: {NA} {NA} {}. BitsPerPixel: {bj8pp12f} {1200x1200DpI, photo paper pro, color, rendered}. BitsPerPixel: {bj8hg12f} {1200x1200DpI, high gloss photo film, color, rendered}. BitsPerPixel: {bj8gc12f} {1200x1200DpI, glossy photo cards, color, rendered}. BitsPerPixel: {bj8oh06n} {600x600DpI, transparencies, color, rendered}. BitsPerPixel: {bj8ts06n} {600x600DpI, t-shirt transfer, color, rendered}. BitsPerPixel: {bj8pa06n} {600x600DpI, plain paper, color, rendered}..EndEntry.#.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8gc12f.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	4.559279126329728
Encrypted:	false
SSDEEP:
MD5:	332A765CB8F84AF1EC34315EF0400267
SHA1:	1C7A11B5F6596280BDCCCCFEEF830A8D7BC6D7C9
SHA-256:	0971D8C684EEEF96006DDEAF4BF4A656E753CB5EA93522F8D36DB963EBECEF82
SHA-512:	25B282579B1A501761B6E8ED1DE936B4EC0344E8219FBB63B0746F97ABC83DE818D11AEDA56CF32A2AF5C85A9A036A7E0FE65FB8FF29E9395FB4115BB77AFA8F
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 8200, (1200DpI)^2, glossy photo card, high quality".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/Canon.-r1200x1200.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8hg12f.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.558388027425217
Encrypted:	false
SSDEEP:
MD5:	692CD4BE60E7347D4691DEB06C6B50AE
SHA1:	9208223AC5B35C7CFDF8431579FDD26ECE93B388
SHA-256:	8D18EB8F26DCE23DB0C870C33E8FB7DEE880C46E6C224E1E8547D6ACA9538E4C
SHA-512:	55BE149F7F3B9A7EAB43EF6D0C9DAD31901E046896E2BAC27E4670430F9BAB2AAD1498C7FE87205CFE8F2ADA29B0123C6E2D87A6E7A00F25C88C81658DAEDA80
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 8200, (1200DpI)^2, high gloss photo, high quality".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/Canon.-r1200x1200.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8oh06n.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.54106606456799
Encrypted:	false
SSDEEP:
MD5:	8D3D588B8B52D520527268D981382EAF
SHA1:	175786C4752F248DBEF87199A9EA2A034E2D7C86
SHA-256:	EA04A1BDC5506DA3FE1A770796B4E5B717D75CA2EE3E6FA4F3196328188DF79E
SHA-512:	2660B80CBAA5DBD5B0EB5A9E017C23D7370A4231F5E2625C349F0C2CF50B2D9A63CF390B94935F66138632CDBEDE8B9ED86945A22A16A409AC31204882362FA1
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 8200, (600DpI)^2, OHP, normal quality".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/Canon.-r600x600.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8pa06n.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1525
Entropy (8bit):	4.539637089274767
Encrypted:	false
SSDEEP:
MD5:	08DFBC8D265585B313E704B49406819C
SHA1:	40CA94E1DC1112139F0D00EF6165B2B1626076F2
SHA-256:	ED6AE6CDE403A8E394C62E028F863879D2F4DECF45965946B74D40B89D27E810
SHA-512:	4A52641B25D8856D27F2721905B4A80DFFCAEDF2EF21A8903BB0BA4B78414947FFEAC7AC5B4D1625EB8DAFA9FDE36CE6E5695B74CD25D403006721DE6F357DB5
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 8200, (600DpI)^2, plain paper, normal quality".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/Canon.-r600x600.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8pp12f.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	4.569141517065613
Encrypted:	false
SSDEEP:
MD5:	987D285072D871242EDFB65630EA6BFD
SHA1:	AE43F8247F024572DFA4220A69B85F1ED648B06C
SHA-256:	265390EF8A4B203E86C9D65C309177A4131210F54055C7F9AA8F804CA90DA971
SHA-512:	A24AC802BB36FACA978583AFE0C0334FC8A0DC14B635CBCFF1F44B314C2FE433892E00661BD6316CCBEF2C8199A07BDC7D38E3D36288B04BE09ACA00ED99094B
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 8200, (1200DpI)^2, professional photo paper, highest quality".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/Canon.-r1200x1200.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.479

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bj8ts06n.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.5554185437099015
Encrypted:	false
SSDEEP:
MD5:	4C4BD936E9A11B610A3EB6471862A720
SHA1:	934DA49E9692AD445799A329A767C76B9DCBA476
SHA-256:	CDAFD54E1F176564709D428D1F1ADC519FF9D40D08EB69600D68C06111A4368E
SHA-512:	903A50584FE6B27E5D4E86A5D839C82C0EECE50D8270663D56B14498FD15BE4218899A63A782BCE4FBDEEA99AEE4AD2D2B13B75EBD0C707D64A60FD6B2AC207B
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 8200, (600DpI)^2, t-shirt transfer, normal quality".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/Canon.-r600x600.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a0.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1527
Entropy (8bit):	4.582945878166366
Encrypted:	false
SSDEEP:
MD5:	272713104AA3AB5B4C2F80C6B11092AA
SHA1:	9CA8EB546B9C2C600932D7BF2DB874CF7102CBB8
SHA-256:	4CBFA40EAE203FE068C1A154BC3BB1C39D659D8ED8DC840060630259FAA1CD2F
SHA-512:	9A98D434764966EC4F1D429E731A28611EC3D22740F6AE46A8259CC4719140A8C694500B40DF410EC4B0DEADAF144A99E6A02A5E31F6F43E7E7408554A2DFB2B
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, plain paper high speed, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a1.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	4.56787491394694
Encrypted:	false
SSDEEP:
MD5:	302A248493956A67F3ED8AC32C5B6FD9
SHA1:	DB8161BB37AC639955354917C2A696F1DAA4AF98
SHA-256:	810220F0BD4309DECE1587C98431AD744880292B09DB3C78250710CF94616051
SHA-512:	9FA7AF2BF24CF4F37E14F22A6B2550AF92EABEF25A9BA95CBC065B415946AB409A8C50728276239FA243779FFB47E760E45CA90CD03CD79B5523310A716F0853
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, plain paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a2.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.572259071561083
Encrypted:	false
SSDEEP:
MD5:	29567F275B715DC9F3DF2DF48A7FAB05
SHA1:	C952CFCD6251BD4E1ADA0FCF5C0645381A8EAA18
SHA-256:	57DBD7B910CF4097EC3781E43BB0B066F6356DEBA8086E6392E9FBDD0C036B2B
SHA-512:	D6AF4C0E9D6D779FB499E397FCB4F1CC5C7ABCEEE3491385996B6614F16D7EA351A1C8C6B044E56744638419D37B99D61379CDBFEC99DDE3A9E87AAE9469343E
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, coated paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a3.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	4.5527335161161835
Encrypted:	false
SSDEEP:
MD5:	75163059E2A7EB79D885599221CC8E82
SHA1:	7F1A59B88880BB1F1C617DC7E757F16B849D1DDB
SHA-256:	ADA21961A86254D4D8003E7F6399EC14BC211A84E152AF23356EE0F6A06BD0E8
SHA-512:	BE94F850DCF1FEA850B218B599ABA5DDAFEEBE92962D63DACA4C0C37A3B07976A84E9F2489413292AF8F836E18E08760C7D1481A35B456C99B049A3E4EDB6D39
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, transparency film, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.56

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a4.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.595956030686988
Encrypted:	false
SSDEEP:
MD5:	8AC7079FB35C110F197D50BC64F5B8BC
SHA1:	CE9071252389B6CD0FFEA70769B37A9CD9154CEC
SHA-256:	8F39800FEC647CD4E4C10DDE12752B7443A06E7672080EB37F60416D9FF63B9C
SHA-512:	D0D447AE6248E8A9E023C76EB00183A133CAE58D7AF33ABFFFFAA37D189E7E4E56E423D0CD2A2FB01802C11F73AEED9F719679B0362523D90D0FEA6AB18AA69F
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, back print film, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupYFlip.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a5.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.580414660051067
Encrypted:	false
SSDEEP:
MD5:	31A1854DC45600813B9E63FBDED99C54
SHA1:	BD0C25F72137A8214A104FEDD56A70C005DD4D42
SHA-256:	FDA6BC2931F878B6B40BDDE6D1714DE93A2400122EA105253D509492E6BCABE2
SHA-512:	BD9779B5E67E67CE90A1F79E833865260E536781095E9D539054A31BCEE624DFC2A8081FD8AAC4145EB8CEDB0D4649BBE0333F69A4A52794A91E40C8B209BCA2
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, fabric sheet, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a6.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.577266903766649
Encrypted:	false
SSDEEP:
MD5:	FF963E5BDC9BBB3E00DB7610A4580DFD
SHA1:	3EBF931CE073BED4C34577EF62B77BECCE6F1F04
SHA-256:	79C1EBA4460DCF6AF066A922CDFD33DA03C9964B8F942A6CFF64C4DB665EB781
SHA-512:	7A28794800B81B3851FB78EBCE884C5D1089A9B9658D4D4E2C0D740CCDB4FFDB044EC0D7E57E072B8BA857F83875F34B8728DDC6098B01645CADC137C8A6EE57
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, glossy paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a7.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	4.555058699117536
Encrypted:	false
SSDEEP:
MD5:	02F63DFFB21A37B3DF1B60AA4EF1BA21
SHA1:	DB563235AB3C96A33ABA517D7C963A12BF052B44
SHA-256:	F18A01FC50E55745C47CE03782FB3125EAC8E39317B53ECD7C70CD9220ABF728
SHA-512:	A98BEDFF1CE39A8673B7B58679C32771C1724C94C1318AB6C315FCDB6F739ABAE08E7EE5DA3531206CDF85BD644B632191D829FA636A88BFD236ED62E5B328D9
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, high gloss film, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610a8.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1526
Entropy (8bit):	4.590747906396555
Encrypted:	false
SSDEEP:
MD5:	938071F80CA83BA489905E0DDE3701EB
SHA1:	C5C643EE15C74C41EE13BA2183F223CE4B10665F
SHA-256:	A422DF1E096044BD651B62C5991B55F05025466A5B068944EAF226ED4BD7311B
SHA-512:	1D124C849633702ACC729E4879A575E1D1C380F59AE1A00E7EEB6143610D32B577F9BEB45BCD7C836361AA3B69113088B2E9DAAA0E6B38F39BE63752890F56B8
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 360x360DpI, high resolution paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r360x360.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0058 0.0164 0.0301 0.0463 0.0648 0.0851 0.1073 .0.1311 0.1564 0.1832 0.2114 0.2408 0.2716 0.3035 0.3366 .0.3708 0.4061 0.4425 0.4798 0.5182 0.5576 0.5978 0.6391 .0.6812 0.7242 0.7681 0.8128 0.8584 0.9048 0.9520 1.0000 .}".-dupCyanTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupMagentaTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b1.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	4.537696141906449
Encrypted:	false
SSDEEP:
MD5:	4416D26B4178E030946C175327C9C6B6
SHA1:	7D18469F19225AFD6D82DAE0A2E425D0BB0105DF
SHA-256:	8B3D347099F5E58671B6E12A93485449EF429D7D8243DBA941D9E7209F79C7BF
SHA-512:	3583B4FEC36863142E1D027D965E54D9BB987309BBBBBCC1CBF7D92E6D15043F62BDBD1BCA7DDA25D05D61B6880D96F03744EB95520EC269450E348BC4597890
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, plain paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0029 0.0082 0.0151 0.0232 0.0324 0.0426 0.0537 .0.0655 0.0782 0.0916 0.1057 0.1204 0.1358 0.1517 0.1683 .0.1854 0.2030 0.2212 0.2399 0.2591 0.2788 0.2989 0.3195 .0.3406 0.3621 0.3840 0.4064 0.4292 0.4524 0.4760 0.5000 .}".-dupCyanTransfer="{.0.0000 0.0004 0.0017 0.0037 0.0067 0.0104 0.0150 0.0204 .0.0266 0.0337 0.0416 0.0504 0.0599 0.0703 0.0816 0.0937 .0.1066 0.1203 0.1349 0.1503 0.1665 0.1836 0.2015 0.2202 .0.2398 0.2601 0.2814 0.3034 0.3263 0.3501 0.3746 0.4000 .}".-dupMagentaTransfer="{.0.0000 0.0004 0.0017 0.0037 0.0067 0.0104 0.0150 0.0204 .0.0266 0.0337 0.0416 0.0504 0.0599 0.0703 0.0816 0.0937 .0.1066 0.1203 0.1349 0.1503 0.1665 0.1836 0.2015 0.2202 .0.2398 0.2601 0.2814 0.3

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b2.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.580493429607447
Encrypted:	false
SSDEEP:
MD5:	306B236DB4201A6ED371DE7D18718D6E
SHA1:	137C0A2184A6CD416BC97DFD84CEED6D5008E61B
SHA-256:	0E90CFD91FD0BC9F44272912E1D950F6D3E7C291F8C83FA237BC70F05CC1DAD8
SHA-512:	EF3C42F15ACFA942028C68BBAECEF9C83742AFD2327F1B62D43188A6F740AF4A7119D8F47BC29E0CE9D427036AA26FA4482A7CC6E0063ED6A2C74251F440C72D
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, coated paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0029 0.0082 0.0151 0.0232 0.0324 0.0426 0.0537 .0.0655 0.0782 0.0916 0.1057 0.1204 0.1358 0.1517 0.1683 .0.1854 0.2030 0.2212 0.2399 0.2591 0.2788 0.2989 0.3195 .0.3406 0.3621 0.3840 0.4064 0.4292 0.4524 0.4760 0.5000 .}".-dupCyanTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.3793 0.4079 0.4376 0.4683 0.5000 .}".-dupMagentaTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b3.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	4.574835215529228
Encrypted:	false
SSDEEP:
MD5:	885D44BDA6C4B82465FC6337A4193660
SHA1:	FFCCD48790BD8BCBFB75760790F8E2A91B70A205
SHA-256:	86C5D2C36D74DE5CE9ABBCBFE0564A1CECF14313C2A61A6EC357180C81B006A8
SHA-512:	9B561D38FF852896DF1AECEF32867026A6907ED5BA325A06B8FC43B1FCC3F95C607971C530DDD0CF76C50BE9A1A4B928760F03FDDAC16A38BC15401EA82E8099
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, transparency film, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.3793 0.4079 0.4376 0.4683 0.5000 .}".-dupMagentaTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.35

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b4.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.606484154507585
Encrypted:	false
SSDEEP:
MD5:	F58FC5D7C95E359BF7D751126210DEAF
SHA1:	2694CCCA13E0AD4E71A41940E4755D5DC59FDD28
SHA-256:	1AB92424301325D4B8C4FEFF1EB8BB0E667EAC88369943CF70DFCB7D4BE854B4
SHA-512:	0593104484E2569CA0BD5D956936BA19E845E2F958CCA591BE51803C9751F7C80231A7013F483398BE32F82802B441CC6C13DF3BA55217DCC8852F4F9DD42F47
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, back print film, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupYFlip.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0005 0.0019 0.0042 0.0075 0.0117 0.0169 0.0229 .0.0300 0.0379 0.0468 0.0567 0.0674 0.0791 0.0918 0.1054 .0.1199 0.1353 0.1517 0.1690 0.1873 0.2065 0.2266 0.2477 .0.2697 0.2927 0.3165 0.3414 0.3671 0.3938 0.4214 0.4500 .}".-dupMagentaTransfer="{.0.0000 0.0005 0.0019 0.0042 0.0075 0.0117 0.0169 0.0229 .0.0300 0.0379 0.0468 0.0567 0.0674 0.0791 0.0918 0.1054 .0.1199 0.1353 0.1517 0.1690 0.1873 0.2065 0.2266 0.2477 .0.2697 0.2

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b6.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	4.585969086397626
Encrypted:	false
SSDEEP:
MD5:	E2FC90A088D0A30CEF318B258EF58372
SHA1:	50A7CCA23EA229A1C061464DA978E478BD7D5ACD
SHA-256:	6569F80D84D84749B17B4211A56C9F37246E02131DF72BCA13CD82820D8781B3
SHA-512:	F106BEB2A9642215E4F9B6F475282EF561B387D5A66F015FDD2F9D5A1AA6BE2A85353F30549F34BEB3E2535D042DFF59410D2F2F0EA2A5AFCE837C72A4AC8F9E
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, glossy paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0029 0.0082 0.0151 0.0232 0.0324 0.0426 0.0537 .0.0655 0.0782 0.0916 0.1057 0.1204 0.1358 0.1517 0.1683 .0.1854 0.2030 0.2212 0.2399 0.2591 0.2788 0.2989 0.3195 .0.3406 0.3621 0.3840 0.4064 0.4292 0.4524 0.4760 0.5000 .}".-dupCyanTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.3793 0.4079 0.4376 0.4683 0.5000 .}".-dupMagentaTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b7.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	4.575959431831605
Encrypted:	false
SSDEEP:
MD5:	AECB71A200AA8A7ABA6B36E174B94B29
SHA1:	E31737102DAF95716F43DD245C32995233497D9A
SHA-256:	D387BDA50EDFAEF50F9223021ADFC2460CAAB9EC067992E88FB25D87AC86CCDC
SHA-512:	2509F0E7F883542927F15928955297A7760829DCB7C1E51055C6A202B65B89B47FD18B3305B94B48A1A2E445AC2E32509D9AA0A557E027E6AAE4FE3C445E7433
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, high gloss paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.3793 0.4079 0.4376 0.4683 0.5000 .}".-dupMagentaTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.351

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\bjc610b8.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1526
Entropy (8bit):	4.581400597176733
Encrypted:	false
SSDEEP:
MD5:	DA6BD78547C51EE6F1CB1031832735B7
SHA1:	19620444A602540A7B1AF785875409AFCFDFDB77
SHA-256:	62C3CD85ACC7B33705CE3AD3662C8430644715EBD3096EEAF62BFE137D0E109E
SHA-512:	724E83CB56FAA0B06C8739812927B3FE9F4318B5451916B3B065DDEDE29E65D1D633800BA41C9043AD89894D2AA50C2C060E0B2519EF15B0B2EFAAD69256CC6E
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Canon BJC 610, 720x720DpI, high resolution paper, color, rendered".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Canon.-r720x720.-dupMargins="{ 8.23 20.44 11.05 7.9 }".-dupOutputComponentOrder="{ 3 2 1 0 }" .-dupBlackTransfer="{.0.0000 0.0008 0.0033 0.0075 0.0133 0.0208 0.0300 0.0408 .0.0533 0.0674 0.0832 0.1007 0.1199 0.1407 0.1632 0.1873 .0.2131 0.2406 0.2697 0.3005 0.3330 0.3671 0.4029 0.4404 .0.4795 0.5203 0.5627 0.6069 0.6527 0.7001 0.7492 0.8000 .}".-dupCyanTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252 0.3517 0.3793 0.4079 0.4376 0.4683 0.5000 .}".-dupMagentaTransfer="{.0.0000 0.0005 0.0021 0.0047 0.0083 0.0130 0.0187 0.0255 .0.0333 0.0421 0.0520 0.0630 0.0749 0.0879 0.1020 0.1171 .0.1332 0.1504 0.1686 0.1878 0.2081 0.2294 0.2518 0.2752 .0.2997 0.3252

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\caption.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.808533367364292
Encrypted:	false
SSDEEP:
MD5:	02A6627C59797F7674FBA827CF140012
SHA1:	99F6A10F360EE99C69AD113660425F7A66DC032B
SHA-256:	52FD33DB85C10B248D05CA19753154FC03155D81D187B1CDF8F29E1532F30FC1
SHA-512:	CD979C41C57D1758F32159BEE961B60DDE4E9524E1EFC80D5260780CF72200EE708910EFEB196CD2F3EF3749008B7F35C5CC81F652504730FB98A0083557F585
Malicious:	false
Reputation:	unknown
Preview:	%!.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Add a "caption" to the bottom of each page../captionsize 20 def./caption. { /Helvetica //captionsize selectfont. (Printed by Artifex's XXYYZZ) show. /Symbol //captionsize selectfont. (\324) show..% trademarkserif. /Helvetica //captionsize selectfont. ( product) show. } bind def..10 dict begin.gsave. initgraphics. clippath pathbbox. pop exch 36 add /by exch def. % We can't use stringwidt

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cat.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2871
Entropy (8bit):	3.3499058052885955
Encrypted:	false
SSDEEP:
MD5:	5F59F3643F77259D2D84363418F1B6CD
SHA1:	8303BABC1055A184BD87F5C1B0D3C45D7D8EF4AF
SHA-256:	4E1076114508E56F48F682129FC09406EC5843E000FBBF2315D789E1597A9C6C
SHA-512:	AAD742BCAD1145ACF7388E6D732BD17D87C23C75AC29D05371C697AE0CBEE853818176D94B9136B26FB5534CA30D01247370F8AF118367E6CCD4881B44AABD39
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%.%.% $Id: cat.ps 8331 2008-02-05 11:07:00Z kens $.%.% Appends one file to another. Primarily used to overcome the.% 'copy' limitation of Windows command shell for ps2epsi.%.% the files to be appended are given by the environament.% variables %infile% and %outfile%. %infile% is appended to.% %outfile%.%../datastring 1024 string def..{. (outfile) getenv. {. /outfilename exch def.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cbjc600.ppd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PPD file, version "4.1"
Category:	dropped
Size (bytes):	11148
Entropy (8bit):	5.283894078774555
Encrypted:	false
SSDEEP:
MD5:	945672F0DA5796288B587F822BD83907
SHA1:	E1BF7C63CCF0217F519E950FDEC0AAC729F2BCDA
SHA-256:	64C31DE3938FA8076D14985417DD50A001D74E62D3626D2F158D6031F9E00C82
SHA-512:	67B1DF7EAF97AF6E7E5744A96F01AB05A9DD91CA2366C58AA593902D29355A1B33D32B28A2BCBAF93896D6DE9027844EBEA60712DCEFCD5DAFB062EF9ED31CF5
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.1".% Adobe Systems PostScript(R) Printer Description File.% Copyright 1995 Yves Arrouye for AFPL Ghostscript with Level 2 PS..% All Rights Reserved. .% This file may be distributed as part of GNU Ghostscript and/or AFPL.% Ghostscript, under the same terms and conditions as Ghostscript..% End of Copyright statement.FormatVersion: "4.1".FileVersion: "1.0".LanguageEncoding: ISOLatin1.LanguageVersion: English.PCFileName: "CBJC600.PPD".Product: "(Canon Bubble Jet Color 600)".PSVersion: "(2010.351) 0".ModelName: "Canon Bubble Jet Color 600".NickName: "BJC-600".ShortNickName: "BJC-600".Manufacturer: "Canon"..% This file is not complete, and may lack some useful information.....% Note: the default transfer function should be set to Null if Ghostscript.% exhibit a bug making magenta appear while printing in gray levels....% Note: if you print on A4 paper by default, change Default values (the.% default is Letter here)...*% ==============Constraints ========

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cbjc800.ppd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PPD file, version "4.1"
Category:	dropped
Size (bytes):	11491
Entropy (8bit):	5.318493686848141
Encrypted:	false
SSDEEP:
MD5:	ECAC823FF6F95A532C6388257CDE106F
SHA1:	C0F4FE5E4A642FF9213019646CEF035B5D8D02DC
SHA-256:	E7C73109D85DB98EE0C508E34840E856018FAF09FD3C7772172386DB9D5866B1
SHA-512:	129A1ACCBF8B7080F6F13849680E96C032E3FA6D27F2AF7638017FF0CCD793EFAAA2B151A0AA27ED9658A19B62812A45DCEF8808C1E97E0B29A03FD93051AE1A
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.1".% Adobe Systems PostScript(R) Printer Description File.% Copyright 1995 Yves Arrouye for AFPL Ghostscript with Level 2 PS..% All Rights Reserved. .% This file may be distributed as part of GNU Ghostscript and/or AFPL.% Ghostscript, under the same terms and conditions as Ghostscript..% End of Copyright statement.FormatVersion: "4.1".FileVersion: "1.0".LanguageEncoding: ISOLatin1.LanguageVersion: English.PCFileName: "CBJC800.PPD".Product: "(Canon Bubble Jet Color 800)".PSVersion: "(2010.351) 0".ModelName: "Canon Bubble Jet Color 800".NickName: "BJC-800".ShortNickName: "BJC-800".Manufacturer: "Canon"..% This file is not complete, and may lack some useful information.....% Note: the default transfer function should be set to Null if Ghostscript.% exhibit a bug making magenta appear while printing in gray levels....% Note: if you print on A4 paper by default, change Default values (the.% default is Letter here)...*% ==============Constraints ========

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cdj550.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	4.757565419343953
Encrypted:	false
SSDEEP:
MD5:	2217003FA001E390762C19943D32164E
SHA1:	DC5AAC0FC2F9FCE689F991935D6C221CEB7CA00C
SHA-256:	9307CBD9932DFD799B833680ED51B44D620A75E9B2993A79B93C822AEF9DF926
SHA-512:	8721057DF59106BCE58B8790A44CFF3F749117AC0FE3921F5B5A1ACC925CB215B520C89951E14F4AAB014884D66E5FC840BA7DF450F30B64B9D6C19977F26A12
Malicious:	false
Reputation:	unknown
Preview:	-supModel="HP Deskjet 550c, 300x300DpI, Gamma=2".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Pcl.-r300x300.-dupMargins="{ 12.0 36.0 12.0 12.0}".-dupBlackTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751 0.9365 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751 0.9365 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cdj690.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1999
Entropy (8bit):	4.703890708644089
Encrypted:	false
SSDEEP:
MD5:	B9609EA4F0676071C1EA3AFC9919DBFC
SHA1:	32926334A8C2117E6F6E448A3A3C70E8111799F2
SHA-256:	F11D410ACDD0ABAC139C842C09D864E63366791EDF0BC70EF9E009C9B396E531
SHA-512:	1C9549FC950A2B9853EB2EC733BC5B908EF38F9DAD39CB145C5B9B7F927B4F42F1EE5EC3C93D352725400218CE686550ED57175E26270A0C5BA0851A2D90E7C4
Malicious:	false
Reputation:	unknown
Preview:	-supModel="HP Deskjet 690 Normal Gamma 2.0".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Pcl.-r600x300.-dupMargins="{ 12.0 36.0 12.0 12.0}".-dupBlackTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751 0.9365 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751 0.9365 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cdj690ec.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	4.71618239725129
Encrypted:	false
SSDEEP:
MD5:	54D22116832DDEEB195ED442172DB9BC
SHA1:	1C0CEE9E33DEA2C1133B28C2D87951F0A3B801DA
SHA-256:	CE93569357EDFA20D04A3184E537287618529AF45F2E5E2FFCC1BAD05D941831
SHA-512:	3B4A8C86CA3BB369D858244ECE79D0CF96E7EFAF328F0103F842F8B7C13C71E4BB2F1FB53D8A4BEC3679AAE46EC6C07CEFE21DEEB0CD121C6C405CAD770CD879
Malicious:	false
Reputation:	unknown
Preview:	-supModel="HP Deskjet 690 Econo-Fast Gamma 2.0".-sDEVICE=uniprint.-sPAPERSIZE=a4.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Pcl.-r300x300..-dupOutputYOffset=300.-dupMargins="{ 0.0 36.0 12.0 12.0}".-dupBlackTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751 0.9365 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505. 0.5994 0.6504 0.7034 0.7586 0.8158 0.8751 0.9365 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0010 0.0042 0.0094 0.0166 0.0260 0.0375 0.0510 . 0.0666 0.0843 0.1041 0.1259 0.1498 0.1758 0.2039 0.2341. 0.2663 0.3007 0.3371 0.3756 0.4162 0.4589 0.5036 0.5505.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cid2code.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4499
Entropy (8bit):	4.629882979148671
Encrypted:	false
SSDEEP:
MD5:	082C49EF60F451D0A1A91F76806B47A6
SHA1:	80D93BCA1C773EED5397DD8042CE86243B4D0165
SHA-256:	517A5D0CEA48B8241CB150058A56BD7BC090142A381A019EC04F8CDBF80F300C
SHA-512:	7793F42943436913A0A8859CA48BA30FEB92C285BBF0EB5DBD1679B6620308CDA7D168D683BE90BC93D9EA45E5E425BBDCDC4BFEFE0B3DDF151D69EAD418BB84
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Construct an inverse map from CIDs to codes...% Create an inverse map from CIDs to code values..% We only use this for 16-bit Unicode, so it has some limitations..% After invoking .cmap2code, loading a CMap file prints out the map.% instead of doing what it usually does. For example:.%.%.gs -dNODISPLAY -dBATCH lib/cid2code.ps -c .cmap2code\.%. -f Resource/CMap/UniJIS-UCS2-H > mapfile../.cmap2codedict 10 dict begin.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\cidfmap

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	2796
Entropy (8bit):	5.30100052642693
Encrypted:	false
SSDEEP:
MD5:	25A1F64B9D7D14989385C18126FAB7AF
SHA1:	C1B7B5CAAD932A73BACA2A15F7C788842E77F41A
SHA-256:	9078F567D97B4680FADCFCE2F724FE0766AB656DDD3900F6EFA4F05BFFBD4470
SHA-512:	87D5F006F49A8E13E855EF7A1566789C876D31AD99D2B41A8A7B716CAFD66053E580DB6FDD411E1F41B270B9CA6D8579D52DF68B4206A268FA3229601CE43673
Malicious:	false
Reputation:	unknown
Preview:	%!.% cidfmap generated automatically by mkcidfm.ps from fonts found in.% C:/WINDOWS/Fonts..% Substitutions./MS-PGothic << /Path (C:/WINDOWS/Fonts/msgothic.ttc) /FileType /TrueType /SubfontID 1 /CSI [(Japan1) 3] >> ;./DotumChe << /Path (C:/WINDOWS/Fonts/gulim.ttc) /FileType /TrueType /SubfontID 3 /CSI [(Korea1) 3] >> ;./SimSun << /Path (C:/WINDOWS/Fonts/simsun.ttc) /FileType /TrueType /SubfontID 0 /CSI [(GB1) 2] >> ;./Dotum << /Path (C:/WINDOWS/Fonts/gulim.ttc) /FileType /TrueType /SubfontID 2 /CSI [(Korea1) 3] >> ;./MS-Gothic << /Path (C:/WINDOWS/Fonts/msgothic.ttc) /FileType /TrueType /SubfontID 0 /CSI [(Japan1) 3] >> ;./FangSong << /Path (C:/WINDOWS/Fonts/simfang.ttf) /FileType /TrueType /SubfontID 0 /CSI [(GB1) 2] >> ;./GungsuhChe << /Path (C:/WINDOWS/Fonts/batang.ttc) /FileType /TrueType /SubfontID 3 /CSI [(Korea1) 3] >> ;./MS-PMincho << /Path (C:/WINDOWS/Fonts/msmincho.ttc) /FileType /TrueType /SubfontID 1 /CSI [(Japan1) 3] >> ;./KaiTi << /Path (C:/WINDOWS/Fonts/simkai.ttf) /Fil

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\decrypt.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.553710280303095
Encrypted:	false
SSDEEP:
MD5:	8E0CBEC3D8193876376BE6458A96F01C
SHA1:	864E55BB989C74D49F149682365E98B136547822
SHA-256:	D61CE1A59AFC8FB478BB6DABC0FCF9FB19C9C71B8DEAD661010AF44D87C1D314
SHA-512:	2280F0069127F7AFD31E4A8A368FF38019902D1A7A1D981F20D40096F11DE46E740B2A10D8FCCB02AB9C367B3DB92E4BC31CDF5295D01CB3C2B60F2D23649364
Malicious:	false
Reputation:	unknown
Preview:	%!.% Decrypt an eexec-encoded file...(t.in) (r) file /in exch def.(t.out) (w) file /out exch def.256 string /buf exch def.55665..% eexec encryption seed. { in buf readhexstring /more exch def. dup .type1decrypt out exch writestring. more not { exit } if. } loop.in closefile.out closefile.quit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\dnj750c.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2808
Entropy (8bit):	4.5912131519291695
Encrypted:	false
SSDEEP:
MD5:	53F4535CED9FF89DC725416B5493D582
SHA1:	58B013909F15C16B39D9EFD7A578C694ACB68D5E
SHA-256:	655FB643172514AEE24FC5A0CF412E6404C733BA0CA9269B7B6562F1A1CD9BF4
SHA-512:	2D4B596C4B2F21DE8310D35227776AB4AF1B737BCEE47CFE601FB642CC6A2311F3EA2A28825256B308A00D3A23C7061F353615ED6D9E9097F5D2F866368E3331
Malicious:	false
Reputation:	unknown
Preview:	-supModel="HP Designjet 750c, 300x300DpI, Gamma=2.5, CMY".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceRGB.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Pcl.-r300x300.-dupMargins="{0.0 0.0 0.0 0.0}".-dupRedTransfer="{1.0 0.921295345 0.846429467 0.775337517 0.707954228 .0.644212425 0.584044278 0.527380228 0.474149585 0.424279869 0.377697408 .0.334326446 0.294089675 0.256907612 0.222698912 0.191379622 0.162863538 .0.137061611 0.113881744 0.0932285339 0.0750028 0.0591011234 0.0454152822 .0.0338314585 0.0242292974 0.0164806321 0.0104477014 0.00598061318 0.00291339168 .0.00105723308 0.000186894162 0.0}".-dupGreenTransfer="{1.0 0.921295345 0.846429467 0.775337517 0.707954228 .0.644212425 0.584044278 0.527380228 0.474149585 0.424279869 0.377697408 .0.334326446 0.294089675 0.256907612 0.222698912 0.191379622 0.162863538 .0.137061611 0.113881744 0.0932285339 0.0750028 0.0591011234 0.0454152822 .0.0338314585 0.0242292974 0.0164806321 0.0104477014 0.00598061318 0.00291339168 .0

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\dnj750m.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1975
Entropy (8bit):	4.715978194998058
Encrypted:	false
SSDEEP:
MD5:	96423332EF16DA1D0291BF15153D1547
SHA1:	9E5A475AE958A4C43309EFFE4AC0FBB93010B64D
SHA-256:	82A578078ABCFB4BCFFD378B3AC0C5B4AE09BFA39BE8A13CDCA5FA61E182AC1E
SHA-512:	644CA23E24576C9C830AE20FC43E33A578DF660292A1C433BD90B9598D9F5A08074EB5D16C2654B98311BB35334FAD5963479901CF8761B2E06A014B9125E557
Malicious:	false
Reputation:	unknown
Preview:	-supModel="HP Designjet 750m, 600x600DpI, Gamma=2.5, CMY".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Pcl.-r600x600.-dupMargins="{0.0 0.0 0.0 0.0}".-dupWhiteTransfer="{.1.0 0.921295345 0.846429467 0.775337517 0.707954228.0.644212425 0.584044278 0.527380228 0.474149585 0.424279869.0.377697408 0.334326446 0.294089675 0.256907612 0.222698912.0.191379622 0.162863538 0.137061611 0.113881744 0.0932285339.0.0750028 0.0591011234 0.0454152822 0.0338314585 0.0242292974.0.0164806321 0.0104477014 0.00598061318 0.00291339168 0.00105723308.0.000186894162 0.0.}".-dupBeginPageCommand="<. 1b252d313233343558. 40504a4c204a4f42204e414d45203d20226773220d0a. 40504a4c20534554204d4952524f52203d204f4646200a. 40504a4c205345542050414c45545445534f55524345203d20534f465457415245200a. 40504a4c205345542052454e4445524d4f4445203d20475241595343414c45200a. 40504a4c20534554205245534f4c5554494

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\docie.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7506
Entropy (8bit):	4.9218071518396345
Encrypted:	false
SSDEEP:
MD5:	DA87DE76B1EF5F14CEA50783BC7C0E63
SHA1:	74952A70959665D6ABE6F227AA2A647DE53091B5
SHA-256:	9E68E5D8A175701CF11851FEB4ACC59B0720127D05AF24851A1D834999FE3355
SHA-512:	4EC433B36A18A8928138C7711584D5A23F0D21F99D293B2B59EDBE2B416C7289B92CFE2A6982BCDC4BCD55BFD9B10375C6EE2634BD70BC1625D45DAF51EAD157
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% docie.ps.% Emulate CIE algorithms in PostScript...% ---------------- Auxiliary procedures ---------------- %../r1default [0 1] def./r3default [0 1 0 1 0 1] def../apply3..% <u> <v> <w> [<pu> <pv> <pw>] apply3 <u'> <v'> <w'>. { { 4 -1 roll exch exec } forall. } bind def../restrict.% <u> <min> <max> restrict <u'>. { 3 1 roll .max .min. } bind def../restrict3.% <u> <v> <w> [<minu> ... <maxw>] restrict3 <u'> <v'> <w'>. {

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\dvipdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.370319905371505
Encrypted:	false
SSDEEP:
MD5:	AF7A16AC9926ABE79FA83E343BADA089
SHA1:	82A0DAF9D096EB09E2123E1A563A15F4DF094B4D
SHA-256:	8E9478F83026FEFDA95C696F28F00CAAF9ECAB132F2EB076837784DB48FD5FF4
SHA-512:	AD4A9ABF4DCD3876D41992007CC4E89C136DB6C9079658BCA2507D9666D0CA8A3211A9F520F390A3EC6D718CE44F53DB5B9C26F623B172028D47B8D0FED18B77
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert DVI to PDF..#.# Please contact Andrew Ford <A.Ford@ford-mason.co.uk> with any questions.# about this file..#.# Based on ps2pdf..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs...OPTIONS="".DVIPSOPTIONS="".while true.do..case "$1" in..-R) DVIPSOPTIONS="$DVIPSOPTIONS $1";;..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -lt 1 -o $# -gt 2 ]; then..echo "Usage: `basename \"$0\"` [options...] input.dvi [output.pdf]" 1>&2..exit 1.fi..infile=$1;..if [ $# -eq 1 ].then..case "${infile}" in.. .dvi).base=`basename "${infile}" .dvi` ;;.. *)..base=`basename "${infile}"` ;;..esac..outfile="${base}".pdf.else..outfile=$2.fi..# We have to include the options twice because -I only takes effect if it.# appears before other options..exec dvips -Ppdf $DVIPSOPTIONS -q -f "$infile" \| $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPT

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\eps2eps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.498657582707051
Encrypted:	false
SSDEEP:
MD5:	1837BA59EEFD02342B48FE8316B551F7
SHA1:	FA36B6AEEBEFB6128E8625AD2B4D0695E09D2464
SHA-256:	430513D5B4A5050BA1B945B6BC10B2AA66928146546DB58E91CA7769A55B8518
SHA-512:	861F1DD90E4C1DE6CA161ECC03F081B25971CB63336D6E842ECFCC4ACDBDF86131E5F4C09717AE2B52D8375CBA09BCBF3A5E66AE9FC703EE12685CDDB397111D
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# "Distill" Encapsulated PostScript...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..OPTIONS="-dDEVICEWIDTH=250000 -dDEVICEHEIGHT=250000".while true.do..case "$1" in..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -ne 2 ]; then..echo "Usage: `basename \"$0\"` ...switches... input.eps output.eps" 1>&2..exit 1.fi..exec "$GS_EXECUTABLE" -q -sDEVICE=epswrite -sstdout=%stderr "-sOutputFile=$2" -dNOPAUSE -dBATCH -P- -dSAFER $OPTIONS "$1".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\eps2eps.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	582
Entropy (8bit):	5.2554719076342
Encrypted:	false
SSDEEP:
MD5:	CF9072C32D56E2C7FE85DCA673C137CA
SHA1:	4765DABF01BD1039C8A9291ED02B3AA79B20C8A5
SHA-256:	0A8952D7DE4F57AE6C750F87D9DD3933B03F8742A3A9E91DD9408E902D35B99D
SHA-512:	D303BCAE7C024B49AD844BBB2FEBBEF541826AAD72104E371DB123E75C3CE7A57EB513622FD16ACBF932B265BCAF33E69BCEE400B1E6D5F3B075F9BA6D30F963
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem "Distill" Encapsulated PostScript...if %1/==/ goto usage.if %2/==/ goto usage.call "%~dp0gssetgs.bat".echo -dNOPAUSE -dBATCH -P- -dSAFER >"%TEMP%\_.at".rem Watcom C deletes = signs, so use # instead..echo -dDEVICEWIDTH#250000 -dDEVICEHEIGHT#250000 >>"%TEMP%\_.at".:cp.if %3/==/ goto doit.echo %1 >>"%TEMP%\_.at".shift.goto cp..:doit.rem Watcom C deletes = signs, so use # instead..%GSC% -q -sDEVICE#epswrite -sOutputFile#%2 @"%TEMP%\_.at" %1.if exist "%TEMP%\_.at" erase "%TEMP%\_.at".goto end..:usage.echo "Usage: eps2eps ...switches... input.eps output.eps"..:end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\eps2eps.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	OS/2 REXX batch file, ASCII text
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.020328542604158
Encrypted:	false
SSDEEP:
MD5:	483B721EA2111AD0053661806AF22C7F
SHA1:	35646D4877B2C0D7AFE2F826EF351FFD7DBD6C99
SHA-256:	CC547190D670F8419EB3FADDD15E5DCC46C2BAA4C6440FC8EE6DA00A9F684080
SHA-512:	00FF5FA2D19ACCF9715D7246F7B1A506AF7A0629E38AFB66A8C4B658E2804D15757FC2EA46C203E3D0259BB15301ABBACB84A3649B97AF2E8989584AEB5C2E5D
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ "Distill" Encapsulated PostScript. /..parse arg params..gs='@gsos2'..if params='' then call usage..options='-dNOPAUSE -dBATCH -P- -dSAFER'../ extract options from command line */.i=1.param=word(params,i).do while substr(param,1,1)='-'..options=options param..i=i+1..param=word(params,i).end..infile=param.if infile='' then call usage.outfile=word(params,i+1).if outfile='' then call usage..gs '-q -sDEVICE=epswrite -sOutputFile='outfile options infile.exit..usage:.say 'Usage: eps2eps ...switches... input.eps output.eps'.exit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\font2c

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.3090012175704
Encrypted:	false
SSDEEP:
MD5:	CD3D15468D9825F8B36E28308BB7CADF
SHA1:	E372FF4575EA4AF0F1067AA800F3A7C2D0AC74CA
SHA-256:	0867BEBB6A2492AA9F2F21BAB2A4380BBAC433B893FD9645467B518E89973A9E
SHA-512:	4091A41C2577EE993BD450EA0026657805D22835B1C5F60EBCB92ECE5C7545B1D5DD17DF04752035CE41E74A24B947D2B467566BA6A5D920A6F839EF36BA3AD7
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -P- -dSAFER -dNODISPLAY -dWRITESYSTEMDICT -- font2c.ps "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\font2c.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.080676328069786
Encrypted:	false
SSDEEP:
MD5:	0CB25A3A955DE32499E22268ADCD5D0A
SHA1:	D2D67A7CF2969BD2A38ED3EAD9A2C8D547AAFABD
SHA-256:	287B207C0BA9B9BDFF10F5C2F55AADDB4A9915B7B2EFE606917EA7ED1A132246
SHA-512:	A03559192D9DB3AA250AA1F5A99C5530F4ECC5120B4015C3CBAB07BC25A6846952C892D95AC81386D71D9DAB3C4DC82B788F7CA92FF7EE789A9B0AF78BD5FA71
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -P- -dSAFER -q -dNODISPLAY -dWRITESYSTEMDICT -- font2c.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\font2c.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.156378629545703
Encrypted:	false
SSDEEP:
MD5:	38E3DCCC62F53DF7B3C43812A319A1A7
SHA1:	A4D37C0B7B4BA87A1BCE16017594DFD09A46BF5E
SHA-256:	5B5A9A96F0720AE8997A6A0B8DD0F2C1A66FEF821753A6981ADB4B8D9FE9D7DF
SHA-512:	E6B278D087E40E40DC391F4E287DA17201335C3BEFEAFB19AA9E43FD7462AE4FC1B25ECC0901FB71C90AE28A9E8B81BE838A5098E200D027BBD9D39A858D3D87
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. */..@gsos2 -q -dNODISPLAY -dWRITESYSTEMDICT -- font2c.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\font2c.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20088
Entropy (8bit):	4.64267641278906
Encrypted:	false
SSDEEP:
MD5:	99EF6C218B69B0DD3BCC1191E4639B6D
SHA1:	1FB12CE258AC59EED4E20A1A82CA11F7B92D3CAD
SHA-256:	4D4CF6EBF293707A36FF7F493D18C5A7353F467E4C60BCA47966D26B571E3A85
SHA-512:	9B1CC3EA4CEDBE4E2D8457B795EB18FED12701E146E8586E3EDDA0574618D0A15D45CE8A82C0B34B905E528C3F8773B46AA1D44F931204A13DFF5E962F1702CF
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% font2c.ps.% Write out a PostScript Type 0 or Type 1 font as C code.% that can be linked with the interpreter..% This even works on protected fonts, if you use the -dWRITESYSTEMDICT.% switch in the command line. The code is reentrant and location-.% independent and has no external references, so it can be put into.% a sharable library even on VMS.../font2cdict 100 dict dup begin..% Define the maximum string length th

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\font2pcl.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18371
Entropy (8bit):	4.627401529430006
Encrypted:	false
SSDEEP:
MD5:	762537C9ACB24D01B54ABAF45E12CA36
SHA1:	9E349FEEAF00A7A5295F5E8CD067F328C4D55CF4
SHA-256:	BB0404DA274673A0A3625F9F6500E14CA02BDEAE149B086A3DA3F78E1E46972E
SHA-512:	F0756E2BE15D32E248814D4215371246F3E0DFEBC95F40B5A67277C2DAD8DD994678C4E5C0E823B8D2718BA973AD67E77245138D677A9E3B802B360D6B975A91
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% font2pcl.ps.% Write out a font as a PCL bitmap font.../pcldict 60 dict def..% Write out the current font as a PCL bitmap font..% The current transformation matrix defines the font size and orientation.../WriteResolution? false def.% true=use "resolution bound font" format,. % false=use older format../LJ4 false def...% true=use LJ4 Typeface code. % false=us

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ghostpdf.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.414355644452906
Encrypted:	false
SSDEEP:
MD5:	9A845E93FD02101E693BCFC4CF0B5B13
SHA1:	9FA1429C89509AC5EB7661FFA0FA86850304A1FD
SHA-256:	3D752372A7335B346C421132AD4409803F6D26FFF5DEFC1050A40FB4C0CA42EC
SHA-512:	FCE691C6C2A873DBC4EF3BCF3E0D608D67BE875E7F88919A0D6B52D62C09CC69BD7002F99680E5164EB067DA553A48FB06EE94DE4B7C34F041AE0188A4430749
Malicious:	false
Reputation:	unknown
Preview:	; GHOSTPDF.INF (for Windows 2k, XP and XP x64 edition)..[Version].Signature="$Windows NT$".Provider=Ghostgum Software Pty Ltd.ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318}.Class=Printer.CatalogFile=oemprint.cat..DriverVer=01/02/2007,1.0.0.1..; Manufacturer section.[Manufacturer]."Ghostscript"=Ghostscript,NTamd64,NTia64..; Model sections.[Ghostscript]."Ghostscript PDF" = GHOSTPDF.PPD, Ghostscript_PDF, Ghostscript_PDF_Writer..[Ghostscript.NTamd64]."Ghostscript PDF" = GHOSTPDF.PPD, Ghostscript_PDF, Ghostscript_PDF_Writer..[Ghostscript.NTia64]."Ghostscript PDF" = GHOSTPDF.PPD, Ghostscript_PDF, Ghostscript_PDF_Writer..; Installer section.[GHOSTPDF.PPD].CopyFiles=@GHOSTPDF.PPD.DataSection=PSCRIPT_DATA.Include=NTPRINT.INF.Needs=PSCRIPT.OEM..[DestinationDirs].DefaultDestDir=66000..[SourceDisksNames].1=%Disk1%,,,""..[SourceDisksFiles].GHOSTPDF.PPD =1..[Strings].Disk1="Ghostscript PPD Setup Disk 1".; end of ghostpdf.inf.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ghostpdf.ppd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	25643
Entropy (8bit):	5.3870540751073115
Encrypted:	false
SSDEEP:
MD5:	FECBAD78BA06500F1E867A656818847C
SHA1:	A446AE706BB66BC606867917A4D6E524910B387E
SHA-256:	72DAB2B3B2F138928DD589C5BAC59E0AFCF4E57304048AD5FC18E1371770CDC7
SHA-512:	AB495768CE76F663022B970D649C58BEE55AB47BB214B799C07D23AF7B69596F76D1A81E5DFFE1C89CD6AD7749471CEFF973D4B5A611EB36CA1B049C3A82FEC6
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.3".FileVersion: "1.1".FormatVersion: "4.3" .LanguageEncoding: ISOLatin1.LanguageVersion: English.Manufacturer: "Ghostscript".ModelName: "Ghostscript PDF Writer".ShortNickName: "Ghostscript".NickName: "Ghostscript".% PCFileName should be of the form XXNNNNNN.PPD where XX is an assigned.% manufacturer code..PCFileName: "GHOSTPDF.PPD".Product: "(Ghostscript)".Product: "(AFPL Ghostscript)".Product: "(GNU Ghostscript)".Product: "(GPL Ghostscript)".PSVersion: "(3010) 815"..% DefaultImageableArea:.% DefaultPageRegion:.% PageRegion:.% ImageableArea:.% DefaultPageSize:.% PageSize:.% DefaultPaperDimension:.% PaperDimension:..% == Above are required..Copyright: "2004-2006 Ghostgum Software Pty Ltd".%.% Copyright (C) 2004-2006, Ghostgum Software Pty Ltd. All rights reserved..%.% Permission is hereby granted, free of charge, to any person obtaining.% a copy of this file ("Software"), to deal in the Software without.*% restriction, including

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_ce_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.792948983093598
Encrypted:	false
SSDEEP:
MD5:	5AA52B0AE289EEE072A2457ED9C60257
SHA1:	A9113644840FEEF4BE3F822D0DE706C155F8B19E
SHA-256:	F82CC4155F5075AD114111015CA66416D6431EC79261C61131096A8CDA6CDCD1
SHA-512:	4499ECCA3CD3E29D2E1C954450B540E8B212EE621CAD32D7C8AFECB6DF40437DBEFAEA3E4106C4B39F7CDA547C280EFBBA4E574D0453EB20FB27372D2D054C72
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the Adobe CE (Central European) encoding vector..% We define it by differences from the ISOLatin1Encoding vector../CEEncoding.ISOLatin1Encoding 0 39 getinterval aload pop.% 047. /quotesingle.ISOLatin1Encoding 40 56 getinterval aload pop.% 140. /grave.ISOLatin1Encoding 97 31 getinterval aload pop.% 20x. /.notdef /.notdef /quotesinglbase /.notdef /quotedblbase /ellipsis /dagger /daggerdbl. /.notdef /pert

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_cmdl.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4905
Entropy (8bit):	4.63075229740164
Encrypted:	false
SSDEEP:
MD5:	D1AF2737B72721F12E73439D9789A95F
SHA1:	46DF69C3C9854008CCEB6DC05366031095466D9A
SHA-256:	E45301F19935BC0A202F7F5803FFB0DD4077381C73345DA559101A6C8C54E48F
SHA-512:	E966675256FCC037676E68EA4AF8E96D3292B1714BE924DEFA8C90E3288C70E803AA6074C80A440A6991EDF47F0ADF6D997AC583600BE07FF74F440FF0DB233C
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Parse and execute the command line..% C code handles the following switches: -h/-? -I -M -v../cmddict 50 dict def.cmddict begin..% ---------------- Utility procedures ---------------- %..% Get the next argument from the parsed argument list../nextarg..% - nextarg <arg> true. % - nextarg false. { argv length 0 eq. { false }. { argv dup 0 get exch dup length 1 sub 1 exch getinterval /argv e

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_fform.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3167
Entropy (8bit):	4.5436261194377
Encrypted:	false
SSDEEP:
MD5:	90C2A81602A9096978E94EEC6821A672
SHA1:	BE81971D5D7F26CFF0116264D4EC9A06CF1F9518
SHA-256:	33AE236D96E899FE295C0A6E9F6F91DFA48F3F973DB752C23D1CDA312B1D1968
SHA-512:	FC884C80D08F0EE91A0CFF5EB5CB6799F01742E6B5B1E7E2BBD201167488FC23C2F440A7382F81BB29552E98FB77D44F4F23B0B73C62573D2960455F06AF6C4B
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Form caching implemented in PostScript...% This implementation doesn't do the right thing about halftone or.% Pattern phase, but the Pattern cache doesn't either......% The Form cache key is the Form dictionary; the value is an array.% of 2 elements [CTM pattern_instance]..%.% In order to prevent restore from clearing the cache, we explicitly.% push the cache entries on the stack before a restore and reinstall them..

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_il2_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2639
Entropy (8bit):	4.899840976980188
Encrypted:	false
SSDEEP:
MD5:	84ACFFBEEEF9CF394CB9293FF4A1E785
SHA1:	1C9A6280E024114B0DCEAFE2C0E61934F9A178B2
SHA-256:	6D214623EAA952FE86018ED8690D22E7AD6DC4ABBE6D6C99B002110907841397
SHA-512:	FDD04AFF5DF15D95716964AA4B9FE507F56756C7C024B8FD8FF2385C70EB79E1C3825B06913E92C92A66ACFE662CAA5C60FA01FAE3FE643AF3ABCA6AFEF1E594
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the ISO Latin-2 (8859-2) encoding vector...% The original version of this encoding vector used Unicode names, rather.% than Adobe names, for many characters. Here are the names that appeared.% in the original version:.%.\047./quoteright./apostrophe.%.\056./period../fullstop.%.\137./underscore./lowline.%.\140./quoteleft./grave.% \055 is /hyphen in StandardEncoding, but /minus in 8859-1; we follow.% 8859-1 here

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_kanji.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4015
Entropy (8bit):	4.983388686745275
Encrypted:	false
SSDEEP:
MD5:	30F110FD100E8136695D8A78486AB68E
SHA1:	7276797487EF5107E8CA5827E1223417D50DE43D
SHA-256:	5BA833BA7702F794B584E38434B846204C6675E8CF1C1E2F0663AE2BF9C35F0E
SHA-512:	F800CD7919685CC16DF27E9CA9DABD1E6B936E292FAA304768D4B027503FF1D55975FEA65ABC1B28E833972468E31CF9F5F198E03F5D5FCBEA8AF8BFF51AF14D
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Scaffolding for Kanji fonts. This is based on the Wadalab free font.% from the University of Tokyo; it may not be appropriate for other.% Kanji fonts.../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse..% Define the encoding for the root font.../KanjiEncoding.% \x00. 0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.% \x20. 0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_ksb_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3153
Entropy (8bit):	4.087098643797712
Encrypted:	false
SSDEEP:
MD5:	402415A44EBC3D4B86793838A7D355E3
SHA1:	4059AACC7CD813CF66416D3EA29CB3CD6047D9B3
SHA-256:	C5A039519628749D40C2E218F0158ADA5C0F7B1E714A878175D790B1AC772F51
SHA-512:	9C13266605D08A4F67B7A1A60AA8F4030C18D94EF89BA0BE05EB8B24ABFDCE48569D04861F255FA020C826BF055EE712D81E72B7493A5895667F53E177A0DFB3
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the KanjiSub encoding vector../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse./KanjiSubEncoding.%\x00. /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef. /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef. /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef /.notdef. /.notdef /.notdef /.notdef /.notdef /.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_l.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (48x48), ASCII text
Category:	dropped
Size (bytes):	1945
Entropy (8bit):	3.09949714641723
Encrypted:	false
SSDEEP:
MD5:	E9712B956CFBF4F331358E6E289ACA81
SHA1:	51A75867135024FC290BCA86EDB853544914AF21
SHA-256:	FC59C26DEF746ED3AD28AD9ED70FC1B75055688B42F97AA3EAF9EF522EED0DD8
SHA-512:	40480F6F2E234AB3D9C10EC130E6E14743B02DCE6B7AF5C8AB42C20852325C875BF00CA5CE9BDC1B2B1492E9DD8856A994E005798B554787266C0C4374503A60
Malicious:	false
Reputation:	unknown
Preview:	#define gs_l.xbm_width 48.#define gs_l.xbm_height 48.#define gs_l.xbm_x_hot 0.#define gs_l.xbm_y_hot 0.static unsigned char gs_l.xbm_bits[] = {. 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x00, 0x00,. 0x00, 0x00, 0x00, 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x20, 0x03, 0x00,. 0x00, 0x00, 0x00, 0x3e, 0x03, 0x00, 0x00, 0x00, 0xff, 0x1f, 0x07, 0x00,. 0x00, 0xe0, 0xff, 0x0f, 0x07, 0x00, 0x00, 0xf8, 0xff, 0x81, 0x07, 0x00,. 0x00, 0xfc, 0x1f, 0xc0, 0x0f, 0x00, 0x00, 0xfe, 0x07, 0xf0, 0x1f, 0x00,. 0x00, 0xff, 0x01, 0xf8, 0x1f, 0x00, 0x00, 0xff, 0x41, 0xfc, 0x3f, 0x00,. 0x80, 0xff, 0xc8, 0xfc, 0x3f, 0x00, 0x80, 0xff, 0xd8, 0xf8, 0x3f, 0x00,. 0x80, 0xff, 0x98, 0xf0, 0x3f, 0x00, 0x80, 0xff, 0x10, 0xe0, 0x3f, 0x00,. 0x00, 0xff, 0x01, 0xc0, 0x3f, 0x00, 0x00, 0xff, 0x81, 0x81, 0x1f, 0x00,. 0x00, 0xfe, 0x83, 0x83, 0x1f, 0x00, 0x00, 0xfc, 0x0f, 0x83, 0x0f, 0x00,. 0x00, 0xf8, 0x1f, 0xc3, 0x03, 0x00, 0x00, 0xe0, 0x1f, 0xe0, 0x01, 0x00,. 0x00, 0xf0, 0x1f, 0x38, 0x00

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_l.xpm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	X pixmap image, ASCII text
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	2.4862764716181562
Encrypted:	false
SSDEEP:
MD5:	D609ACB8CE1C8950FA94F58911C79593
SHA1:	5E6E0B6DFAADFABF6FDA972C8643462FEF0AF4AB
SHA-256:	F6FD376366042384BC39677D306DC0371D439147F7A5A9C2ADCC7D68193736EC
SHA-512:	0019BB4085DC3C19714E24A5F95FA5369B94123114677261EBD6D034C0B18E04F50E93E73C56AEE84F224088D56F49ACBCCB9E3B527C582744CB96C78BD1E271
Malicious:	false
Reputation:	unknown
Preview:	/* XPM /.static char gs_l_xpm[] = {./* width height ncolors cpp [x_hot y_hot] /."48 48 4 1 0 0",./ colors /." .s none.m none.c none",."..s iconColor1.m black.c black",."X.s iconColor2.m white.c white",."o.s iconColor5.m black.c blue",./ pixels */." . ",." .X.. ",." .X.. ",." .XX.. ",." .....XX.. ",." .............XXX... ",." ...............XXXX... ",." ..............XXXXXX.... ",." ...........XXXXXXXXX...... ",." ..........XXXXXXXXX......... ",." .........XXXXXXXXXX.......... ",." .........XXXXXoXXX............ ",." .........XXXoXXooXX............ ",." .........XXXooXooXXX........... ",." .........X

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_l_m.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (48x48), ASCII text
Category:	dropped
Size (bytes):	1955
Entropy (8bit):	3.045471538186586
Encrypted:	false
SSDEEP:
MD5:	126B26A3AB513A456DEEA90C5BA00826
SHA1:	FFA56C3F787A2DAEBE2B898F44A5E2EE42AD7DF2
SHA-256:	C2C75908097A02B1F9DCCF8B732BC1003A9DF20C0920BBF2C4056B23FEFA6606
SHA-512:	B93F5C6A2DD962B592F0FEAFCA9BC09B92E0E45D90050F0524EADCEC9DA163E0C6781F0BE7FF0DBE1F6794F0006D4F5DFFDFBFAE645708294C5F16A0070E1090
Malicious:	false
Reputation:	unknown
Preview:	#define gs_l_m.xbm_width 48.#define gs_l_m.xbm_height 48.#define gs_l_m.xbm_x_hot 0.#define gs_l_m.xbm_y_hot 0.static unsigned char gs_l_m.xbm_bits[] = {. 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x00, 0x00,. 0x00, 0x00, 0x00, 0xe0, 0x01, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x03, 0x00,. 0x00, 0x00, 0x00, 0xfe, 0x03, 0x00, 0x00, 0x00, 0xff, 0xff, 0x07, 0x00,. 0x00, 0xe0, 0xff, 0xff, 0x07, 0x00, 0x00, 0xf8, 0xff, 0xff, 0x07, 0x00,. 0x00, 0xfc, 0xff, 0xff, 0x0f, 0x00, 0x00, 0xfe, 0xff, 0xff, 0x1f, 0x00,. 0x00, 0xff, 0xff, 0xff, 0x1f, 0x00, 0x00, 0xff, 0xff, 0xff, 0x3f, 0x00,. 0x80, 0xff, 0xff, 0xff, 0x3f, 0x00, 0x80, 0xff, 0xff, 0xff, 0x3f, 0x00,. 0x80, 0xff, 0xff, 0xff, 0x3f, 0x00, 0x80, 0xff, 0xff, 0xff, 0x3f, 0x00,. 0x00, 0xff, 0xff, 0xff, 0x3f, 0x00, 0x00, 0xff, 0xff, 0xff, 0x1f, 0x00,. 0x00, 0xfe, 0xff, 0xff, 0x1f, 0x00, 0x00, 0xfc, 0xff, 0xff, 0x0f, 0x00,. 0x00, 0xf8, 0xff, 0xff, 0x03, 0x00, 0x00, 0xe0, 0xff, 0xff, 0x01, 0x00,. 0x00, 0xf0, 0xff,

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_lgo_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2742
Entropy (8bit):	4.762687178495115
Encrypted:	false
SSDEEP:
MD5:	3B8B5411DCF79EA552DC8DD785A60F8F
SHA1:	8D1A66C627CAE9D6366A72EC4AEBA23E04483A5B
SHA-256:	8646340F73EA9DF08BB52265120076FB0A172D0412EA9559F2D9A760B22A5D38
SHA-512:	F3DC862147B9F3C55CDFC891CF1A551668F31551AEE73C23952A61707AEA441C83CFBD257C5322CD8BDCD85016EB35140B83010B8C754DCA7746FFB02DC6D7CD
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the Adobe "original" Latin glyph set..% This is not an Encoding strictly speaking, but we treat it like one../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse./AdobeLatinOriginalGlyphEncoding mark../.notdef./A /AE /Aacute /Acircumflex /Adieresis /Agrave /Aring /Atilde./B./C /Ccedilla./D./E /Eacute /Ecircumflex /Edieresis /Egrave /Eth./F./G./H./I /Iacute /Icircumflex /Idie

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_lgx_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	4.80366348277299
Encrypted:	false
SSDEEP:
MD5:	8477F23F765B87CCFE47758EBF086D07
SHA1:	7A9BF3A0240872A711612D0C0D34155760FAB8FE
SHA-256:	AA712E06DBC763709DF30D89C9984559DA51A95B98962EEF282D32DA173E42FC
SHA-512:	4C64F27ECF623EAB6A16E70D6DC4AADD8324D88B04D8D373FAADA4E677CA97F8A76AC04E2444F0684F0D81397BFD2D1552C404EC03772B142E04A0F0ED4F9C1F
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the Adobe "extension" Latin glyph set..% This is not an Encoding strictly speaking, but we treat it like one../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse./AdobeLatinExtensionGlyphEncoding mark../Abreve /Amacron /Aogonek./Cacute /Ccaron /Dcaron./Dcroat /Delta./Ecaron /Edotaccent /Emacron /Eogonek./Gbreve /Gcommaaccent./Idotaccent /Imacron /Iogonek./Kcommaaccent./Lacu

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_m.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (32x32), ASCII text
Category:	dropped
Size (bytes):	945
Entropy (8bit):	3.471181878623591
Encrypted:	false
SSDEEP:
MD5:	45FDFEC41CD9CCCABEFC539515FC099E
SHA1:	D4F2C196EABA3D7707C15C3E0408F16C1384951B
SHA-256:	E5F468D6370111399618B78BED865B7F5A913B922754AAFE0E783C4475DBBF4C
SHA-512:	3155265696AAA0F3A9E21F6FD84D0E8B4D3A778CB7D1A76829ABDED51CD2A55926710A4C4A6495AA3A1FD49B17CFA7ED978D3FB35CAE4214E476A0F3D88FE764
Malicious:	false
Reputation:	unknown
Preview:	#define gs_m.xbm_width 32.#define gs_m.xbm_height 32.#define gs_m.xbm_x_hot 0.#define gs_m.xbm_y_hot 0.static unsigned char gs.m.bm_bits[] = {. 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x48, 0x00,. 0x00, 0xf8, 0xc7, 0x00, 0x00, 0xff, 0xc1, 0x00, 0x80, 0x3f, 0xf0, 0x00,. 0xc0, 0x0f, 0xf8, 0x01, 0xc0, 0x87, 0xfc, 0x03, 0xe0, 0xa7, 0xfc, 0x03,. 0xe0, 0x27, 0xf8, 0x03, 0xe0, 0x07, 0xf0, 0x03, 0xc0, 0x0f, 0xe3, 0x01,. 0x80, 0x1f, 0xe3, 0x00, 0x00, 0x3f, 0x60, 0x00, 0x00, 0x7c, 0x10, 0x00,. 0xc0, 0x3f, 0x00, 0x00, 0xe0, 0x03, 0x00, 0x00, 0xf0, 0x07, 0x00, 0x00,. 0xf0, 0xff, 0x7f, 0x00, 0xf0, 0xff, 0xff, 0x03, 0xe0, 0xff, 0xff, 0x07,. 0xc0, 0xff, 0xff, 0x0f, 0x00, 0xff, 0xff, 0x1f, 0x00, 0x00, 0xe0, 0x1f,. 0xf0, 0x00, 0x80, 0x0f, 0x78, 0x10, 0x80, 0x07, 0x78, 0x10, 0xc0, 0x13,. 0x70, 0xe0, 0xff, 0x08, 0xf0, 0x00, 0x00, 0x06, 0xc0, 0x03, 0xe0, 0x01,. 0x00, 0xff, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_m.xpm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	X pixmap image, ASCII text
Category:	dropped
Size (bytes):	1437
Entropy (8bit):	3.1401243914719346
Encrypted:	false
SSDEEP:
MD5:	5CBE7434E932D0361DDFFFC223B6CF85
SHA1:	75A26C21D10D36E24A4A0A33F8B89978ACD69E8C
SHA-256:	7B255806A18B67CA77AE48958C53E672DEAF1DA5202588F76A92DB43CD93E254
SHA-512:	6A10A8FB7C46A6BD4F07A1C51FF744A1F75303A989CE65E54A500F4C718576845BA8A0259E5025586FF7466D5EAC40EB786CB0C5B9C42B2172B7D74A95261F55
Malicious:	false
Reputation:	unknown
Preview:	/* XPM /.static char gs_m_xpm[] = {./* width height ncolors cpp [x_hot y_hot] /."32 32 6 1 0 0",./ colors /." .s none.m none.c none",."..s iconColor1.m black.c black",."X.s iconColor2.m white.c white",."o.c #C0C0C0C0C0C0",."O.c #808080808080",."+.c #00000000FFFF",./ pixels */." .X ",." .X. ",." .XX. ",." ........XXX.. ",." .........oXXXo.. ",." .......XXXXXXO... ",." ......XXXXXXX...... ",." .....XXXX+XX........ ",." ......XX+X+XX........ ",." ......XX+XXXXX....... ",." ......XXXXXXXXX...... ",." ......XXXX++XXX.... ",." .....OXXX++XXX... ",." ......XXXXXXX.. ",." .....XXXXX. ",." ........XXXXXXX ",." .....XXXXXXXXXXXX ",." .......XXXXXXXXXXXX ",." ...................X ",." ......................

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_m_m.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (32x32), ASCII text
Category:	dropped
Size (bytes):	955
Entropy (8bit):	3.4202727268968602
Encrypted:	false
SSDEEP:
MD5:	BA6414662C58B2D6D01ABDCEFF239330
SHA1:	CB734A07EEA4CD9B828E351C4CD9CB7D2307E423
SHA-256:	83A2CC50C827166FDEFCC8F5A3A1FB59D3E1EEA5E5A7C31276FF165BD32FD94E
SHA-512:	F720EAC6ADD259B5536DAFA739D9477869A9AE94FAA043CF00B8AB9849EB0AED224071026AB0711F71E94C8F9CB5E1905E234CE3FA3168A6F6B2C3E401EF33E6
Malicious:	false
Reputation:	unknown
Preview:	#define gs_m_m.xbm_width 32.#define gs_m_m.xbm_height 32.#define gs_m_m.xbm_x_hot 0.#define gs_m_m.xbm_y_hot 0.static unsigned char gs.m_m.bm_bits[] = {. 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x78, 0x00,. 0x00, 0xf8, 0xff, 0x00, 0x00, 0xff, 0xff, 0x00, 0x80, 0xff, 0xff, 0x00,. 0xc0, 0xff, 0xff, 0x01, 0xc0, 0xff, 0xff, 0x03, 0xe0, 0xff, 0xff, 0x03,. 0xe0, 0xff, 0xff, 0x03, 0xe0, 0xff, 0xff, 0x03, 0xc0, 0xff, 0xff, 0x01,. 0x80, 0xff, 0xff, 0x00, 0x00, 0xff, 0x7f, 0x00, 0x00, 0xfc, 0x1f, 0x00,. 0xc0, 0xff, 0x1f, 0x00, 0xe0, 0xff, 0x3f, 0x00, 0xf0, 0xff, 0x7f, 0x00,. 0xf0, 0xff, 0xff, 0x00, 0xf0, 0xff, 0xff, 0x03, 0xe0, 0xff, 0xff, 0x07,. 0xc0, 0xff, 0xff, 0x0f, 0x00, 0xff, 0xff, 0x1f, 0x00, 0xfe, 0xff, 0x1f,. 0xf0, 0xff, 0xff, 0x1f, 0xf8, 0xff, 0xff, 0x1f, 0xf8, 0xff, 0xff, 0x1f,. 0xf0, 0xff, 0xff, 0x0f, 0xf0, 0xff, 0xff, 0x07, 0xc0, 0xff, 0xff, 0x01,. 0x00, 0xff, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_pfile.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4457
Entropy (8bit):	4.6331658194769085
Encrypted:	false
SSDEEP:
MD5:	FC6A3F4746D5DF6C774F641AA74CF67D
SHA1:	603E5681AB493E9250EC29E410F37F6FDE352AEF
SHA-256:	8D8807900431F96ABAFACB5211C79955F1B1749AD3CC371857C47D35721C27DB
SHA-512:	2C9A569EF26A0D3628270E29498207D6C017758CD3D764EDC7AFCB312ABAA63EBF90E62DED5F46B134D54D984FB5D81EB6C5A46FAA7C44ED47D24D9B4E8ADCAA
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Runtime support for minimum-space fonts and packed files...% **** NOTE: This file must be kept consistent with.% **** packfile.ps and wrfont.ps...% ---------------- Packed file support ---------------- %..% A packed file is the concatenation of several file groups, each of which.% is the result of compressing several files concatenated together..% The packed file begins with a procedure that creates an appropriat

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_rdlin.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	724
Entropy (8bit):	4.8406109976832745
Encrypted:	false
SSDEEP:
MD5:	FDFA5B09C7CAF0DA01F741C0D0DD3470
SHA1:	7A790B91C0DF8548F7346F54CA053ACA7EDBFB3D
SHA-256:	A56FE34B65F5A32C388D36CC07D2BC17A590C60495AC913C7CB692534530F9F3
SHA-512:	A9FD4C1ED8834E0443A27B1C858395B441F069C4BF36D17DF0F24F50796B3EB7415861625994BA9B02C4331772041B3AC4424C9F89941093FD1EE315500654F9
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Patch for systems with readline support in the interpreter...% Disable the prompt message, since readline will generate it../.promptmsg { } def.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_s.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (24x24), ASCII text
Category:	dropped
Size (bytes):	594
Entropy (8bit):	3.8945489669190514
Encrypted:	false
SSDEEP:
MD5:	A9D52B3617F779A636D62D3478A3DB3B
SHA1:	A9289B853683D91A40F65497ABAACD2B01E3C440
SHA-256:	B314EB8B372A6D4ECCFC8E5C707A0C0AC5D3893B964F21758874A3E1F21FB948
SHA-512:	4B13193F5CBE0548B695C3C66B1A08473781A471B5468198F07B725ED014D5BE89D906549D6629B1DBE28489A695CA69E2148FE0124D873DBD15CC5E88D690E2
Malicious:	false
Reputation:	unknown
Preview:	#define gs_s.xbm_width 24.#define gs_s.xbm_height 24.#define gs_s.xbm_x_hot 0.#define gs_s.xbm_y_hot 0.static unsigned char gs.s.bm_bits[] = {. 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x80, 0x08, 0x00, 0x00, 0x13,. 0x00, 0x00, 0x33, 0x00, 0xfe, 0x31, 0xe0, 0xff, 0x38, 0xf0, 0x3f, 0x38,. 0xf8, 0x07, 0x7e, 0xfc, 0x01, 0x7f, 0xfe, 0x90, 0x7f, 0x7e, 0x94, 0x7f,. 0x7e, 0x84, 0x7f, 0x7e, 0x00, 0x7f, 0x7e, 0x00, 0x7e, 0xfc, 0x60, 0x7c,. 0xfc, 0x61, 0x38, 0xf8, 0x03, 0x38, 0xf8, 0x03, 0x18, 0xf0, 0x07, 0x0c,. 0xc0, 0x0f, 0x06, 0xc0, 0x07, 0x03, 0xf0, 0x01, 0x00, 0x00, 0x00, 0x00};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_s.xpm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	X pixmap image, ASCII text
Category:	dropped
Size (bytes):	957
Entropy (8bit):	3.782009464562276
Encrypted:	false
SSDEEP:
MD5:	469C00E492E5D773C29480BF0BA06BF3
SHA1:	4BFED86759884BE5F4B03B474165279ED18FE1BA
SHA-256:	AAE679C392CB58F89927007FD5F2D42E686C9AA45E3C8AABEB794C635C3E450F
SHA-512:	5DE015D0068917001CB846744FC75D27BC4928EB9237A62C044E9439DD51DD6BF98242FB6BB3546EF2B7EE7191D01B8E1488E8783B4749B9A823984DF082D752
Malicious:	false
Reputation:	unknown
Preview:	/* XPM /.static char gs_s_xpm[] = {./* width height ncolors cpp [x_hot y_hot] /."24 24 6 1 0 0",./ colors /." .s none.m none.c none",."..c #808080808080",."X.s iconColor1.m black.c black",."o.c #C0C0C0C0C0C0",."O.s iconColor2.m white.c white",."+.c #00000000FFFF",./ pixels */." ",." .. ",." XoOo. ",." X.OoX ",." X.OoX. ",." .XXXXXX.oOoXX ",." ..XXXXXXXX.oOO.XX ",." XXXXXXXX..oOOOo.XX ",." XXXXXXX.OOOOOo.XXXX. ",." XXXXXX.OOOOOOOXXXXXXX ",." .XXXXX.OOOO+OOXXXXXXXX ",." XXXXXXOOO+O+OOXXXXXXXX ",." XXXXXXOOO+OOOOXXXXXXXX ",." XXXXXXOOOOOOOOOXXXXXXX ",." .XXXXXOOOOOOOOOO.XXXXX ",." XXXXXXOOOOO++OOO.XXXX ",." .XXXXX.OOOO++OOOoXXX ",." XXXXXX.OOOOOOOOOXXX ",." .XXXXXXoOOOOOOOoXX ",." .XXXXXXoOOOOOo.X ",." .XXXXXOOOOO.X ",." .XXXXOOOOO.. ",." XXXXXOOOOOOOO ",." "};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_s_m.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (24x24), ASCII text
Category:	dropped
Size (bytes):	604
Entropy (8bit):	3.811147256026612
Encrypted:	false
SSDEEP:
MD5:	CE3C1A51871A0436138CA55AB4693FEB
SHA1:	6ACDCC902D5B89E12E27F01C57469C228AE050D9
SHA-256:	8DFD0B7CEC0E1D5EB0B9605C3A5914B9C1CBF181C102140EA282650CE7D324DD
SHA-512:	B5DE9FF3CC5E3881EC89D0339A6E3F8FBE1338C794A5F55F88A8A7D85DE8522125472CDD6D05B26FA9A402F326382FE48251ACD6450CF6C5A768B23370D763B2
Malicious:	false
Reputation:	unknown
Preview:	#define gs_s_m.xbm_width 24.#define gs_s_m.xbm_height 24.#define gs_s_m.xbm_x_hot 0.#define gs_s_m.xbm_y_hot 0.static unsigned char gs.s_m.bm_bits[] = {. 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x80, 0x0f, 0x00, 0x00, 0x1f,. 0x00, 0x00, 0x3f, 0x00, 0xfe, 0x3f, 0xe0, 0xff, 0x3f, 0xf0, 0xff, 0x3f,. 0xf8, 0xff, 0x7f, 0xfc, 0xff, 0x7f, 0xfe, 0xff, 0x7f, 0xfe, 0xff, 0x7f,. 0xfe, 0xff, 0x7f, 0xfe, 0xff, 0x7f, 0xfe, 0xff, 0x7f, 0xfc, 0xff, 0x7f,. 0xfc, 0xff, 0x3f, 0xf8, 0xff, 0x3f, 0xf8, 0xff, 0x1f, 0xf0, 0xff, 0x0f,. 0xc0, 0xff, 0x07, 0xc0, 0xff, 0x03, 0xf0, 0xff, 0x01, 0x00, 0x00, 0x00};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_t.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (16x16), ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.347252184489383
Encrypted:	false
SSDEEP:
MD5:	07D618DA986E47F205F8024B4F7C7D8C
SHA1:	CEB225908B24959168056D302AA29F6A939FC790
SHA-256:	CF42461B5D011B0360142F17628AD17D9C066068E45E0399E1B88257C00BF8B7
SHA-512:	D931404583E938CCBE618C6E871E8FBF9D31C4C2FF2EFA2C0EA6C6AF5B393747965A242E18622CD800D8042698A93A9B2C7753EA2A51A49AC7921C07A7C0FF45
Malicious:	false
Reputation:	unknown
Preview:	#define gs_t.xbm_width 16.#define gs_t.xbm_height 16.#define gs_t.xbm_x_hot 0.#define gs_t.xbm_y_hot 0.static unsigned char gs.t.bm_bits[] = {. 0x00, 0x10, 0x00, 0x20, 0x00, 0x68, 0xf0, 0x67, 0xfc, 0x61, 0x7e, 0x70,. 0x1f, 0xf9, 0x4f, 0xfd, 0x4f, 0xfc, 0x0f, 0xf8, 0x1f, 0xf3, 0x1e, 0xe3,. 0x3e, 0x60, 0x7c, 0x30, 0x70, 0x0c, 0x1e, 0x00};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_t.xpm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	X pixmap image, ASCII text
Category:	dropped
Size (bytes):	605
Entropy (8bit):	4.2978254201964345
Encrypted:	false
SSDEEP:
MD5:	079193F2163939114F752DB5103DA851
SHA1:	A731A325C76D470EBA0B9670078ECECB123B84DC
SHA-256:	CD6F58F5D43276A1B8788DB6250D30F8FD971C35C7843FFE79DE337EA400A727
SHA-512:	C5C30DDF3D4317681EBC3711B7FF42A3A53C53DD742406D30C645C4AB8A5205900C693DD1DF0413EFD44A0E1D2BF5EC89AE7A5D1596FCECCFCBF2862AAD95C33
Malicious:	false
Reputation:	unknown
Preview:	/* XPM /.static char gs_t_xpm[] = {./* width height ncolors cpp [x_hot y_hot] /."16 16 6 1 0 0",./ colors /." .s none.m none.c none",."..s iconColor1.m black.c black",."X.s iconColor2.m white.c white",."o.c #808080808080",."O.c #C0C0C0C0C0C0",."+.c #00000000FFFF",./ pixels */." . ",." X. ",." .X.o ",." o......XX.. ",." .......OXXX.. ",." ......XXXXXo.. ",."o....XXX+XX.....",."....XX+X+Xo.....",."....XX+XXXo.....",."....XXXXXXX.....",."o...oXXX++XX....",." ....XXX++XXX..o",." ....oXXXXXXX.. ",." .....XXXXX.. ",." ...XXXoo ",." o...XXXXXXX "};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_t_m.xbm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	xbm image (16x16), ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.198427194418165
Encrypted:	false
SSDEEP:
MD5:	1C1D8DC9A34BA98D8B534DDAEF385440
SHA1:	3770472CC6B1B7FA489F1407B97300C55E7142C5
SHA-256:	E0E68139137EC2FC8ABC1B835A70BE795CF575921BD13C607304535724CD3AB4
SHA-512:	6F35207BB8D106A64401A0B7ECFB617E7912E49869770CFB022E2292781715BA29BF7DEF1E192DF2A416258BCCC0CDC69D8C37F990D31749738F00C834C298ED
Malicious:	false
Reputation:	unknown
Preview:	#define gs_t_m.xbm_width 16.#define gs_t_m.xbm_height 16.#define gs_t_m.xbm_x_hot 0.#define gs_t_m.xbm_y_hot 0.static unsigned char gs.t_m.bm_bits[] = {. 0x00, 0x10, 0x00, 0x30, 0x00, 0x78, 0xf0, 0x7f, 0xfc, 0x7f, 0xfe, 0x7f,. 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff,. 0xfe, 0x7f, 0xfc, 0x3f, 0xf0, 0x0f, 0xfe, 0x0f};.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_wl1_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	4.693887817949921
Encrypted:	false
SSDEEP:
MD5:	656D88396276C41418AF7FAFFD59A9FA
SHA1:	39826E217F7CBDFC2D42532AFF2DBDAD29EC8524
SHA-256:	9D26C954DFC6A435BAD6F882860673DC4965A623CA4FF495A64FCA1FC41BCF4A
SHA-512:	013017B59B03F86FCAE10EEF4F2C572A56C519A7930ABB372B559988BD962F05A8C69B240CE5BAF6A38BAFCAFA18B3B7EEF6D59329E21B23FC30548C436BA335
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the Windows 3.1 Latin 1 encoding vector (H-P Symbol set 19U)../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse./Win31Latin1Encoding.ISOLatin1Encoding 0 39 getinterval aload pop. /quotesingle.ISOLatin1Encoding 40 5 getinterval aload pop. /hyphen.ISOLatin1Encoding 46 50 getinterval aload pop. /grave.ISOLatin1Encoding 97 30 getinterval aload pop. /graybox.% \20x

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_wl2_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	4.703535546859324
Encrypted:	false
SSDEEP:
MD5:	228C5A51491AEDC0AD6CDED49E6AB95C
SHA1:	0C654CE49909DEE70C8E3DCABC150DD0890D32A2
SHA-256:	A0387C0608B619303F7F58BE45DB44BA4ECFCEE3A1E8F1C1CC7447DE2CB54666
SHA-512:	76576D790528C6D1EFE597DEBEE8B6A3B3B27172F6E80D5B73C6F59B61812A156B586542DB7B9D80ACE57F41772850CEAF146E46B07E9BA8058842F4185D9F8D
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the Windows 3.1 Latin 2 encoding vector (H-P Symbol set 9E)../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse./Win32Latin2Encoding.ISOLatin1Encoding 0 39 getinterval aload pop. /quotesingle.ISOLatin1Encoding 40 5 getinterval aload pop. /hyphen.ISOLatin1Encoding 46 50 getinterval aload pop. /grave.ISOLatin1Encoding 97 30 getinterval aload pop. /graybox.% \20x.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gs_wl5_e.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2520
Entropy (8bit):	4.6925047860517255
Encrypted:	false
SSDEEP:
MD5:	60BA35A29265FD16A55DABF6AB5FED3C
SHA1:	C4657AF8D02F1D48508B24C65101A4149873B483
SHA-256:	E3A319BF74795847D2F2EE3D65BCA474CB67693C4B655DCD72F1309C66446F06
SHA-512:	D4161A44DF193892EDAA1EE973AD07044D6DC24407CE283C17569B2697484E7CAD351D3334B271CEDABE18BB5C7414660FB01E6821CC2151E8B3C8650F362393
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Define the Windows 3.1 Latin 5 encoding vector (H-P Symbol set 5T)../currentglobal where. { pop currentglobal { setglobal } true setglobal }. { { } }.ifelse./Win32Latin5Encoding.ISOLatin1Encoding 0 39 getinterval aload pop. /quotesingle.ISOLatin1Encoding 40 5 getinterval aload pop. /hyphen.ISOLatin1Encoding 46 50 getinterval aload pop. /grave.ISOLatin1Encoding 97 30 getinterval aload pop. /graybox.% \20x.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsbj

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.307979542644588
Encrypted:	false
SSDEEP:
MD5:	3E0F1FB7057A72D723DDD3DAD21FBFE1
SHA1:	7B99951BE618A8A269B8F2E77D019435D3B1819E
SHA-256:	73B93BB5880989DC8163C5A988E2CF8973B0634ECB2B6F0998382E27558DAF50
SHA-512:	944BC5B16C35873B9EF24B9ADE7F70A05D4B58D04892066BE420A6EE37F2350A484CB06CA7B38A8E3024BAA292C9C49F3ABF23B56139F0A55D6EA318948EB3C9
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -sDEVICE=bj10e -r180 -P- -dSAFER -dNOPAUSE -sPROGNAME=$0 -- gslp.ps --heading-center "`date`" "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsbj.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	5.069793137141017
Encrypted:	false
SSDEEP:
MD5:	09FE49F06BF6EFDB213F745E5C5920C2
SHA1:	E284A4595181346C96257A7D3005405FF3D96D1B
SHA-256:	1D696B72201EDA12BB76665C5D7F6EFA86AA7437BB87CF1D6F20781B804E3064
SHA-512:	CF2712CC844B0206B669E6C8E71D8F71AFB77749E25440777FAFDEB513A4E043AEE9C52B4180A18009971C494DB7EE446C4C9190659822E9F27E612A163B2FE6
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -q -sDEVICE=bj10e -r180 -P- -dSAFER -dNOPAUSE -sPROGNAME=gsbj -- gslp.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdj

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.282762866848505
Encrypted:	false
SSDEEP:
MD5:	FFE979C954587F9807E99751CB971B2C
SHA1:	0D9851865AAEF2537C11ADE224F46A0AD904D520
SHA-256:	9C56BDF6D8CE23909E947E39385E6BFD7FC8EC7C5E98FF2F0DDB12896357A940
SHA-512:	B9124749203219359813550ED81BB6FCB053EACA8618951590DD3DDF1B8EC748304248F9E3CC91B056F839E5F9AAEAC897CF9FC7064D9BD76504FFD0B7CE40DF
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -sDEVICE=deskjet -r300 -P- -dSAFER -dNOPAUSE -sPROGNAME=$0 -- gslp.ps --heading-center "`date`" "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdj.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.063995733056198
Encrypted:	false
SSDEEP:
MD5:	FDF4B7FA98573492A62B6CCA14815FDE
SHA1:	20DD22F0D87E0562D27EA8095223AB833A9229E9
SHA-256:	6178A4DB4FF75FCC0962E3BBF04D4D5A11427755CCEC07E26F0A0E6C0D18D184
SHA-512:	276B18AA3348DBCEAA114A28D9D0FAEA37F8C34105338756B01427B9BA3B1492BAC9AC634CBE0BEE8DBAEB42BBE745B531FFF3411E289C540028CE0F3282A51F
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -q -sDEVICE=deskjet -r300 -P- -dSAFER -dNOPAUSE -sPROGNAME=gsdj -- gslp.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdj500

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.299114275351948
Encrypted:	false
SSDEEP:
MD5:	925912183B9F5501CCBAB61B3DAEC875
SHA1:	01EB8767C233B6AB8607A1711D1666149DBAC2ED
SHA-256:	0CD91333EFE62FE105C834145CB3E1D301D54022F6F3546E69E11C51F55BBBC3
SHA-512:	389402289D1F4769317B31AFC81A2FF6171125CEB9A73A2510EC74DF769B351F52D34C7FA8A4081769BB225A8BDAB12C2E9FD158F54D56CC870C7F9376F118B6
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -sDEVICE=djet500 -r300 -P- -dSAFER -dNOPAUSE -sPROGNAME=$0 -- gslp.ps --heading-center "`date`" "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdj500.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	5.069363885757695
Encrypted:	false
SSDEEP:
MD5:	A128F19C0DEDEBD0DE6AD344A4D0F01E
SHA1:	B8754C9B2F39B214F0D3DC5011498A8BAE5F1134
SHA-256:	1E0F4C01A5520DAA511E4D1B4980923FFD7C2764DCA1679D8F58B732499465D0
SHA-512:	99BD60A1FFF82993C059631900BC7CBF635A6BFC69E37C24F458C7FE9AB2A543941D3603BDFA75B020EEF677074F5DD37B837FC6605493E21F1158E38317C2C8
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -q -sDEVICE#djet500 -r300 -P- -dSAFER -dNOPAUSE -sPROGNAME=gsdj500 -- gslp.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdll32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12574720
Entropy (8bit):	6.461964505511186
Encrypted:	false
SSDEEP:
MD5:	0A7A31DBC07FF508B0FB60B9E5527540
SHA1:	3CE461F8A0AEF4058EE274279AFAAB2A77AB1F0A
SHA-256:	3950D208997FCC29448BE2D2AEF61CA4E6267353973F573165BBAA2D3C3589E7
SHA-512:	871264637DCEBC913EF957ABE521DD0A8820E3AD654B5F57794AF7D9D3FDDEED8E65603A3A79E63794E989A955967A9A2E3BD768CC5A7BB66779201B304DA186
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y......Tl..........!...n....n.....n.....n....n....n...Rich..........PE..L...H+"P...........!.........p......-5-...................................... .......................................KM.A....:M.....................................................................0M.@...............`............................text.............................. ..`.rdata..1...........................@..@.data.....o..PM..`o..PM.............@....rsrc..............................@..@.reloc..6R.......`..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsdll32.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	8014
Entropy (8bit):	5.098442000009014
Encrypted:	false
SSDEEP:
MD5:	F049424A0DB33D7DAC4B76B3D5422B5E
SHA1:	47EB8FC7899B21A55184F60899BC76934748A6B8
SHA-256:	23A5A16E7A93B19F266FA6C8B5FCB926E443C7A14286C18BFCA9701EBCDE2774
SHA-512:	BBE6C5EB3228DA8409F692DDD76DEA4BA679EB89B8FB57E32EB37DFD44AB0F3B70021FAD448016D00701815A85D8884BF1FD575BA2D252CA6589256FF72EBE89
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 1344416584 0 1684 `....;..."...L...............F...F...........................<...<........... ... ...l...l...\|...\|...........\...\...........v...v...................................>...>...................T...T...........$...$...........&...&................__IMPORT_DESCRIPTOR_GSDLL32.__NULL_IMPORT_DESCRIPTOR..GSDLL32_NULL_THUNK_DATA._DllEntryPoint@12.__imp__DllEntryPoint@12._DllMain@12.__imp__DllMain@12.__imp__gsdll_revision@16._gsdll_revision@16.__imp__gsdll_init@16._gsdll_init@16.__imp__gsdll_execute_begin@0._gsdll_execute_begin@0.__imp__gsdll_execute_cont@8._gsdll_execute_cont@8.__imp__gsdll_execute_end@0._gsdll_execute_end@0.__imp__gsdll_exit@0._gsdll_exit@0.__imp__gsdll_lock_device@8._gsdll_lock_device@8.__imp__gsdll_copy_dib@4._gsdll_copy_dib@4.__imp__gsdll_copy_palette@4._gsdll_copy_palette@4.__imp__gsdll_draw@16._gsdll_draw@16.__imp__gsdll_get_bitmap_row@20._gsdll_get_bitmap_row@20.__imp__gsapi_revision@8._gsapi_revision@8.__im

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gslj

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.280311659255097
Encrypted:	false
SSDEEP:
MD5:	4C7B5857DB3F1C52A07D5FEDA1370107
SHA1:	82D222560489626F211558033EF85A69B4B62F29
SHA-256:	17F2C028789D01E46FF751D2F1046570B8915F7D2901FD1A3A010532DDFA4E5E
SHA-512:	F79095211C4D48E131A8FB68264D69D4426E3AC4CEB153400399C2398BDC25EA4AC31452DF891BC9222604F9B30DE2D6500ABAF1041E4A7E0B6FC3C22C7C99BD
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -sDEVICE=laserjet -r300 -P- -dSAFER -dNOPAUSE -sPROGNAME=$0 -- gslp.ps --heading-center "`date`" "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gslj.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	5.055584037314278
Encrypted:	false
SSDEEP:
MD5:	B39534F9E53A4FCC4F28CF99FCEDF6B1
SHA1:	C2A0A55039BD93D114A536525425733A78D50E59
SHA-256:	7A493BE398F6B55A9D84A2DDD5A8FC1DA41EB0B4AF7F6953A536A81AFB335F03
SHA-512:	6E257A896F093BDFBC4ED880194BB45860C2971AFFFF51BB12F83CCE8CFE5E4BDE6AF86562E23B4429CBE4BC86D06469A8093062EDD08CF932AED40629D83596
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -q -sDEVICE=laserjet -r300 -P- -dSAFER -dNOPAUSE -sPROGNAME=gslj -- gslp.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gslp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.283742950093011
Encrypted:	false
SSDEEP:
MD5:	3BC5DFAF7525C2D7FCEEC5DB6165D326
SHA1:	3E77E6D9057E1FC43B9EC837C79A5DA15D170BA3
SHA-256:	7597509E1FA96D1EE307CD067AEF40F820FFABACDF11E6E1E14A58B7A1F79F6E
SHA-512:	B889ED3D0D015DED502A1AE57CA90460C16D754EAD15183237D92E3BAA578EA77CD6A9C480D6823FCA3E74505EB294CD8C5A757ACBE9A39547B6DF0250570EA2
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -sDEVICE=epson -r180 -P- -dSAFER -dNOPAUSE -sPROGNAME=$0 -- gslp.ps --heading-center "`date`" "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gslp.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	5.03348522594411
Encrypted:	false
SSDEEP:
MD5:	A66ED14A1C9E5A6C6D01DB13F8671E45
SHA1:	82AD24884D7F5A200FB37C6ACCB6C1449EAB2A27
SHA-256:	6DAB7D4EA8D68116F0E1C8F2E0902FABF96FFBF80DD6BE87FAFE16A20CF5B5CE
SHA-512:	023D86031FEF4BD7F78E47A5B27C47C12C68637DA215F972E275A97DB080413864921CF1590EDA99E508E05B270A08F053AEACBE7DA7C0BDC6AF55694AF3CDFB
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -q -sDEVICE=epson -r180 -P- -dSAFER -dNOPAUSE -sPROGNAME=gslp -- gslp.ps %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gslp.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20094
Entropy (8bit):	4.732510197867417
Encrypted:	false
SSDEEP:
MD5:	217BB99B6F32F516C17DA7F332B2D68D
SHA1:	3478AC722F6FA9C2E10520425D767B31F6D8FC18
SHA-256:	0E33C3897532F3619A83B8F061E760C5F0DFD91EE3ECFA9FF036398426FE5029
SHA-512:	496406C53CA177CCDAB106AF89E282DB9759CFB8EF68AEF427E5ACF7A417D6307387EDF810DB70FB4EE02A4A6F2D690196D52F6C491C658CB211EE564C8A1720
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% gslp.ps - format and print text..% This utility provides functionality approximately equivalent to the Unix.% `enscript' program. It prints plain text files using a single font..% It currently handles tabs and formfeeds, but not backspaces..% It will line-wrap when using fixed-pitch fonts..% It will also do kerning and width adjustment..% Standard switches implemented:.%.-12BclqRr -b<header> -f<font> -F<hfont> -L<li

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsnd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.205569966605787
Encrypted:	false
SSDEEP:
MD5:	711B0BD8EB0A06BDD9C0540E9C9445EB
SHA1:	C39C0B3D8457B3E4E104D2F0FB507F761BA9ADC6
SHA-256:	577BEC95C32036730167A13D6A5CD9D1C97FF46709DE39ED08D6E46C03A6AFDD
SHA-512:	4455667F16949702C1A00731CB162C714529043CA65BCFC5FC971EDFDA7529CEEFFEF94F43065B737A6AA65861370D7367A5853956AF5C0E211CA1043848E9DF
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -P- -dSAFER -dNODISPLAY "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsnd.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.916689196037588
Encrypted:	false
SSDEEP:
MD5:	6FC26133FCAF67CBAD5D0F315D8B8149
SHA1:	46076C1353493EC7F904D8979A4EEB901AD881B6
SHA-256:	013ED3002AF394866B5BF7183E47647851C2414442A90BAF23D23EEA79BF509B
SHA-512:	6B9740E78523F60DBCEF4239277E509EA04A7B693451175709781602DE3CABF1F9C1EBF17D6417FAC18A25AE48E7EFBFACEB4D106B64BE3FE5A931C2FD41A7E0
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -P- -dSAFER -DNODISPLAY %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsndt.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.928933803601768
Encrypted:	false
SSDEEP:
MD5:	5BC0A2090A05779D8AE6BFC6FA11717E
SHA1:	6E9829A470A5452527214847ECF90B7327557DD2
SHA-256:	5C01581FAE7122F4CEF9D5D9205D9C25F82ED965A2040264EBE418C583EFFF26
SHA-512:	7B4F07B51568C7C12F2845C346C4BD64385141A58EE5454943781FCB76173DBC9496D7F4C2B80187C629E1DD9B58A87D82B3F9C6FF2BE073D67D0D14337E4D23
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -P- -dSAFER -DNODISPLAY %1 %2 %3 %4 %5 %6 %7 %8 %9 >t.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gsnup.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	4.7455776133858505
Encrypted:	false
SSDEEP:
MD5:	D8CF3817BC12321BE67D5A5BA8CE0231
SHA1:	6859AD0B2913849CCF44C684C3AB37B8A3A764F2
SHA-256:	7A3EB9209E3661AD85D5AA8E08FF417F75265121CA9D55787CD3B7223AD455B6
SHA-512:	32F4B66FAB9704179F87A5FF34A11F877C60C5CA595B6D8C607DE15B15305BB2DFB45A747EAB06E539D8840350320340CBD2DCD5EDC777AB0E521C92C52D864C
Malicious:	false
Reputation:	unknown
Preview:	%!.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Prefix this to very well-behaved PostScript files for n-up printing.../cdef { 1 index where { pop pop } { def } ifelse } def..%%%%%%%%%%%%%%%% Begin parameters %%%%%%%%%%%%%%%%..% All parameters are also settable from the command line with -d, e.g.,.% -d.Nx=3../.Nx 2 cdef...% # of pages across the physical page./.Ny 2 cdef...% # of pages down the physical page./.Landscape false cdef..% if true, rotate page by 90 d

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gssetgs.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.661702886883028
Encrypted:	false
SSDEEP:
MD5:	94973BD32C37A479321FEA658C59916D
SHA1:	1937856D32EC2E0D8BC8DD097152642FB8A830C4
SHA-256:	773F54B326F4C22EE1E2DB3CE59BD7B8B0984084B653F37B8B3F1AFF01EBE767
SHA-512:	413A62273A0682BA26EA3E1C20404D9EA635216355A283CFD7E4B51F29C3693D522CE0B05981A73D9ED01EC98A47A04CC635B8A6884B8EAFA8D401BD9B5F1113
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Set default values for GS (gs with graphics window) and GSC.rem (console mode gs) if the user hasn't set them...if %GS%/==/ set GS=gswin32.if %GSC%/==/ set GSC=gswin32c.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gssetgs32.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.661702886883028
Encrypted:	false
SSDEEP:
MD5:	94973BD32C37A479321FEA658C59916D
SHA1:	1937856D32EC2E0D8BC8DD097152642FB8A830C4
SHA-256:	773F54B326F4C22EE1E2DB3CE59BD7B8B0984084B653F37B8B3F1AFF01EBE767
SHA-512:	413A62273A0682BA26EA3E1C20404D9EA635216355A283CFD7E4B51F29C3693D522CE0B05981A73D9ED01EC98A47A04CC635B8A6884B8EAFA8D401BD9B5F1113
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Set default values for GS (gs with graphics window) and GSC.rem (console mode gs) if the user hasn't set them...if %GS%/==/ set GS=gswin32.if %GSC%/==/ set GSC=gswin32c.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gssetgs64.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.661702886883028
Encrypted:	false
SSDEEP:
MD5:	60575A02493E499946423A5CDFF1B07D
SHA1:	DA285BCFA1BD8307247EE3C9441EC1CF05B1F144
SHA-256:	30FCEFBD6E0B093B6E92C33ACAB0BC2FA74B25AB9101CD7289D15C90CF281C61
SHA-512:	3102D797C5F887C353CC3A75A8B7EBE4AF75C48F1D6AEE1C18A094D8D72797B28A6F51F2CB461FA6560120EA0DCB39231584C466EA8E5E4C4A534B3606780F78
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Set default values for GS (gs with graphics window) and GSC.rem (console mode gs) if the user hasn't set them...if %GS%/==/ set GS=gswin64.if %GSC%/==/ set GSC=gswin64c.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gst.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.421441945207327
Encrypted:	false
SSDEEP:
MD5:	BC46A12DC0921BDBAE711E0FAC153860
SHA1:	6A065C0865CE5F6C88E7B53A53CABA9B19B90318
SHA-256:	685BE64E09E4F3A6CC751C468B8AADFD3B865F5A259FDE2C5588DEFED6C2787A
SHA-512:	7E6AF585BE5C89846DE9D777DD32712866037CDC0397648B6FAD29F041111930AF2108233497F3F29832E3781DFA5BBDE5F29D43F0F3ACB8B76E12DB55AF2C56
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GS% %1 %2 %3 %4 %5 %6 %7 %8 %9 >t.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gstt.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	71
Entropy (8bit):	4.437791133284474
Encrypted:	false
SSDEEP:
MD5:	BCF7A957306F77B76859FD630037010F
SHA1:	BB0DBF8CE0A7DD8F9D7B5FE319744A1161633A16
SHA-256:	A208C9A290A2A18D47BF738D7C8AF4D3CAB5084CFA7BBD0021AE3BDA47A682FB
SHA-512:	42C2D248F16C4026416A87C70B4517F472B2FFFCB47648294C5580D03DF930852271027BA20E4C47100BAFE974D538A6EEF903E0EE9B6939E3C3796BC329DD66
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GS% %1 %2 %3 %4 %5 %6 %7 %8 %9 >>t.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\gswin32c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	5.346512713103211
Encrypted:	false
SSDEEP:
MD5:	868A1DE442A6F45035451B2C3B93742E
SHA1:	6A44ED31C9DE6FE285616F45F837CA66531FF612
SHA-256:	AFBAB8CBC2F3837F11652C41AAFC06CE752F61C348067F173E346D201E0E43AA
SHA-512:	00ACDFEDCDC23802AB71D70AA743E26E7862F56C02A03B95D22A3AF7066214765081F44937F741C7C09B767BCC900D61415F10BF86B7F39EE94E7EA9B8AD4853
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........."..xq..xq..xq!L.q..xq.N.q..xq.N.q..xq..yq..xqu.%q..xq.N.q.xq.N.q..xq.N.q..xq.N.q..xqRich..xq........................PE..L...L+"P.....................0.......i............@..........................0.......................................-..5...L...x....`..............................................................P...@............................................text............................... ..`.rdata..5-.......0..................@..@.data....,...0... ...0..............@....rsrc........`.......P..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ht_ccsto.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	228143
Entropy (8bit):	3.99402759313061
Encrypted:	false
SSDEEP:
MD5:	834EBB7CBACED277D9889E8B53453D52
SHA1:	C5DB069E2DD2B0329F914C6507C83B1292AE677A
SHA-256:	BAF1F10CCC728F30D1CE5C1E79566B18E920E1F4112749109D058133975E9737
SHA-512:	07054AAF79F5E87C6CFC0EEEDC7E222DAF5EB2D78CACDA11EFFC1CC840AAB7732812C683E694ADA76255DDB1F47E13D933408F7E1F8BB66A4D8BEB68B85BB364
Malicious:	false
Reputation:	unknown
Preview:	%!.% This file is a reformatting of data placed in the public domain by its.% author, CalComp Technology, Inc..%.% Aladdin Enterprises, Menlo Park, CA reformatted the original data as.% PostScript halftone dictionaries, and hereby places this file in the.% public domain as well...% This file defines a /StochasticDefault Type 5 Halftone...% Note that the Black array is used for Default, Black, and Gray.% (not too surprisingly), as well as for Red, Green, and Blue...% The reason for using the single Black array for the.% RGB additive primaries is to make stochastic dither to displays.% look better since there is no misalignment between primaries to.% a screen (as there often is printing to paper)...% The CMY components are decorrelated (90 degree rotations of the.% Black data) so that misalignment doesn't cause color shifts. This.% is the same reason that conventional ordered screening uses.% varying angles for C, M, Y, and K inks.../StochasticDefault <<. /HalftoneType 5.. /Black <<.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\image-qa.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	73058
Entropy (8bit):	4.8731701825611085
Encrypted:	false
SSDEEP:
MD5:	67459DD41D4CF2132A1E73748A04DBA9
SHA1:	C5282FAC2FED2EBF9863B9B5AA43D9BFCE48DBC9
SHA-256:	A0E884982D1C0A20D6CE0CDD50AAA569915CFC0236C0654A8189F3C269E3935E
SHA-512:	FCFD93B08675063B1932E6AE2BE59B0175B59DDF4D73500A5B98BF25B0DAC9653BC80CC6DD871B77B4031EF697C3135D4EEE94CE38948B4C9D99A7DE9EE96FA4
Malicious:	false
Reputation:	unknown
Preview:	%!PS.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%.%.% Tests for the image operators..% Specifications for Image operator testing..%.% 1. All 8 standard orientations (0, 90, 180, 270 degree rotations with.% and without reflection); ditto those orientations perturbed by +/-.% 10 degrees, and by 45 degrees..%.% Enough space is provided around images on a test page to allow.% these permutations to use the same page layout. This will make.% test pa

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\impath.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5459
Entropy (8bit):	4.604740011985303
Encrypted:	false
SSDEEP:
MD5:	2A00E51F62605FE37F154E9DAB2E6FCC
SHA1:	FCF4F95C3E1E237B8DC170ECFE3D733C12E5ABA5
SHA-256:	95D77C0DEE1C1E8B9E9A01F9F593DF1D68F9F0D4D8BEECD1271BE01B03FC1703
SHA-512:	AC69DEAA3C722617D244A9F3E6314E9040B2A738CDB5200F01E2BD75143A767163184823D46C04301F8A471D54044FD2D9385B6F24A0490903E55FF094F02702
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% impath.ps.% Reverse-rasterize a bitmap to produce a Type 1 outline..% (This was formerly a Ghostscript operator implemented in C.)..%.<image> <width> <height> <wx> <wy> <ox> <oy> <string>.%. type1imagepath <substring>.%..Converts an image (bitmap) description of a character into.%.. a scalable description in Adobe Type 1 format. The.%.. current transformation matrix should be the same as the.%.. FontMatrix of th

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\jispaper.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.90799883140145
Encrypted:	false
SSDEEP:
MD5:	361EC71E97EA666CB90810371C70DD10
SHA1:	883899102881F6C6F6EF1C2EB1EB872C2B56E910
SHA-256:	7A4E9B8799F288CB80B64BE62DC53F9C64E39F8B9667DB022F76D82BA22BC582
SHA-512:	F5AD77531F387DB93E1043A8AADA990C3C97000D84DED665CDA1BC232C583808644A0F559AF9FA56A01EA94AF061FD587644A63DA778C07990DF951558BCC0EA
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Select JIS B paper sizes for b0...b6...userdict begin. /b0 /jisb0 load def. /b1 /jisb1 load def. /b2 /jisb2 load def. /b3 /jisb3 load def. /b4 /jisb4 load def. /b5 /jisb5 load def. /b6 /jisb6 load def.end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\jobseparator.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	123
Entropy (8bit):	4.747196487697607
Encrypted:	false
SSDEEP:
MD5:	7E22397848D839BACA828FB84E3CAACB
SHA1:	31441A7EBD53D8FFCF42107E2518BCB94B94D5E8
SHA-256:	11EF3C946C42B532AC39D796DF677CD1D9ED40DA1C2C61A126C794EA8DFE7CF6
SHA-512:	55A7878B6D38A1BB5E9919425BBCEA1EBB07C5E4C7E55897DFD22713FAD76E4C86E0A4A6C7EE1BCBE3569EE806E0D63400F4A586BFD4DE332A9CEA62388711BE
Malicious:	false
Reputation:	unknown
Preview:	% Execute the "real" system version of the ^D to separate jobs.% when -dJOBDSERVER is being used..<04> cvn .systemvar exec.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\landscap.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	4.371757552711993
Encrypted:	false
SSDEEP:
MD5:	FFE018368E9CE22FB3F8F7B3295109D8
SHA1:	255153846044903D040E6547C322B4CC8DCAFAB2
SHA-256:	95DD151AFF119653E9FA61763293EAC3CCD38AB257499C94733EF91299E5EDB5
SHA-512:	1840EDA509A33D0A9A8E802424EA4E44BDD56164290E85F79D66CFD61EAA065FC7980DA53B97F1FE6197AB8C46B05BED99C8651835D0AF18C75B76E7C6E7B51B
Malicious:	false
Reputation:	unknown
Preview:	%!.% landscap.ps.%.% This file can be prepended to most PostScript pages to force.% rotation to "landscape" mode..%.% There are (at least) four possible ways to reasonably position a.% page after rotation. Any of the four old corners (llx,lly e.g.).% can be moved to match the corresonding new corner..% By uncommmenting the appropriate line below (i.e., remove the.% leading '%'), any such positioning can be chosen for positive or.% negative rotation. The comments at the end of each "rotate" line.% indicate the ORIGINAL corner to be aligned. For example, as given.% below, the lower left hand corner is aligned. When viewed, this.% corner will have moved to the urx,lly corner..%.% originally by James E. Burns, 3/8/93, burns@nova.bellcore.com.%.gsave clippath pathbbox grestore.4 dict begin./ury exch def /urx exch def /lly exch def /llx exch def.%90 rotate llx neg ury neg translate % llx,ury.90 rotate llx neg llx urx sub lly sub translate %

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\level1.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.181277957707538
Encrypted:	false
SSDEEP:
MD5:	7A692F7C2AFAAE04C8383DF53B5FAB68
SHA1:	DB905384C353D4940702EEE0C9D15E5BC73A9137
SHA-256:	B40AE9C8F4CABD5968A7F6B61E8D677E723CED021052FAA33F39A226BC6C4D37
SHA-512:	16E57B7E060C0E5C4D3FCAF8F3A59509597A1A435EAB0BDDD5477F48A3B340788C81315A798AE0E46BEC52782AE71F0F0CAAB5D3B2C0D377E353A46D1CCE3393
Malicious:	false
Reputation:	unknown
Preview:	%!./.setlanguagelevel where { pop 1 .setlanguagelevel } if.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\lines.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	3744
Entropy (8bit):	4.535818492616913
Encrypted:	false
SSDEEP:
MD5:	F23611AD83A6A404BFC077990D889655
SHA1:	38D277E28FE1F52209550CB705AB45EFE836BA2E
SHA-256:	C6356941CF77D5AA3BBCE22E5AAE48A20385CF4206A53CD441B0C9D66BA34989
SHA-512:	10D311A14E8DA7961C4A5038E7BE019FA101BC48BB40A666B41F2E021792AE596CB8055240DF22F87842A307768CAC91833F8388DCFB3179BDABDF1F7527ABE1
Malicious:	false
Reputation:	unknown
Preview:	%!.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Test line rendering (stroke)...% Exercise the miter limit. The left column of lines should bevel at.% 90 degrees, the right column at 60 degrees...gsave.1.8 setlinewidth.0 setgray.15 15 scale.-5 5 translate.[1.415 2.0]. { setmiterlimit 12 0 translate 0 0 moveto. 10 30 360. { gsave 5 0 rlineto rotate 2.5 0 rlineto. gsave 0 setlinewidth 1 0 0 setrgbcolor stroke grestore. strokepath 0 setlinewidth str

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\lp386.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.83002179238206
Encrypted:	false
SSDEEP:
MD5:	09863BD713D6594134265D864B4729FD
SHA1:	268EEF4010B4A29284F0ACD63D68188480DD43FF
SHA-256:	044F3D344640CA14FD89436AC5B3D869CF53E2E104F8035446FD199CC46C39CC
SHA-512:	1F9F4AD14166943ED08B218631772F8D11421A2297721691BE59C9B9DBE29F8C9151C89C1D13062A6FBC3D72FE64107AFD96E8971DCC360866CF7140560B236F
Malicious:	false
Reputation:	unknown
Preview:	@gs386 -sDEVICE=djet500 -P- -dSAFER -dNOPAUSE -- gslp.ps -fCourier9 %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\lp386r2.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.649383749147024
Encrypted:	false
SSDEEP:
MD5:	72DD78C9F9C476DE6F277456CBF875F4
SHA1:	EE0E04DCCB72C45090416EA0D2F4F71FA69A3C82
SHA-256:	FE89FFD4E47EFBC0931DE37853D42FDFCD41A388ABCE6B427F0C21645033B156
SHA-512:	C971A34613039E17EDBA80CEDAF14D0F3436EBCDF9A54CE570AC7B52FA724493E65494FD3AB0D926C5587711D929A8A63BD4BF37897C3BA39598299B9DA92963
Malicious:	false
Reputation:	unknown
Preview:	@gs386 -sDEVICE=djet500 -P- -dSAFER -dNOPAUSE -- gslp.ps -2r %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\lpgs.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	5.139162619195574
Encrypted:	false
SSDEEP:
MD5:	4AEE03647E3F453C76B47E65F82B7F94
SHA1:	5E7E47320702FCDC18F3B4CADCD0188357385250
SHA-256:	94A0872C1C9A115C1114B69CBD818EDA7AB63372112058500CD87A9ABFED06B3
SHA-512:	7587799277EBF0F7AC19892B92418C8CEC380BB48A2A3C35BD057FD43A3F5A4D2FB9391CD796C18A4B3B172847E60A9316E11055D0150F94A1F139BD6BA8938D
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -sDEVICE#djet500 -P- -dSAFER -dNOPAUSE -sPROGNAME=lpgs -- gslp.ps -fCourier9 %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\lpr2.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.082729364580989
Encrypted:	false
SSDEEP:
MD5:	CFFD874A35D9D00EFB491B496D3E9ED2
SHA1:	55464BD6F8C0FF3347790C25179EE117E77BF15F
SHA-256:	C574FB832461B11C74756D27B56A351C28489739861E7ABF556CFE7C7EBC7918
SHA-512:	7D70798C9C3D397F3ACD63925E24AEF746A7E4767ECB7C7AA72FD3084CCFEAD3F60587F7714CD3AA58E4189E88F3649A77FE9E1EAE66821113CF0F2774B7EF13
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".%GSC% -sDEVICE#djet500 -P- -dSAFER -dNOPAUSE -sPROGNAME=lpr2 -- gslp.ps -2r %1 %2 %3 %4 %5 %6 %7 %8 %9.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\lprsetup.sh

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	5.19938028639352
Encrypted:	false
SSDEEP:
MD5:	E3B10A68B593D2AA5BA6B659D79A192E
SHA1:	870B78EA7FF05B908037BE6F999032C75B829A60
SHA-256:	8F620A0A0072174AAAA02D119D2BC6AE2CE4C734ED129B9973C93715CFD41BD7
SHA-512:	C13A1A3FEFA6E09F265ABA1E06C7A05354F5EB29155F3E50BDBA76901C803348B735CDD4F3DEC5118B8932222AF5EE2114ED06A5B2D3B447BC6EE3835CBCE561
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.#.# BSD PRINT FILTER SETUP utility for Ghostscript - used and tested on.# SunOS 4.1.3, but I hope it will be useful on other BSD systems.# See documentation for usage.#..DEVICES="bjt600.32 bjc600.32 bjc600.24 bjc600.24.3 bjc600.16 bjc600.8 bjc600.8.1 bjc600.1 bjc600.dq".#FILTERS="if nf tf gf vf df cf rf".FILTERS="if"..# The port your printer is on.PRINTERDEV=/dev/lp1.# The kind of printer (accepted values: 'parallel' and 'serial').PRINTERTYPE=parallel..GSDIR=/usr/local/lib/ghostscript.GSFILTERDIR=$GSDIR/filt.SPOOLDIR=/var/spool.GSIF=unix-lpr.sh.PCAP=printcap.insert..PATH=/bin:/usr/bin:/usr/ucb.export PATH..if [ ! -w $GSDIR ]; then. echo "$GSDIR must be writable to create filter directory". exit 1.fi..echo ".Making links in the filter directory $GSFILTERDIR ...."..#.# Make the directory for holding the filter and links.#.if [ -d $GSFILTERDIR ]; then. echo "$GSFILTERDIR already exists - not created".else. mkdir $GSFILTERDIR.fi.rm -f $GSFILTERDIR/direct.ln -s . $GSFILTERDIR/

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\markhint.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	4.721423095961168
Encrypted:	false
SSDEEP:
MD5:	6A62E9650CA3A48A9AB92149C8D850D2
SHA1:	CF660FEB55BA1D4C5252EA74184FBD89E357D815
SHA-256:	AA8F5819B37D055BA346A4A32FE76E83CD908340F6E80D8E22C754073232BF28
SHA-512:	5FA52DDC1A4033209B83FC8C25D265045F8065891D09CAEAF3D05DC50D1B498FE3FDE37D9894D114A782169E9EA3D0E5F4C087FB935A4C3F76DC282F64C7CDE3
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% markhint.ps.% Draw the hints for a Type 1 font...(type1ops.ps) runlibfile../mhsetup..% <matrix> <print> mhsetup -. { /mhprint exch def. /mhmx exch def. /mhdash 0 9 gsave initmatrix dtransform grestore idtransform add abs def. gsave. clippath pathbbox. 2 index sub /bbh exch def. 2 index sub /bbw exch def. /bby exch def. /bbx exch def. grestore. } def../markfonthints..% <matrix> <print> markfonthints

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\markpath.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	4.727267408510507
Encrypted:	false
SSDEEP:
MD5:	400AEDD9A3CE446652EE9F61B40D5AC0
SHA1:	6DD081AB301055918A8A86D8030B14D889A3496C
SHA-256:	3659C73419FC377DCC505753084F6E9F8D4972CE88899FB55C042C80F5A1EF2F
SHA-512:	453059BBE3A1F8F1D9E50B6265871D5591F7FBEC7E3D2883B4A3D5745A9E345A61F5388469DAF67220BF18636A146DA760EBC1F1B18E7F7E87AAFBF0003AEB9B
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% markpath.ps.% Mark the corners of a path, drawing it slowly if desired.../Delay where { pop } { /Delay 0 def } ifelse./setxy0. { currentpoint /y0 exch def /x0 exch def. } def./bip. { epsx epsy idtransform /ey exch def /ex exch def. currentpoint ex 2 div ey 2 div rlineto currentpoint 0 ey neg rlineto. ex neg 0 rlineto 0 ey rlineto lineto lineto. stroke. } def./dally. { Delay { } repeat. Delay 0 ne { flushpage

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\mkcidfm.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22329
Entropy (8bit):	4.938809620368722
Encrypted:	false
SSDEEP:
MD5:	714823A3EDD1FCD9A37776D4C82F9C82
SHA1:	4AF5CB35E785D5B78C4F48EEE7B58371CCBCF64F
SHA-256:	CC2B0CFAB33BDE42553C5493E08675478629626C94B30BF1E293A5DD3BB11A9C
SHA-512:	7CB357531994D8468C4362D0F6A4478D352B7ACEA638F3763DC48B16F284B365EE34D35BD81027382038A32A4C9B0C8BFC1AB9F706CD9DBCCA9D278080FDFF42
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%...% Generate a cidfmap file for substituting CID fonts with TrueType.% fonts, based on fonts found in the directory FONTDIR..%.% The directory FONTDIR is searched for fonts whose filename.% matches a Path in the cidsubs dictionary..% Any matches are written out as a CID font substitution..%.% For each fontname and alias in the fontaliases dictionary,.% write out each alias that matches a substituted font..% Where multip

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\necp2x.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	5.2987301564978795
Encrypted:	false
SSDEEP:
MD5:	275A06188B3E946379E6D99FCF643CD1
SHA1:	2F5F3C5F446163714549223F8DCF0D152763A937
SHA-256:	18BB0B3FDFEE77ABDB3892154F5166DC3E9DC84176AD1D7D473887DB1151EA97
SHA-512:	E43025D30AD96D65F4066664DC344C510A4EFEB51BDC89562619CCF987EA6D6EE3A973100854925E7FD7CF07053D63B608E224847211EBE1378215D1565CBC4C
Malicious:	false
Reputation:	unknown
Preview:	-supModel="NEC Prinwriter 2X, 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Epson.-r360x360.-dupMargins="{ 9.0 40.0 9.0 67.0}".-dupWhiteTransfer="{. 0.40000 0.36253 0.32747 0.29475 . 0.26428 0.23599 0.20979 0.18561. 0.16336 0.14297 0.12435 0.10741. 0.09209 0.07831 0.06597 0.05500. 0.04532 0.03684 0.02950 0.02320. 0.01787 0.01343 0.00979 0.00687. 0.00461 0.00290 0.00168 0.00086. 0.00036 0.00011 0.00001 0.00000.}".-dupWeaveXPasses=2.-dupWeaveYPasses=2.-dupOutputPins=24.-dupWeaveYFeeds="{11 12 13 12}".-dupWeaveInitialYFeeds="{ 0 1 0 11}".-dupWeaveInitialPins="{ 6 24 16 5}".-dupFormatXabsolute.-dupBeginPageCommand="<.1b40 1b40 1b7401 1b5200 1b50 1b54 1b7200 1b32 1b4306 1b5500 0d 1c242000.>".-dupAdjustPageLengthCommand.-dupEndPageCommand="(\014)".-dupAbortCommand="(\034F\034\063\044\15\12\12\12 Printout-Aborted\15\014)".-dupXMoveCommand="(\015\034$)".-dupSetLineFeedCommand="(\034F\034\063)

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\necp2x6.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1069
Entropy (8bit):	5.270190585280055
Encrypted:	false
SSDEEP:
MD5:	2701A430A5465D24D283EE147DD15088
SHA1:	149FAB81511A08C9C44C67C283883C5F456ABB12
SHA-256:	8F1D0FB2B8379867DB1887B8776169ABA6890C06FBE477B48DEBA4C3DF2F3B6C
SHA-512:	494C4B43B50F6ABABFC2AF9D566383D136F4EF3C952218A5CD1C06FCA12FEAF99B985909A5738677C3F390D8368605F718335878D426DA8B8AC201554B836C5C
Malicious:	false
Reputation:	unknown
Preview:	-supModel="NEC Prinwriter 2X, 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/Epson.-r360x360.-dupMargins="{ 9.0 9.0 9.0 67.0}".-dupWhiteTransfer="{. 0.40000 0.36253 0.32747 0.29475 . 0.26428 0.23599 0.20979 0.18561. 0.16336 0.14297 0.12435 0.10741. 0.09209 0.07831 0.06597 0.05500. 0.04532 0.03684 0.02950 0.02320. 0.01787 0.01343 0.00979 0.00687. 0.00461 0.00290 0.00168 0.00086. 0.00036 0.00011 0.00001 0.00000.}".-dupWeaveXPasses=3.-dupWeaveYPasses=2.-dupOutputPins=24.-dupWeaveYFeeds="{ 7 9 7 9 7 9}".-dupWeaveInitialYFeeds="{ 0 0 1 0 0 9}".-dupWeaveInitialPins="{ 5 21 13 16 8 24}".-dupFormatXabsolute.-dupBeginPageCommand="<.1b40 1b40 1b7401 1b5200 1b50 1b54 1b7200 1b32 1b4306 1b5500 0d 1c242000.>".-dupAdjustPageLengthCommand.-dupEndPageCommand="(\014)".-dupAbortCommand="(\034F\034\063\044\15\12\12\12 Printout-Aborted\15\014)".-dupXMoveCommand="(\015\034$)".-dupSetLineFeed

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\opdfread.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text conforming DSC level 2.0
Category:	dropped
Size (bytes):	146085
Entropy (8bit):	4.286779692294614
Encrypted:	false
SSDEEP:
MD5:	F7727BA5E8ED8E923BE230418D8B5FE3
SHA1:	104246A5BA0A155DD63D0C379868D527E6759269
SHA-256:	B390ACD33126D6BEAA08EAE4B81F913A3AB188C1A9185FF2FB4603921B440BF9
SHA-512:	084B419849DBD451F9CCE3B169B445B78D999FD2B59132E72C2DD30C97F20FABA20FE56694AE037E4DA34DD92E2CABF27949F5BB7E3E8A94AA93473A372F0E44
Malicious:	false
Reputation:	unknown
Preview:	%!PS-Adobe-2.0.%.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% $Id: opdfread.ps 11951 2010-12-15 08:22:58Z ken $.% pdfread.ps - A procset for interpreting an ordered PDF 1.3 file...% This module defines routines for interpreting a PDF file with.% a Postscript interpreter. To convert a PDF file into Postscript.% just pre-contcatenate this file. The PDF file must satisfy.% few constraints :.%.% 1. It must contain only Postscript level 2 objects encoded with.% the

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\packfile.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	4.772016614860296
Encrypted:	false
SSDEEP:
MD5:	769040B7E7FB31487ADCAEDE04D17B6E
SHA1:	658B5FAAA3AEB04E2B0E2CE8942344604D267CF7
SHA-256:	2112F0324BC33FE44806A1D27F3E7789ECC0AC806F1D6D29A4CB4092AE2004D1
SHA-512:	510B8C343763F868726A050B760717345A91DFF60FAC601B586AE291E1FF268A6A962F8A14BA690FD4D083A1687FBA6576C8EA89F2143197AF2BACC0D2983874
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% packfile.ps.% Pack groups of files together, with compression, for use in.% storage-scarce environments...% ****** NOTE: This file must be kept consistent with gs_pfile.ps...% ---------------- Huffman coding utilities ---------------- %..% We count runs of zeros, and individual byte frequencies separately.% depending on whether they follow or do not follow a run of zeros../zruns 256 array def./zfreq 256 array def./nz

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pcharstr.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3456
Entropy (8bit):	4.799573656212134
Encrypted:	false
SSDEEP:
MD5:	92FD34C3E3FBA2FC1BA85F2906C42649
SHA1:	E6FA700670873C552DA2A9D0B7A2DF187F4258AC
SHA-256:	9DD335A5A070FDCEDCDF74087D0274DA05DDAF40C5319794DFC14FA038A6FADF
SHA-512:	3269AAFBF9994E01FB54DF197231BCF71406CBD41EA50B0E5742367AA5EABE50D5C0DA01FE976C3F374915C2507F381FD49F8BFF6AE8EA2FCF753B49F924448F
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% pcharstr.ps.% Print the CharStrings and Subrs (if present) from a Type 1 font,.% in either a PostScript-like or a C-compatible form,.% depending on whether CSFormat is defined as /PS or /C...% Load the Type 1 utilities..(type1ops.ps) runlibfile..% Define the printing procedures for PostScript-like output../pcs_ps_dict mark. /, {( ) print}. /charname {==only}. /csbegin {}. /beginchars {(%---------------- CharStrin

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdf2dsc

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	698
Entropy (8bit):	5.434165431762664
Encrypted:	false
SSDEEP:
MD5:	A77064F0ED54CACF23E8C32A36F70E8D
SHA1:	50AB023251165545FC0AC72F0E0467D74DFD5B46
SHA-256:	FAE867267482717A6AE8E5A429DABD6AE8496DC8E83BCDF52D6040DF4C31B6F2
SHA-512:	4E3B4C1C033B0C1D887A75167D16B905D331253251426CF2DC6F696ED004B931906DB14ECE9351352DE30747E24B0DE75C7238319CF8501E9B220256672C52E1
Malicious:	false
Reputation:	unknown
Preview:	#! /bin/sh..# psf2dsc: generates an index of a PDF file..#.# Yves Arrouye <arrouye@debian.org>, 1996..# 2000-05-18 lpd <ghost@aladdin.com> added -dSAFER..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..me=`basename $0`..usage() {. >&2 echo usage: $me "pdffile [ dscfile ]". exit 1.}..if [ $# -gt 2 ].then. usage.fi..pdffile=$1.dscfile=$2.: ${dscfile:=`echo $pdffile \| sed 's,\.[^/.]*,,'`.dsc}..exec "$GS_EXECUTABLE" -q -dNODISPLAY -P- -dSAFER -dDELAYSAFER\. -sPDFname="$pdffile" -sDSCname="$dscfile" pdf2dsc.ps -c quit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdf2dsc.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	318
Entropy (8bit):	5.10237163421825
Encrypted:	false
SSDEEP:
MD5:	89ABF67457237ABBA1540A8C918BDD92
SHA1:	87E3B130F4A551A930CB682AC7FD19C58FECDA51
SHA-256:	B5BA5E885CF873D8FF011AE674B73C7F1CDF6D6AAB0E666CE3F32FA428CE2CBF
SHA-512:	3D9FBFB189247B5F8E71A6B3ED83438FCBB409F379A4EBA0F48420F58B2B3D29903BDD0E8A6E590656388145EE8F7E0C60516085ABFD6E10C8387755A52FFECE
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem Convert PDF to DSC..if %1/==/ goto usage.if %2/==/ goto usage.call "%~dp0gssetgs.bat"..rem Watcom C deletes = signs, so use # instead..%GSC% -q -dNODISPLAY -P- -dSAFER -dDELAYSAFER -sPDFname#%1 -sDSCname#%2 -sOutputFile#%2 pdf2dsc.ps.goto end..:usage.echo "Usage: pdf2dsc input.pdf output.dsc"..:end...

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdf2dsc.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8232
Entropy (8bit):	4.666722409098499
Encrypted:	false
SSDEEP:
MD5:	1ED9DF11BDC2F8DEFAD785DF30B63304
SHA1:	909250E7BD2458D69F763AA22A7C66E4060662D6
SHA-256:	871A6ACA8B0B6D78E15DEB4E65C79C719FF261DA12EE4A60FBA3A969E3034D39
SHA-512:	C9FBFD666060F72E1013B969DEFA9DDB5E0A625463AC471F08CE47024EFC51611DBEC45D01D67E2E5304F70BE03ED6F0E25A8E5165CDF6F88AE1C08770199DAA
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% pdf2dsc.ps.% read pdf file and produce DSC "index" file..%.% Input file is named PDFname.% Output file is named DSCname.%.% Run using:.% gs -dNODISPLAY -sPDFname=pdffilename -sDSCname=tempfilename pdf2dsc.ps.% Then display the PDF file with.% gs tempfilename.%.% Modified by Jason McCarty, bug 688071.% Add PageLabels support..% Modified by Geoff Keating <geoffk@ozemail.com.au> 21/12/98:.%.Add DocumentMedia, P

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdf2ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	909
Entropy (8bit):	5.343963466299108
Encrypted:	false
SSDEEP:
MD5:	BE94F493CF3D6B96D56B2DDE5ADE8EA0
SHA1:	99F265CEC5DDD1760D0F86FED99A7F86A96F0A31
SHA-256:	C153D8FBC178EA6E576DDCA45EDCC23ED933BF9DC715FDD074148041107D5DE8
SHA-512:	349FD26B9DC6B023E21445585DE4371447F62DFE2E0EE8BF7AAD2A3743262BB367AD07D44046DE814FCF372D57C0B34A90664A29A49D5D2BAA364B63749729A9
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PDF to PostScript...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..OPTIONS="".while true.do..case "$1" in..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -eq 2 ] .then. outfile=$2.elif [ $# -eq 1 ].then. outfile=`basename "$1" \.pdf`.ps.else. echo "Usage: `basename \"$0\"` [-dASCII85EncodePages=false] [-dLanguageLevel=1\|2\|3] input.pdf [output.ps]" 1>&2. exit 1.fi..# Doing an initial 'save' helps keep fonts from being flushed between pages..# We have to include the options twice because -I only takes effect if it.# appears before other options..exec "$GS_EXECUTABLE" $OPTIONS -q -dNOPAUSE -dBATCH -P- -dSAFER -sDEVICE=ps2write "-sOutputFile=$outfile" $OPTIONS -c save pop -f "$1".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdf2ps.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	494
Entropy (8bit):	5.28455331671232
Encrypted:	false
SSDEEP:
MD5:	07FCB58D7BB449B4BC1125BA5B73D690
SHA1:	B6CA3ADB75F01BE332A09F886418B478950C2F7C
SHA-256:	E5EB214D56272270BF184F25807C61C5BCF274B43B93A3909D718D2DEAE747CB
SHA-512:	B465DEE88A7BAF10731EC3043DD4165B60EA193F1F4764E6EC390449F4B6B7E519C118AE4451578B99E3249ED839641A6FBB618EBED2265E8B51AB52ADB328D5
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem Convert PDF to PostScript...if %1/==/ goto usage.if %2/==/ goto usage.call "%~dp0gssetgs.bat".echo -dNOPAUSE -dBATCH -P- -dSAFER -sDEVICE#ps2write >"%TEMP%\_.at".:cp.if %3/==/ goto doit.echo %1 >>"%TEMP%\_.at".shift.goto cp..:doit.rem Watcom C deletes = signs, so use # instead..%GSC% -q -sOutputFile#%2 @"%TEMP%\_.at" %1.if exist "%TEMP%\_.at" erase "%TEMP%\_.at".goto end..:usage.echo "Usage: pdf2ps [-dASCII85DecodePages=false] [-dLanguageLevel=n] input.pdf output.ps"..:end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdf2ps.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	OS/2 REXX batch file, ASCII text
Category:	dropped
Size (bytes):	761
Entropy (8bit):	5.109204967672506
Encrypted:	false
SSDEEP:
MD5:	20558AD61BD6DB096988733C8BE36DE3
SHA1:	A664694D7F3D8E03999F12D1CAF72E660BED162F
SHA-256:	A8139F56122A1388E251390D55ABC2995BDFB959989B48753DA4979FDF97F29A
SHA-512:	1528F4C4D2408176DFFE75568FC47BBAEED2FFBC7A6EE6F8A175200CFB644B6FA67A99035C689951BD1C6D256F5064B5C765A2FCE4A181AD300BBB292C699A7F
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ Convert PDF to PostScript. /..parse arg params..gs='@gsos2'.inext='.pdf'.outext='.ps'..if params='' then call usage..options='-dNOPAUSE -dBATCH -P- -dSAFER -sDEVICE=ps2write'../ extract options from command line */.i=1.param=word(params,i).do while substr(param,1,1)='-'..options=options param..i=i+1..param=word(params,i).end..infile=param.if infile='' then call usage.outfile=word(params,i+1).if outfile='' then do..outfile=infile''outext..infile=infile''inext.end..gs '-q -sOutputFile='outfile options infile.exit..usage:.say 'Usage: pdf2ps [-dASCII85DecodePages=false] [-dLanguageLevel=n] input[.pdf output.ps]'.exit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdfopt

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	550
Entropy (8bit):	5.447175018832537
Encrypted:	false
SSDEEP:
MD5:	7397398DC2A2724CED7D73F95209D898
SHA1:	C9E1E44168BF9F6CE57157CD6693AACD12237AE4
SHA-256:	27771C25B09FC2FE5E8E40375B34A4AC282E9F5811ECC28ECF70C968A7BFD13E
SHA-512:	50F15E873022A946552894A3310267E581931A2F3E800B0BC99EE1428ECF1E465102BA21A6B5FF2CE6CAA8FF43B00270F57BE35EE9947D99FA3C2E0FE3DDF45A
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PDF to "optimized" form...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..OPTIONS="-P- -dSAFER -dDELAYSAFER".while true.do..case "$1" in..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -ne 2 ]; then..echo "Usage: `basename \"$0\"` input.pdf output.pdf" 1>&2..exit 1.fi..exec "$GS_EXECUTABLE" -q -dNODISPLAY $OPTIONS -- pdfopt.ps "$1" "$2".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdfopt.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	396
Entropy (8bit):	5.173368796131359
Encrypted:	false
SSDEEP:
MD5:	B4BDA8C6D47397B89826DB08B7D5D584
SHA1:	134E79673F4AF98EAC4DE5719ABDF52FD5739CDF
SHA-256:	B44BFCCE7C3AFD85D87F24FDB3278EDBD3DCDD5DC1104F2CE3E73107C228F60B
SHA-512:	C440D30EC19322891CE9DEFBE75664C3053AC817267FEB0C67CB80F998DAD197F719FC0168C61F396A9213EE8DE1F42DBFB23C03EE4C025350111AD9CD7235DA
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem Convert PDF to "optimized" form...if %1/==/ goto usage.if %2/==/ goto usage.call "%~dp0gssetgs.bat".echo -q -dNODISPLAY -P- -dSAFER -dDELAYSAFER >"%TEMP%\_.at".:cp.if %3/==/ goto doit.echo %1 >>"%TEMP%\_.at".shift.goto cp..:doit.%GSC% -q @"%TEMP%\_.at" -- pdfopt.ps %1 %2.if exist "%TEMP%\_.at" erase "%TEMP%\_.at".goto end..:usage.echo "Usage: pdfopt input.pdf output.pdf"..:end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdfopt.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38349
Entropy (8bit):	4.6651133095927255
Encrypted:	false
SSDEEP:
MD5:	2A8E83552CCCFED80E9C8E3533396A3F
SHA1:	6530FFD17075A0D64663719EF4BDE1AC5C158AF6
SHA-256:	96A57FD85ADE5B07BF5FCD177400890DC12D02BEA552AF9DB6BC6E4115E36063
SHA-512:	09763DF6877A553CBD2EAA1CF356E12FB9E963757089B27201A87E6A050E9B04330B1C381EE4DB58E8D7F4F75376B7B53DEBB6CC3E0EAE1451A9CEE51CF9C0C0
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% PDF linearizer ("optimizer")....currentglobal true .setglobal./pdfoptdict 200 dict def.pdfoptdict begin..% This linearizer is designed for simplicity, not for performance..% See the main program (the last procedure in the file) for comments.% describing the main processing sequence...% ---------------- Utilities ---------------- %..% ------ Data structures ------ %..% Distinguish dictionaries, arrays, and everything

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pdfwrite.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	assembler source, ASCII text
Category:	dropped
Size (bytes):	11571
Entropy (8bit):	4.837386917071204
Encrypted:	false
SSDEEP:
MD5:	F4A4779CA3029297ABA4F77329611247
SHA1:	FC2A7283D03ADCC886BFDA57DA7D9209ED943EFF
SHA-256:	2A7509D021C97294FB85CA114195742D9959729E27C387D0B77B28F676BABE23
SHA-512:	256528B75BCFF06DEDB8C478F055BEBDBE2B2B0FB89B239DAB9787AA64EFB813BB1ECDD56E055C322BDE92E2FE41F7840B523469906CFEEBDF0A23663BC0F629
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Writer for transmuting PDF files...% NOTES:.% We do editing by replacing objects (in the cache) and then doing a.% simple recursive walk with object renumbering..% Free variables:.% RMap [per input file] (dict): input_obj# => output_obj#.% PDFfile (file): current input file.% OFile (file): current output file.% XRef (dict): output_obj# => output_file_pos.% ToWrite: 0..N-1 => [obj# gen#]...languagelevel 2

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pf2afm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.297180584304157
Encrypted:	false
SSDEEP:
MD5:	ED0C3A002F208BD915F43D4B71F8BAF0
SHA1:	EB614EC49BB2EFDAF35768889B212EF57031677A
SHA-256:	AF4AE09119119350E7704749FF0CE8A9FBCABB6F41A747534854130FBDC30764
SHA-512:	687D538F754BE210DCC16E0345B35C317AB3060FCB545E88C9F63D09684EA1836ABDFCED2E636759229F842540BD6A2E7FEB71B56F0E11A6AF47982E1E838B14
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Make an AFM file from PFB / PFA and (optionally) PFM files. Usage:.#.pf2afm fontfilename.# Output goes to fontfilename.afm, which must not already exist..# See pf2afm.ps for more details...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -dNODISPLAY -P- -dSAFER -dDELAYSAFER -- pf2afm.ps "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pf2afm.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.153273778767179
Encrypted:	false
SSDEEP:
MD5:	D3C17D58EDD85ACA947A0AC0091C5660
SHA1:	7DA0C1F507CDCBA4CEFAFF51D518BBF1200E317B
SHA-256:	CC1E30918D2436DF7F15F6DE7BFC33BDAC07579966490EC83D51B8917157C920
SHA-512:	D5F20743B510652B0A48DF83F3F6DFC09C141029D8163DA98545726785A34BEB8C3AC16457B493F3FC4DC43906B9AB8F12CA57057E71213E4D1B1F90EEB5D237
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem Make an AFM file from PFB / PFA and (optionally) PFM files...if %1/==/ goto usage.if not %2/==/ goto usage.call "%~dp0gssetgs.bat"..%GSC% -q -dNODISPLAY -P- -dSAFER -dDELAYSAFER -- pf2afm.ps %1.goto end..:usage.echo "Usage: pf2afm disk_font_name"..:end...

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pf2afm.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.075905369922373
Encrypted:	false
SSDEEP:
MD5:	F5C5F9D6FFFCB710F8EC2BFF6585CBCD
SHA1:	2F759ED79A3D784F8CB1FBFA5BBA8E8FD9E13F92
SHA-256:	1C2DF77FBB185D637025243782EDB8A07E96F8189EF639ADE692F98D332C6F09
SHA-512:	B821FFC785C365862EDFBA8BBBB0D0FE37CBBD02954DA096FD92E3964566B95874E224EB0D1124DEDF362C675D7C2F73E5156A23A2531CC014294C93195C3405
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. */..@gsos2 -q -dNODISPLAY -P- -dSAFER -dDELAYSAFER -- pf2afm.ps %1.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pf2afm.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	15294
Entropy (8bit):	4.833210650025737
Encrypted:	false
SSDEEP:
MD5:	535D69C2605B81B06634483A097DFBB9
SHA1:	2562C2B3142FD3C8DDE322DDD22F8977F6ECB0FB
SHA-256:	4113DC0B2DC6ED4F0B55A80332C25D558B90FE582AD22B8227FB630D6471D867
SHA-512:	668CA594172812779F7F49F0D5998DEFF5516E97FA6E1F3A6932348D3ED2671E2DCF8985B753D3603B2A7AF3CF8A824D15664C6DDEC0BD28397A7F5C394D8D65
Malicious:	false
Reputation:	unknown
Preview:	%!.% This is a PostScript program for making an AFM file from.% PFB / PFA and (optionally) PFM files..%.% Written in BOP s.c., Gda\'nsk, Poland.% e-mail contact: B.Jackowski@GUST.ORG.PL.% version 0.5 (18 XII 1997).% version 0.55 (11 III 1998) -- unlimited number of chars in a font.% version 1.00 (27 III 1998) -- scanning PFM subdirectory added,.% code improved; version sent to LPD.% version 1.01 (1 II 2000) -- message changed..% Usage:.% gs [-dNODISPLAY] -- pf2afm.ps disk_font_name.%.% The result is written to the file disk_font_name.afm, provided such.% a file does not exist; otherwise program quits..%.% The font can be either .pfa or .pfb; if no extension is supplied,.% first disk_font_name.pfb is examined, then disk_font_name.pfa..% Moreover, if there is a *.pfm file in the same directory or in the.% subdirectory PFM, i.e., disk_font_name.pfm or PFM/disk_font_name.pfm,.% kern pairs from it are extracted, as well as additional font.% parameters, us

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pfbtopfa

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	516
Entropy (8bit):	5.188894498185776
Encrypted:	false
SSDEEP:
MD5:	82FBEAB547535657CCD2628B235C5118
SHA1:	2488CF27EA3847205A64C38F70712C71690ED908
SHA-256:	3C72B0295A853070356BF25C297DA945DF3CD16C235C0F37FD37516A4659F321
SHA-512:	2A6141CA3C4FDB66A5292268FE7B51A6671D5C1BE9315861C4589F5E4CABE2D846D4F20C662A8C464715E1219BBFEC48C9B3926A00EBF5CB2489EF2C0BC41C6A
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert .pfb fonts to .pfa format..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..if [ $# -eq 2 ] .then. outfile=$2.elif [ $# -eq 1 ].then. outfile=`basename "$1" \.pfb`.pfa.else. echo "Usage: `basename \"$0\"` input.pfb [output.pfa]" 1>&2. exit 1.fi..exec "$GS_EXECUTABLE" -q -P- -dNODISPLAY -- pfbtopfa.ps "$1" "$outfile".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pfbtopfa.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	256
Entropy (8bit):	4.855844658271534
Encrypted:	false
SSDEEP:
MD5:	A4F047184CC16140D2E45A2E5FED373D
SHA1:	AD42ECF190A7266458BF0144D4A21D5FFE602446
SHA-256:	E665447A2B5A054DF2031D25129DE4D7F4E33DA96E618984EBFA09B0E9DEB7BA
SHA-512:	0D46B6A141A470CF2874A86973335197EAF17DEE15A2C578C87B76F691F796D7DDD3474ABD7229BDFBCDBBE180B9008CCE6A189A7B4FC08E6047D4359BDC6CDA
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem Convert .pfb fonts to .pfa format..if %1/==/ goto usage.if %2/==/ goto usage.if not %3/==/ goto usage.call "%~dp0gssetgs.bat"..%GSC% -P- -q -dNODISPLAY -- pfbtopfa.ps %1 %2.goto end..:usage.echo "Usage: pfbtopfa input.pfb output.pfa"..:end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pfbtopfa.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	4.806455714412215
Encrypted:	false
SSDEEP:
MD5:	DBB1B9C5CDA46B3D66F5761890D17AB9
SHA1:	959B17F92827A728F586A23AF346C8B19D3C2803
SHA-256:	877637454AA22C51E56DF1ECC3AB551177C19FF073C9516DCEDFF83E8033023D
SHA-512:	13B2F90DD8202D08AF70FD04F5225D76FAFD2FCCC1E5BEBA4059D9520022F836602288E40A23DB18ADEA48459344B05E5EAF0D76E0E030F2ADE9C01A6F69E5DE
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% pfbtopfa.ps.% Convert a .pfb font to .pfa format...[ shellarguments {. counttomark 2 eq {. /pfa exch def /pfb exch def pop. /in1 pfb (r) file def. /in in1 true /PFBDecode filter def. /out pfa (w) file def. { in read not { exit } if out exch write } loop. out closefile in closefile in1 closefile. quit. } {. cleartomark (Usage: pfbtopfa input.pfb output.pfa) = flush. } ifelse.} {. pop.} ifel

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pftogsf.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	5.3075470726825
Encrypted:	false
SSDEEP:
MD5:	82A2806EA432236F246B022F310DEBF1
SHA1:	2FD890AA25851A1D0DD004F55C734856E277F4F4
SHA-256:	F4D440C1000D9AFE714060A967EDF6A989FFB9BFA2546F7AD89210D8C4344041
SHA-512:	D90C11EFCF80CA426FDF3E193A54156AB1495EE1B5ED5A3EF13151D41D9B8B51D79E184A6205851D0F126CA84BECA09FD9AD4184861DD9CE8D12FB652C6D89CD
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem *****************************.rem Convert .pf? files to .gsf .rem *****************************..call "%~dp0gssetgs.bat".echo (wrfont.ps) run (unprot.ps) run unprot >"%TEMP%\_temp_.ps".echo systemdict /definefont. /definefont load put >>"%TEMP%\_temp_.ps".echo systemdict /definefont { userdict /LFN 3 index put definefont. } bind put >>"%TEMP%\_temp_.ps".echo ARGUMENTS 0 get (r) file .loadfont LFN findfont setfont prunefont reprot >>"%TEMP%\_temp_.ps".echo ARGUMENTS 1 get (w) file dup writefont closefile quit >>"%TEMP%\_temp_.ps".rem for %%f in (cyr cyri) do %GSC% -P- -dSAFER -q -dNODISPLAY -dWRITESYSTEMDICT -- _temp_.ps fonts\pfa\%%f.pfa fonts\%%f.gsf.rem for %%f in (ncrr ncrb ncrri ncrbi) do %GSC% -P- -dSAFER -q -dNODISPLAY -dWRITESYSTEMDICT -- _temp_.ps fonts\pfa\%%f.pfa fonts\%%f.gsf.rem for %%f in (bchr bchb bchri bchbi) do %GSC% -P- -dSAFER -q -dNODISPLAY -dWRITESYSTEMDICT -- _temp_.ps fonts\pfa\%%f.pfa fonts\%%f.gsf.rem for %%f in (putr putb putri putbi) do %G

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ppath.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1827
Entropy (8bit):	4.804175326336069
Encrypted:	false
SSDEEP:
MD5:	0B31D8078067CEB6870AD5AE03190142
SHA1:	FF75B202992151C53B332A5B6F55C208FE33BE96
SHA-256:	E14F11A5BD45BC6F27443B7CD5766D02EFB72C54A337DF46AD47D3C18D8BA215
SHA-512:	8A2FD90F4A131BFC203F98721361C7904C053E95E6C90669B4273B5F63F76C5CC2E0F532051EBCB86C7B6F90B51D0A246D3BFEA66E227F621821BC9072F968E2
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Redefine pathforall for tracing..% Can't be used recursively.../# {( )print} def../-mat matrix def./-imat matrix def./-smat { //-mat currentmatrix pop //-imat setmatrix } bind def./-rmat { //-mat setmatrix } bind def./-pathforall /pathforall load def./-p2 { ( ) print exch =only ( ) print =only } bind def./-dp2 { 2 copy -p2 2 { exch 4096 mul dup cvi dup ( ) print =only sub dup 0 eq { pop } { (+) print =only } ifelse }

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pphs

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.270918843374205
Encrypted:	false
SSDEEP:
MD5:	80C4D9730C577439243521EFC17A5E67
SHA1:	0DFD7B9D14E953DCDCC18CC11A647076CD404747
SHA-256:	DA21938D181DB66AD8755C53F2964B9F60291BC2A21A24EABC05BDF3C6AA7348
SHA-512:	E7537D9126BC7CC3DA77E67A1423211F3C5610E20625B024D84AA2D672592CC33D7FC6E94ED1465478BB6DC8E69C925CBB6AC79E4B319E0F94B4A6D4D1D6BEA1
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Print the Primary Hint Stream from a linearized PDF file. Usage:.#.pphs filename.pdf.# Output goes to stdout...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -P- -dSAFER -dNODISPLAY -- pphs.ps "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\pphs.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6851
Entropy (8bit):	4.754648255984106
Encrypted:	false
SSDEEP:
MD5:	02D43B2F6C4D0287492523F3E12501E2
SHA1:	29304EBB50B4302B324654446521FE080493CDA3
SHA-256:	6C325A5A09ED7EF1537D04286E07BECAB099E7DCEB6867111B2192AB40452EB4
SHA-512:	EA6EAC60DC8657251D042C37527CFBCB08BDBF7DA393F581A62D00BBF0BCD9D8C4C63B6B9D283B66CCE391F5649FDDA70B92CE6237F95F990CE1389419497368
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Print Linearized PDF hint streams..% Utilities./read1 {.% <file> read1 <value>. read not {. (**** Unexpected EOF) = flush quit. } if.} bind def./read2 {.% <file> read2 <value>. dup read1 8 bitshift exch read1 add.} bind def./read4 {.% <file> read4 <value>. dup read2 16 bitshift exch read2 add.} bind def.% Free variables: Bits, Bitsleft./readninit {.% - <readninit> -. /Bits 0 def. /Bitsleft 0 def.} bind def..

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\prfont.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	7221
Entropy (8bit):	4.789891119204941
Encrypted:	false
SSDEEP:
MD5:	A771E87E00AD87FAC20C5E05CC336682
SHA1:	919D952D8895362E2C5B08B024C536C2411BFAB4
SHA-256:	39D38652F96DAE2BD6CA9E3332DD922C8A7BD89494FEA7CC159855E38E0E04BF
SHA-512:	D3622FE8109E1CF976210FB1826B7671BB3B21156692E977FDB92FD21029CF74C14D7701EE2EBD67CA357527D0447E367867DDD71F75EFF5F4D5C8A7B4D2A6F2
Malicious:	false
Reputation:	unknown
Preview:	%!.%%Creator: Eric Gisin <egisin@waterloo.csnet>.%%Title: Print font catalog.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%.% Copyright (c) 1986 Eric Gisin.% Copyright (C) 1992 Aladdin Enterprises, Menlo Park, CA.% Modified to print all 256 encoded characters..% Copyright (C) 1993 Aladdin Enterprises, Menlo Park, CA.% Modified to print unencoded characters..% Copyright (C) 1994 Aladdin Enterprises, Menlo Park, CA.% Modified to always create 256-element Encodin

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\printafm

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	395
Entropy (8bit):	5.225112640283407
Encrypted:	false
SSDEEP:
MD5:	21145BF2205A26E73A08E1699D91D1BF
SHA1:	3C40AFD4CED26038D8B1314CDA282C76D3AF9157
SHA-256:	E436C093AA5D4DA2AAA0A471E34EA1DC1D31BB6DAD3A249B5130229802D6DD74
SHA-512:	3FBD5D31CEBCF75967D9733EB1F1AE1B8198A86E87E11BAFAB2C37A9288932EB036499E6242FF44988B39D33FC7A24846228EADC033CE6B88B3DA54298892F10
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Print the metrics from a font in AFM format. Usage:.#.printafm fontname.# Output goes to stdout...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -P- -dSAFER -dNODISPLAY -- printafm.ps "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\printafm.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	4896
Entropy (8bit):	4.0139302888861
Encrypted:	false
SSDEEP:
MD5:	E0D0C5C1AAC334A8ED39653A23A4E5CE
SHA1:	F2CC7680D7AB24CB832BE3485C40C7A017ABC30A
SHA-256:	AD7F90022F2D2951929A8154C928DE3FCC60158443A45B83EC863A0B51A29264
SHA-512:	B9E6978DD503DC4BE3BE910659F8F3563AD1E08ED8C00B5885D8C45621DF1281EA17D7DFE4389AF4AA31E35B2F589281CFC4A054531F5FA5240DE61D7AA253DB
Malicious:	false
Reputation:	unknown
Preview:	%!.% written by James Clark <jjc@jclark.uucp>.% print an afm file on the standard output.% usage is `fontname printafm' eg `/Times-Roman printafm'..% From the `dvitops' distribution, which included this notice:.% dvitops is not copyrighted; you can do with it exactly as you please..% I would, however, ask that if you make improvements or modifications,.% you ask me before distributing them to others...% Altered by d.love@dl.ac.uk to produce input for Rokicki's afm2tfm,.% which groks the format of the Adobe AFMs...% Modified by L. Peter Deutsch 9/14/93:.% uses Ghostscript's =only procedure to replace 'buf cvs print'..% Modified by L. Peter Deutsch 9/6/95:.% uses Ghostscript's shellarguments facility to accept the font name.% on the command line...% Altered my master@iaas.msu.ru to work with fonts of more than 256 glyphs.% and avoid FSType output. Also print a comment with UniqueID of the font.../onechar 1 string def..% c toupper - c./toupper {. dup dup 8#141 ge exch 8#172

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ai.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	22314
Entropy (8bit):	4.834081840350227
Encrypted:	false
SSDEEP:
MD5:	BFBC38D1FBA6CB93AE7949CF2D240DC7
SHA1:	F8FCB0DE3D3FEBD3690752C6A3F6C92D0FE8FFB8
SHA-256:	63DC2BA164AC6FD0ADA9B56FB5DF69020C22C615E65213855CCB3166347D158E
SHA-512:	C3615E171D6E97D5E4D9EFCD6AFF2D14CFE8F4F9503590D73BCF36D2C7E427BFFBA7EE6057665274784F4ABF98596625463CC6926E1056A25C89357F8AA6ED38
Malicious:	false
Reputation:	unknown
Preview:	%!.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..%xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.%.% ps2ai.ps - a postscript to editable adobe illustrator file filter.%./vers {2.14} def % January 31, 1999..% conditional def ( if the key is already defined before, don't.% redefine it. This can be used by other programs to overwrite.% some settings from externally.%./cdef { 1 index where { pop pop pop } { d

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ascii

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	740
Entropy (8bit):	5.211916527637585
Encrypted:	false
SSDEEP:
MD5:	45F9F3107690B2FE1FA2D060B2431546
SHA1:	EAF08340F487F3C80600A633F6330F3C1C63F850
SHA-256:	F764E59DDDA0AD3A1664F20B0E117CA5BCB5637C75A2AA3CA0DAE71E94F56C14
SHA-512:	11E63E7B26855E63C6212C6F678F7DC1399D2AC75A7CDF1B89B758A6E03008D851C0B5A31DD765BAB88655F099F39B95CE53747D2394307EBA18F68436169B6E
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Extract ASCII text from a PostScript file. Usage:.#.ps2ascii [infile.ps [outfile.txt]].# If outfile is omitted, output goes to stdout..# If both infile and outfile are omitted, ps2ascii acts as a filter,.# reading from stdin and writing on stdout...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs..trap "rm -f _temp_.err _temp_.out" 0 1 2 15..OPTIONS="-q -dNODISPLAY -P- -dSAFER -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE".if ( test $# -eq 0 ) then..$GS_EXECUTABLE $OPTIONS -c save -f ps2ascii.ps - -c quit.elif ( test $# -eq 1 ) then..$GS_EXECUTABLE $OPTIONS -c save -f ps2ascii.ps "$1" -c quit.else..$GS_EXECUTABLE $OPTIONS -c save -f ps2ascii.ps "$1" -c quit >"$2".fi.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ascii.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	395
Entropy (8bit):	5.15749348175186
Encrypted:	false
SSDEEP:
MD5:	DD77E8B85DD9BBD39375B4D815585E68
SHA1:	3778F1C4253C9F7C99450F90011AA390D1580363
SHA-256:	2009C0ECFBD86C1A1AF8B8705C0F3C158CBF68436E0E4BE18A549FCD73022FE5
SHA-512:	E9A7A26762A431AB9255BD6291CCD6614F66730A73283B6DE00DA929AA38592A3BAE21879A9EB104B76870143985D2202F8DCD065533B59D138DA81BDCFB91AC
Malicious:	false
Reputation:	unknown
Preview:	@echo off..call "%~dp0gssetgs.bat".if '%1'=='' goto a0.if '%2'=='' goto a1.%GSC% -q -dNODISPLAY -P- -dSAFER -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE ps2ascii.ps %1 -c quit >%2.goto x.:a0.%GSC% -q -dNODISPLAY -P- -dSAFER -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE ps2ascii.ps - -c quit.goto x.:a1.%GSC% -q -dNODISPLAY -P- -dSAFER -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE ps2ascii.ps %1 -c quit.goto x.:x.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ascii.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	469
Entropy (8bit):	5.284374947873303
Encrypted:	false
SSDEEP:
MD5:	32296579D27A6E591EF5D4387D4DA262
SHA1:	9E2832CAE2DA5153A9489449CC0248F5B4185279
SHA-256:	F6DFCC9790A397F8090AB0B6F8FA2FD66AA5E066108E081CCF30C7C207CA3FC6
SHA-512:	0E290E4E4B8FA8325926A9934C4095876D183F8BAB267B568A197364309DD2FB562543812FB77B4655ED936E314164419488BA1DD882BCACF11D3809775EE559
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. */..@echo off.if '%1'=='' goto a0.if '%2'=='' goto a1.gsos2 -q -dNODISPLAY -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE ps2ascii.ps %1 -c quit >%2.goto x.:a0.gsos2 -q -dNODISPLAY -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE ps2ascii.ps - -c quit.goto x.:a1.gsos2 -q -dNODISPLAY -dDELAYBIND -dWRITESYSTEMDICT -dSIMPLE ps2ascii.ps %1 -c quit.goto x.:x.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ascii.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	44795
Entropy (8bit):	4.511603334603058
Encrypted:	false
SSDEEP:
MD5:	E590FE5850A7B8D1BF752F5BEE2C9935
SHA1:	AC5B53BCE5B7F5A56128520CE28895AC1265CE38
SHA-256:	BD24202C4053C1E42BAC94D50375F49F0C05B95B53988A6997404E6D0E53CB5F
SHA-512:	B32D83C26F7E837A6564F0040DA4F6160918F9BD9B18A794AA3BF5071C54F6CCA591D643134A374AAB310C8628A5A3D520EBBC32AC6A2ECF99BA95B217C95E78
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Extract the ASCII text from a PostScript file. Nothing is displayed..% Instead, ASCII information is written to stdout. The idea is similar to.% Glenn Reid's `distillery', only a lot more simple-minded, and less robust...% If SIMPLE is defined, just the text is written, with a guess at line.% breaks and word spacing. If SIMPLE is not defined, lines are written.% to stdout as follows:.%.%.F <height> <width> (<fontn

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2epsi

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2794
Entropy (8bit):	5.5422534126778205
Encrypted:	false
SSDEEP:
MD5:	28B704D27B5A24160E441470598F359A
SHA1:	279E1492439A975704C9CB68E976AB12F357D8E4
SHA-256:	AB8CFF6475494EF349370CB63B9EF6E4F159FB96BBE41347FFDC093FB50E3262
SHA-512:	45D556D8F90DB40C42773AF96CEDCBE33E8B654ECC7CFD09365722E9068235D35F378BD10789545E052B20FD88B5CFF0A790938C6A85124CA78D5A7F79AC7BC3
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..# try to create a temporary file securely.if test -z "$TMPDIR"; then..TMPDIR=/tmp.fi.if which mktemp >/dev/null 2>/dev/null; then..tmpfile="`mktemp $TMPDIR/ps2epsi.XXXXXX`".else..tmpdir=$TMPDIR/ps2epsi.$$..(umask 077 && mkdir "$tmpdir")..if test ! -d "$tmpdir"; then...echo "failed: could not create temporary file"...exit 1..fi..tmpfile="$tmpdir"/ps2epsi$$.fi.trap "rm -rf \"$tmpfile\"" 0 1 2 3 7 13 15..export outfile..if [ $# -lt 1 -o $# -gt 2 ]; then..echo "Usage: `basename \"$0\"` file.ps [file.epsi]" 1>&2..exit 1.fi..infile=$1;..if [ $# -eq 1 ].then..case "${infile}" in.. .ps)..base=`basename "${infile}" .ps` ;;.. .cps).base=`basename "${infile}" .cps` ;;.. .eps).base=`basename "${infile}" .eps` ;;.. .epsf).base=`basename "${infile}" .epsf` ;;.. *)..bas

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2epsi.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1204
Entropy (8bit):	5.0298793098511
Encrypted:	false
SSDEEP:
MD5:	957F5658901C7E661494CD2D54EF70A3
SHA1:	9779E866245260B21CE4927B7BF1A7A691E253F0
SHA-256:	24641B965767809903DB6521ED0B997284693588916BCA400C06438839477B46
SHA-512:	0572E9554A6DFF996133EFD8B541F2805910F68FD268A96BA17D6B929DA4352EC747717361AA17845B5C6FF1ECEFC4992C60DC261558E912C254E34673FC5FD1
Malicious:	false
Reputation:	unknown
Preview:	@echo off ..if %1/==/ goto usage.if %2/==/ goto usage..call "%~dp0gssetgs.bat".set infile=%1.set outfile=%2..rem First we need to determine the bounding box. ps2epsi.ps below will pick.rem the result up from %outfile%.%GSC% -q -dNOPAUSE -dBATCH -P- -dSAFER -dDELAYSAFER -sDEVICE=bbox -sOutputFile=NUL %infile% 2> %outfile%..rem Ghostscript uses %outfile% to define the output file.%GSC% -q -dNOPAUSE -P- -dSAFER -dDELAYSAFER -sDEVICE=bit -sOutputFile=NUL ps2epsi.ps < %infile%..rem We bracket the actual file with a few commands to help encapsulation.echo %%%%Page: 1 1 >> %outfile%.echo %%%%BeginDocument: %outfile% >> %outfile%.echo /InitDictCount countdictstack def gsave save mark newpath >> %outfile%.echo userdict /setpagedevice /pop load put >> %outfile%..rem Append the original onto the preview header.rem cat.ps uses the %infile% and %outfile% environment variables for the filenames.%GSC% -q -dNOPAUSE -dBATCH -P- -dSAFER -dDELAYSAFER -sDEVICE=bit -sOutputFile=NUL cat.ps...echo %%%%EndDoc

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2epsi.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.9833968832405215
Encrypted:	false
SSDEEP:
MD5:	F1E546C81E98C0508E8956EA77DE9086
SHA1:	75589920D25258965069594C1A4F53DF1C3A36F7
SHA-256:	0CED33E0B704B9B9E41C3A0B1C10511825A9F1E8E3EC5B1C7A9A424FB093B720
SHA-512:	09AEE89C42F9EC61C30BBD484969B4B99373B546413AED59BF6DB6123F4A339B9D53A0DD0C9A104402B67694112D86DAF7FD9A8C5AFC260B6BEF0324BA9CABCD
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. */..@echo off.if %1/==/ goto usage.if %2/==/ goto usage..set infile=%1.set outfile=%2..rem First we need to determine the bounding box. ps2epsi.ps below will pick.rem the result up from %outfile%.gsos2 -q -dNOPAUSE -dBATCH -P- -dSAFER -dDELAYSAFER -sDEVICE=bbox -sOutputFile=NUL %infile% 2> %outfile%..rem Ghostscript uses %outfile% to define the output file.gsos2 -q -dNOPAUSE -P- -dSAFER -dDELAYSAFER -sDEVICE=bit -sOutputFile=NUL ps2epsi.ps < %infile%..rem We bracket the actual file with a few commands to help encapsulation.echo %%%%Page: 1 1 >> %outfile%.echo %%%%BeginDocument: %outfile% >> %outfile%.echo /InitDictCount countdictstack def gsave save mark newpath >> %outfile%.echo userdict /setpagedevice /pop load put >> %outfile%..rem Append the original onto the preview header.copy %outfile% + %infile%..echo %%%%EndDocument >> %outfile%.echo countdictstack

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2epsi.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.474262467214813
Encrypted:	false
SSDEEP:
MD5:	27CD8FE4F24E9926F050C5CE7EDF06AA
SHA1:	A0DA101E62FDFA26851DA88CEFE60BF0A300682C
SHA-256:	5B7D9DBF861531856E0675867A71221BD6917621A5D83E2B68C03746B81AFBEE
SHA-512:	C5F23DB640A5D8D36B3EB95AD8FCCC729F4F9F9F9BB7CA5A9F1863C220795950E4D106833E0E1C6C398035AD2549326D672A6C97F9EC11787ED00592CE7E28ED
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Convert an arbitrary PostScript file to an EPSI file..%.% Please do not contact these users if you have questions. They no longer.% have the time, interest, or current expertise to keep this code working..% If you find bugs, please send proposed fixes to bug-gs@ghostscript.com..%.% Bug fix 2002-04-20 by rayjj: Bounding box was incorrect since it depended.% on the dither pattern and gray shade at the boundary. Chan

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.940650040714981
Encrypted:	false
SSDEEP:
MD5:	868F7BFE3DAC6331E8766785AAB7A53A
SHA1:	9A91019471162117E0F870DD8189CDFC7A6179D9
SHA-256:	1DB131FE92B5106FCBE9BF1539CEA9AF6595085DBBABFFC30EC408222D89B63B
SHA-512:	7E3279F1B69491A6256CC02C5905F3DFF8185B2EDA1D970AE30914D444A4F8ED13666BE6B436CED46A264014F03CC6B9100E96AF3C50155EFD85D4A4E2971A69
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PostScript to PDF...# Currently, we produce PDF 1.4 by default, but this is not guaranteed.# not to change in the future..version=14..ps2pdf="`dirname \"$0\"`/ps2pdf$version".if test ! -x "$ps2pdf"; then..ps2pdf="ps2pdf$version".fi.exec "$ps2pdf" "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.116125513304257
Encrypted:	false
SSDEEP:
MD5:	EB12B1B17BAE9ACDF5F730E8A8B8F482
SHA1:	0A0538FA445685E69B074A8EE4705A45278D1773
SHA-256:	1AD73CCF3A7FEE6894FBDF83416DED3A2728771C49991C0CE0DC8B6A230B1056
SHA-512:	4CA93DBBDAB6D9E9F286EF2B6BEE09DD78DBD44DABD13BECBA51012C1D0753AB6F0258004B53CEF380CDE43CFACDE87E2B2A5C3D059F4D9B28D6444103474DF4
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Convert PostScript to PDF 1.4 (Acrobat 5-and-later compatible)..rem The default PDF compatibility level may change in the future:.rem use ps2pdf12 or ps2pdf13 if you want a specific level...set LIBDIR=%~dp0..rem The current default compatibility level is PDF 1.4..echo -dCompatibilityLevel#1.4 >"%TEMP%\_.at".goto bot..rem Pass arguments through a file to avoid overflowing the command line..:top.echo %1 >> "%TEMP%\_.at".shift.:bot.rem Search for leading '-'.echo %1 \| findstr /b /C:- >nul 2>&1.if ERRORLEVEL 1 goto proc.goto top.:proc.call "%LIBDIR%ps2pdfxx.bat" %1 %2.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	OS/2 REXX batch file, ASCII text
Category:	dropped
Size (bytes):	909
Entropy (8bit):	5.053023583691847
Encrypted:	false
SSDEEP:
MD5:	A6DA8C4EF62D2E0D2ECBD182C2B240A2
SHA1:	4B403745B2248C88E9262FF7722D7EE5DEFE3381
SHA-256:	995709D1A90470700F4863DB948D7041BECF80D10BAAD2F6E9E312D9C0C312A9
SHA-512:	B71187BA5396BD3719F8C8160A016F3F7E04EC86366BE00760904B9F3FE65FB0AF0A3EF6FBD71B148A8F5D8F34B548296B7A312F17D9F2FF6BB509903755B893
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ Convert PostScript to PDF 1.4 (Acrobat 5-and-later compatible). /./ The PDF compatibility level may change in the future: /./ use ps2pdf12 or ps2pdf13 if you want a specific level. /..parse arg params..gs='@gsos2'.inext='.ps'.outext='.pdf'..if params='' then call usage..options=''../ extract options from command line */.i=1.param=word(params,i).do while substr(param,1,1)='-'..options=options param..i=i+1..param=word(params,i).end..infile=param.if infile='' then call usage.outfile=word(params,i+1).if outfile='' then do..outfile=infile''outext..infile=infile''inext.end..gs options '-q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile='outfile options '-c save pop -f' infile.exit..usage:.say 'Usage: ps2pdf [options...] input[.ps output.pdf]'.exit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf12

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.070051775189495
Encrypted:	false
SSDEEP:
MD5:	F5DD2441CC7D66714004426EF0753D82
SHA1:	6A9B252D8C4568A644E923767FE80C0D8AE47BFE
SHA-256:	224B3536D3ABFE57F42B95D5D0EF23170505E93FCFFF8DC8240BA246E18D302D
SHA-512:	A807DB13EFE3B81585C0C71F6D65F05CD8BA00EA3EF719BE628ACCB5FFF44563A98774AE45EBDEA7E6EC9B88F35E221C12ED4734B006AC3E600787226DB0F851
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PostScript to PDF 1.2 (Acrobat 3-and-later compatible)..ps2pdfwr="`dirname \"$0\"`/ps2pdfwr".if test ! -x "$ps2pdfwr"; then..ps2pdfwr="ps2pdfwr".fi.exec "$ps2pdfwr" -dCompatibilityLevel=1.2 "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf12.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.188607771870123
Encrypted:	false
SSDEEP:
MD5:	5083568FE7F99A27106D38F15A1DE8DA
SHA1:	FBFB715CD0110A4AA37E90D2F4069B1691839CC1
SHA-256:	8D29AB6670BA4FF0A435F794C50E8A1D6C6347EDFD6689013B49C15484721324
SHA-512:	C633A8F93004BC4EE1FF16E6F774BF649359CE38C1A7FF90AF390DC281E86930A1EA639BE175AE44700FA87C5D35C0FFDEB260701877B17AB9B2BC89EA5D93FD
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Convert PostScript to PDF 1.2 (Acrobat 3-and-later compatible)...set LIBDIR=%~dp0..echo -dCompatibilityLevel#1.2 >"%TEMP%\_.at".goto bot..rem Pass arguments through a file to avoid overflowing the command line..:top.echo %1 >>"%TEMP%\_.at".shift.:bot.rem Search for leading '-'.echo %1 \| findstr /b /C:- >nul 2>&1.if ERRORLEVEL 1 goto proc.goto top.:proc.call "%LIBDIR%ps2pdfxx.bat" %1 %2.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf12.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.8610875885969325
Encrypted:	false
SSDEEP:
MD5:	BA18B3DF4376D1988EC695E6E7BE976E
SHA1:	00A34C55A2773AB364744A16B8008E5DBB600746
SHA-256:	71BE93A8A174C1CD9026C43317C5743F38B410DD238E6DEA9A1CFF261738EC63
SHA-512:	21136B0D394C8ECED7D4F6277B87710964082A950C0E828928D211253BE9B4FE735431F35C4E23D5D8480F767B5EF1D24036B6AE6E63C873AC56416E51485B15
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ Convert PostScript to PDF 1.2 (Acrobat 3-and-later compatible). */..parse arg params..call 'ps2pdf' '-dCompatibilityLevel=1.2' params.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf13

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.100238868192626
Encrypted:	false
SSDEEP:
MD5:	B96F45DE19B8BF5E1AFCDFF3A0181A72
SHA1:	C529A0A4DAC3218F12F1BD0F3F2C8668B189E65B
SHA-256:	A3D0653159E64A9ED338947366605BCBB9DE751571203D62ABA385D50BB46E0F
SHA-512:	8A615CFBA6B7FB227BC55C25618C0385B4C83268268E59259513BBDEEA6BA5514FF10E5F72B19A67006400E041B6E863EE0A7C89B6FB034D7FE56405D8769084
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PostScript to PDF 1.3 (Acrobat 4-and-later compatible)..ps2pdfwr="`dirname \"$0\"`/ps2pdfwr".if test ! -x "$ps2pdfwr"; then..ps2pdfwr="ps2pdfwr".fi.exec "$ps2pdfwr" -dCompatibilityLevel=1.3 "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf13.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.200624487148028
Encrypted:	false
SSDEEP:
MD5:	AA00A6C11C781CC0A77BC45AA5E80BF4
SHA1:	5A6CD53990E411EA7AD57DB925F30D23C532AEA1
SHA-256:	E0190BF29A6DB83E028BC7E95080F80CF9CBEE2F06AC94CAD18E5B10C08485CA
SHA-512:	7172F67986F96266892C2281191983BCD04729A1FFA94A3E55232E020F554AEE760730478143964F17A8E7605D1CB85CDE239D7EDE641DFAA463869BF95C2E2E
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Convert PostScript to PDF 1.3 (Acrobat 4-and-later compatible)...set LIBDIR=%~dp0..echo -dCompatibilityLevel#1.3 >"%TEMP%\_.at".goto bot..rem Pass arguments through a file to avoid overflowing the command line..:top.echo %1 >>"%TEMP%\_.at".shift.:bot.rem Search for leading '-'.echo %1 \| findstr /b /C:- >nul 2>&1.if ERRORLEVEL 1 goto proc.goto top.:proc.call "%LIBDIR%ps2pdfxx.bat" %1 %2.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf13.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.871215851472534
Encrypted:	false
SSDEEP:
MD5:	06D9815751042D56AE1A6965A9BC94C1
SHA1:	37987D0F67A04C7AF96D4CE70F855F999CEF85A8
SHA-256:	485C61FA0A4CF2E702E754ADB59C7EE2B8EAE438666EB69D36FBE5750E142E56
SHA-512:	F3D1AB59FF96CE8F6C1C0299198BF3AED94D9815C35FF1EBF21C05A68DC980340C66F55CBDE9A0FA6D09B9A4C001F9A49D172EF41AB77CBA2A5A62D500FE64EB
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ Convert PostScript to PDF 1.3 (Acrobat 4-and-later compatible). */..parse arg params..call 'ps2pdf' '-dCompatibilityLevel=1.3' params.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf14

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.100238868192626
Encrypted:	false
SSDEEP:
MD5:	294FFC3F3B999D5F22235C251C3A97CE
SHA1:	2347BB5E0826BFE5EC454FBA5A99D6EF8473BB9D
SHA-256:	F41AE340A9FAAD07C77FD89CE3ABDA0BEEB498F253398EDF4D315F9277828F62
SHA-512:	90A11D89796E6C145563C39CA18713244DE544353F267F9330E6506A461265435D872CB36FD259604B6954A5A59D46F716D27D829744271FBC480689766E0764
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PostScript to PDF 1.4 (Acrobat 5-and-later compatible)..ps2pdfwr="`dirname \"$0\"`/ps2pdfwr".if test ! -x "$ps2pdfwr"; then..ps2pdfwr="ps2pdfwr".fi.exec "$ps2pdfwr" -dCompatibilityLevel=1.4 "$@".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf14.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.200624487148028
Encrypted:	false
SSDEEP:
MD5:	E73952C1808EAD40B09F9D840E607AD7
SHA1:	295545505AC416567896BB5593F01228EC397A41
SHA-256:	FDE8B971EF81A87AD159F7D5AEF61FD3AF002CA91819F1DAD723D4A70522F388
SHA-512:	4F211701B5544BB9D63604F5A880526BC16766631DC61603F804AB202F30E2910B6436FA973A92537A7DBB4F02DE5301A9DDC7E00297E5ADC48CA1726337759F
Malicious:	false
Reputation:	unknown
Preview:	@echo off..rem Convert PostScript to PDF 1.4 (Acrobat 5-and-later compatible)...set LIBDIR=%~dp0..echo -dCompatibilityLevel#1.4 >"%TEMP%\_.at".goto bot..rem Pass arguments through a file to avoid overflowing the command line..:top.echo %1 >>"%TEMP%\_.at".shift.:bot.rem Search for leading '-'.echo %1 \| findstr /b /C:- >nul 2>&1.if ERRORLEVEL 1 goto proc.goto top.:proc.call "%LIBDIR%ps2pdfxx.bat" %1 %2.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdf14.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.871215851472534
Encrypted:	false
SSDEEP:
MD5:	4DD9C407150EA7C3A058075E0071444A
SHA1:	A1081748DAE6E11E63E957854EB40746E5A5906E
SHA-256:	671EB45BEA75105E00CF56D7EA687D17F5F4BC7A98B5CDA5F7F9E06D44A3509C
SHA-512:	B534AA6D62C8AE7DD3DBBF12F8C036E40FAC83FD322C3AE20005017E3BF547F0C59FD18B204024865C6EA170E0E16091D7202D9E554F2C76AE7ADCF0206CE6F1
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ Convert PostScript to PDF 1.4 (Acrobat 5-and-later compatible). */..parse arg params..call 'ps2pdf' '-dCompatibilityLevel=1.4' params.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdfwr

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	5.368989707321924
Encrypted:	false
SSDEEP:
MD5:	EFCF78EF4AC78A304A30FBEB4315D7C0
SHA1:	DA96EBA1128A8AC3A5380CD5A67910A6C64C2322
SHA-256:	5E70DDD89DDEE58B970984FCE403B6DB7AFEC0F7727B23B71411D265ED180910
SHA-512:	A612F9CA12BCD396752F0DD5FEC4A82656CF6ACBBC602D2D7B83B48466706718923C1EC891A1DE86E32E81B0AB9DD743F66E83A1924FA8499AFD89AD09EE81BF
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# Convert PostScript to PDF without specifying CompatibilityLevel...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..OPTIONS="-P- -dSAFER".while true.do..case "$1" in..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -lt 1 -o $# -gt 2 ]; then..echo "Usage: `basename \"$0\"` [options...] (input.[e]ps\|-) [output.pdf\|-]" 1>&2..exit 1.fi..infile="$1";..if [ $# -eq 1 ].then..case "${infile}" in.. -)..outfile=- ;;.. .eps).base=`basename "${infile}" .eps`; outfile="${base}.pdf" ;;.. .ps)..base=`basename "${infile}" .ps`; outfile="${base}.pdf" ;;.. *)..base=`basename "${infile}"`; outfile="${base}.pdf" ;;..esac.else..outfile="$2".fi..# We have to include the options twice because -I only takes effect if it.# appears before other options..exec "$GS_EXECUTABLE" $OPTIONS -q -P- -dNOPAUSE -dBATCH

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2pdfxx.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1460
Entropy (8bit):	5.164392724015736
Encrypted:	false
SSDEEP:
MD5:	B82F9935BFA11419EC6C363A29AE05E1
SHA1:	4DC77A41561A01318CD9814082AF0C2D83C2B2B8
SHA-256:	508B1E7BF50D351BFF30349DD32879A60897D407C0B4602102B5BCFAC56BB2A9
SHA-512:	A2C130056E06850ED0E1B5AC3A10EFF92C638A92BCD74A8AE285E830DC227BC2F48E0C0F7748C33525C93C30DCC5B87612534B24CF2711DC3DEF1CFE695DDC27
Malicious:	false
Reputation:	unknown
Preview:	@echo off.rem Internal batch file for calling pdfwrite driver...rem The files that call this one (ps2pdf*.bat) write the command-line.rem options into _.at, and then pass the last 2 (or fewer) arguments.rem to this file...call "%~dp0gssetgs.bat".echo -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE#pdfwrite >"%TEMP%\_.at"2..if "%OS%"=="Windows_NT" goto nt..rem.Run ps2pdf on any Microsoft OS...if %1/==/ goto usage.if %2/==/ goto usage..rem Watcom C deletes = signs, so use # instead..rem We have to include the options twice because -I only takes effect if it.rem appears before other options...:run.echo -sOutputFile#%2 >>"%TEMP%\_.at"2.copy /b /y "%TEMP%\_.at"2+"%TEMP%\_.at" "%TEMP%\_.at"2 >NUL.echo -c .setpdfwrite -f%1 >>"%TEMP%\_.at"2.%GSC% @"%TEMP%\_.at" @"%TEMP%\_.at"2.goto end..:usage.echo Usage: ps2pdf [options...] input.[e]ps output.pdf.goto end..rem.Run ps2pdf on Windows NT...:nt.if not CMDEXTVERSION 1 goto run.if %1/==/ goto ntusage.if %2/==/ goto nooutfile.goto run..:ntusage.echo Usage

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.453806535877303
Encrypted:	false
SSDEEP:
MD5:	8C87402C915B0074770CB1B8B251DE7E
SHA1:	7E1F932EBC97EA5E9022C831D73552AC79B6C28A
SHA-256:	1D7EC533B1D29C587B1485EE5F58D60599CC4A25AFA7DB018D4BA00679CAA5C6
SHA-512:	38D5A15D93E547FEFAB5CCA71923C8B15A09C09E3963C70F013C27D10C9DFF371CA25E98751E1F80CD3E997B5E167AE19DC97BA6BBF0E9F06C91D9B8AB855AC0
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# "Distill" PostScript...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..OPTIONS="-P- -dSAFER".while true.do..case "$1" in..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -ne 2 ]; then..echo "Usage: `basename \"$0\"` [options] input.ps output.ps" 1>&2..echo " e.g. `basename \"$0\"` -sPAPERSIZE=a4 input.ps output.ps" 1>&2..exit 1.fi..exec "$GS_EXECUTABLE" -q -sDEVICE=ps2write -sstdout=%stderr "-sOutputFile=$2" -dNOPAUSE -dBATCH $OPTIONS "$1".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ps.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	501
Entropy (8bit):	5.190193654137357
Encrypted:	false
SSDEEP:
MD5:	025E7D6CD7027E0703D2F45641E1D0A2
SHA1:	CF84B0FF361C640CF522598BBB2DF823D73F11FB
SHA-256:	F5ABF63C18161F9C40873BE31914C6A8D09DACE913DC039E64289E027620ABF8
SHA-512:	47E48CD7D16173B738CAAB1900C9263BF4D48838CB5EAEA63A8500DC66D2FBCDBF327C789DE324F59A44EFFB6B1645783FB583E6D5E5AC5B6942CB32838118FA
Malicious:	false
Reputation:	unknown
Preview:	@echo off .@rem "Distill" PostScript...if %1/==/ goto usage.if %2/==/ goto usage.call "%~dp0gssetgs.bat".echo -dNOPAUSE -P- -dSAFER -dBATCH >"%TEMP%\_.at".:cp.if %3/==/ goto doit.echo %1 >>"%TEMP%\_.at".shift.goto cp..:doit.rem Watcom C deletes = signs, so use # instead..%GSC% -q -sDEVICE#ps2write -sOutputFile#%2 @"%TEMP%\_.at" %1.if exist "%TEMP%\_.at" erase "%TEMP%\_.at".goto end..:usage.echo "Usage: ps2ps [options] input.ps output.ps".echo " e.g. ps2ps -sPAPERSIZE=a4 input.ps output.ps..:end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ps.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	OS/2 REXX batch file, ASCII text
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.035616810124054
Encrypted:	false
SSDEEP:
MD5:	7170214B7009F535E591B59E696E32CA
SHA1:	2AF83FABF9DE9AE3A688911779278E3D9F588072
SHA-256:	D0F243CD7D01C2D4617A45DE2017F740B783788FD623874157BF831F83909600
SHA-512:	D36FFEB45995FE3478578BBCED27E4185CF92A950051AC1E5626B7C85F8796BBACA4D90656B829D94F4EF2ECC806E794EC133B4791FE3F1EFC44E7D3BDD0D408
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ "Distill" PostScript. /..parse arg params..gs='@gsos2'..if params='' then call usage..options='-P- -dSAFER -dNOPAUSE -dBATCH'../ extract options from command line */.i=1.param=word(params,i).do while substr(param,1,1)='-'..options=options param..i=i+1..param=word(params,i).end..infile=param.if infile='' then call usage.outfile=word(params,i+1).if outfile='' then call usage..gs '-q -sDEVICE=ps2write -sOutputFile='outfile options infile.exit..usage:.say 'Usage: ps2ps ...switches... input.ps output.ps'.exit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ps2

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	669
Entropy (8bit):	5.3244219246539535
Encrypted:	false
SSDEEP:
MD5:	BC90D70227B613F8012F4BB4485EBD2D
SHA1:	6DF491B0E9E34C8B22634F6159D5CF21D76C9DD2
SHA-256:	00D9EB918871124F72C14404158D08DB63C24C38A9F426FBC0A556B4D7FEBAB2
SHA-512:	CF306B1B2ECBAAD13D029FEDB32C8A4788EFA7C275C18A3255754A2A450D702BD68EBCEEF8FCC0DE055CBEB2B86CA7AB1A8FE1DE6010020CAA61E960031B842B
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.# "Distill" PostScript with the Ghostscript 'ps2write' device.# this generates a PDF-style stream with an attached .# PostScript program to interpret it...# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs..OPTIONS="-P- -dSAFER".while true.do..case "$1" in..-?) OPTIONS="$OPTIONS $1" ;;..) break ;;..esac..shift.done..if [ $# -ne 2 ]; then..echo "Usage: `basename \"$0\"` [options] input.ps output.ps" 1>&2..echo " e.g. `basename \"$0\"` -sPAPERSIZE=a4 input.ps output.ps" 1>&2..exit 1.fi..exec $GS_EXECUTABLE -q -sDEVICE=ps2write -sstdout=%stderr "-sOutputFile=$2" -dNOPAUSE -dBATCH $OPTIONS "$1".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ps2.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	528
Entropy (8bit):	5.186279568559231
Encrypted:	false
SSDEEP:
MD5:	E35C2A861E7B51C8EE01DCAE82CAEA3C
SHA1:	B63438C67CE82453F2B6E754A917152072168FBD
SHA-256:	DC3BF721765750626E478DB3B259B7A293E7E3EA462A183EAC3B48FC94B95AA1
SHA-512:	234E8DC781003A2EF4BD3B180A27F25BD3DEC9B7DF4EF40BD0586CE9CAB9892B3E8FF4DEFEE3698E4B024F386493B7C09FF10C88C783BB2C7E86A55B558B5B66
Malicious:	false
Reputation:	unknown
Preview:	@echo off.@rem Converting Postscript 3 or PDF into PostScript 2...if %1/==/ goto usage.if %2/==/ goto usage.call "%~dp0gssetgs.bat".echo -dNOPAUSE -P- -dSAFER -dBATCH >"%TEMP%\_.at".:cp.if %3/==/ goto doit.echo %1 >>"%TEMP%\_.at".shift.goto cp..:doit.rem Watcom C deletes = signs, so use # instead..%GSC% -q -sDEVICE#ps2write -sOutputFile#%2 @"%TEMP%\_.at" %1.if exist "%TEMP%\_.at" erase "%TEMP%\_.at".goto end..:usage.echo "Usage: ps2ps [options] input.ps output.ps".echo " e.g. ps2ps -sPAPERSIZE=a4 input.ps output.ps..:end.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ps2ps2.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	OS/2 REXX batch file, ASCII text
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.035616810124054
Encrypted:	false
SSDEEP:
MD5:	7170214B7009F535E591B59E696E32CA
SHA1:	2AF83FABF9DE9AE3A688911779278E3D9F588072
SHA-256:	D0F243CD7D01C2D4617A45DE2017F740B783788FD623874157BF831F83909600
SHA-512:	D36FFEB45995FE3478578BBCED27E4185CF92A950051AC1E5626B7C85F8796BBACA4D90656B829D94F4EF2ECC806E794EC133B4791FE3F1EFC44E7D3BDD0D408
Malicious:	false
Reputation:	unknown
Preview:	/. This file is maintained by a user: if you have any questions about it,. * please contact Mark Hale (mark.hale@physics.org).. /../ "Distill" PostScript. /..parse arg params..gs='@gsos2'..if params='' then call usage..options='-P- -dSAFER -dNOPAUSE -dBATCH'../ extract options from command line */.i=1.param=word(params,i).do while substr(param,1,1)='-'..options=options param..i=i+1..param=word(params,i).end..infile=param.if infile='' then call usage.outfile=word(params,i+1).if outfile='' then call usage..gs '-q -sDEVICE=ps2write -sOutputFile='outfile options infile.exit..usage:.say 'Usage: ps2ps ...switches... input.ps output.ps'.exit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\quit.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:
MD5:	6B9541966446CBCF79C21825BD2FF17B
SHA1:	8FBF3A9CA829C12E55D8C98C812F3834F09B341F
SHA-256:	0A7B6A054F4637F0B3077C3427E3A0491812CDA612EADF6A94CCFA11398564B6
SHA-512:	26A7BB8C64962E0516C05E10756414E2C64460477A928DD46ECF26F615F266BE12FB1A239D5131F9452A30C7C04929920E0217BCB069B1D97F336AE507957051
Malicious:	false
Reputation:	unknown
Preview:	quit.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ras1.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.102309090855406
Encrypted:	false
SSDEEP:
MD5:	59D4A595BF81CBBB7B2F445532DDB071
SHA1:	722E72C659FDF04AC344686E286F351A71642FB4
SHA-256:	E79D4747C5392532C902BFF45CEFB7F3F645C765B1E828D1F3B1601840BA63B6
SHA-512:	63CED351E756F15DD9138C07D31B1DBD99C28CFD62FAC98023A2A44353ADD70310F3156207A37B46D232D33405802135B798BA301FFE8035377822B182473980
Malicious:	false
Reputation:	unknown
Preview:	-supModel="SUN rasterfile, 1 Bit, 2 Colors (Ghostscript-Rendering)".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/SunRaster.-dupComponentBits={1}.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ras24.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.126451690639683
Encrypted:	false
SSDEEP:
MD5:	0ED30A7AC03FCF45F98D122EA405BDEE
SHA1:	6E411895FC75638C152642A59261A6E26F20A564
SHA-256:	F437EABB758FACAE9C10D064E081C944EE207F2C2D26167CD84C1B848B6F90CD
SHA-512:	FB2E336C46558C7CA0FAAE70F2A1164954216800D0E390A3F5B15B0E19B04D70338BF162BD14E6779298EEE74523A62796C2414B3A0139D35FC75E51229FC923
Malicious:	false
Reputation:	unknown
Preview:	-supModel="SUN rasterfile, 24 Bit, 7 Colors (RGB-Error-Diffusion)".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceRGB.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/SunRaster.-dupComponentBits="{8 8 8}".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ras3.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.148991472539039
Encrypted:	false
SSDEEP:
MD5:	8034FD35AA6BA116DDA168F6917B4EEB
SHA1:	B29BDEA4F4F3FBF4113D1DF82772559D77F12975
SHA-256:	A28915C7682F6350F7C5DECF1B6EAA34BDADB59815E08755C10A2AD178D5F50C
SHA-512:	7973FE5BF6810B89E490877F9C79C98B44E179F4970930979D8D61F51B87E7645CAAD1A4A1EC11092D4F45F9074657776B05D5915545D959FFC74DC7733D587C
Malicious:	false
Reputation:	unknown
Preview:	-supModel="SUN rasterfile, 3 Bit, 7 Colors (RGB-Ghostscript)".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceRGB.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/SunRaster.-dupComponentBits="{1 1 1}".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ras32.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.131510539727149
Encrypted:	false
SSDEEP:
MD5:	A5DDBA369FB38E8A9D0C4386D08989C4
SHA1:	39BBEFC2245901AA63C53081661F78F1643DBBC6
SHA-256:	97B20B1A1012D2488B0DEB2C4B94784CA1CB898BD09E77E0197CF8EBDE0471A9
SHA-512:	C90C0B2D16461C4A137C9D588D672FF1BB7148A9EBF352B6D9B43F5736ACC5E431263DD5357372ECEC9CD9ACA6BBE3CE3A7275BA63E23EACB8AC41A49EF4D8C7
Malicious:	false
Reputation:	unknown
Preview:	-supModel="SUN rasterfile, 32 Bit, 6+1 Colors (CMYK-Error-Diffusion)".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/SunRaster..

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ras4.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.20756606168581
Encrypted:	false
SSDEEP:
MD5:	0E2ABC98189B8ACB9558CCC6E16EAD09
SHA1:	8DC6B4D05911A7178F5F219513F1E613AFF4D3D1
SHA-256:	EED86DC1B4AF515566EBAB5F3B8FDF76154350D274EB2E29812C677AF6B43D5F
SHA-512:	483FEB39BE9738EFF47653B9C9959646FE12161D378BC47B627289D4B9077078898DA8465E806EB22BBD28C364F54B869BAB8328DB8F2661440FE5007DD85BDF
Malicious:	false
Reputation:	unknown
Preview:	-supModel="SUN rasterfile, 4 Bit, 6+1 Colors (CMYK-Ghostscript)".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/SunRaster.-dupComponentBits="{1 1 1 1}".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\ras8m.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.070623892420277
Encrypted:	false
SSDEEP:
MD5:	168EB178B4E4240E54696597DABABEE3
SHA1:	A39DE404483F4B41C1BA6618BED72FCF2CA2B5B0
SHA-256:	6C7031170881DCA72E5FD8B7163074804E8FE7322D9B82C6BAD93B9EE3557148
SHA-512:	6760D08D6D6D759555B1AF9A844500211A16E4E4CB28AFA6550EF124B7A30598082A9152F0D8BE88BA038FDCEA4B6A4E6AD427CCD677B43893BAC1475BBCFCD6
Malicious:	false
Reputation:	unknown
Preview:	-supModel="SUN rasterfile, 8 Bit, 2 Colors (Error-Diffusion)".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/SunRaster.-dupComponentBits={8}.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\rinkj-2200-setup

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3228
Entropy (8bit):	3.8565307475969557
Encrypted:	false
SSDEEP:
MD5:	FD4A647727E32FB07F3EF3E9547553B3
SHA1:	C7DA4860B3316FA989903DE4288E40CDEF3EF2FC
SHA-256:	726B0FE2791088A7FFA2ADFC355B6EDBDAAC5BAE4347AFB34C96FB43AC7E5BC7
SHA-512:	3A462C42586C4A5AFD5883AFA07A9EE0F299D1709299496ECB40C8D3323E86F3E2610575C98F63BB580692993C241EBE448676220957D7DFC0595DDD4562387A
Malicious:	false
Reputation:	unknown
Preview:	Manufacturer: EPSON.Model: Stylus Photo 2200.Resolution: 1440x720.Dither: 2.Aspect: 2.Microdot: 16.Unidirectional: 0.AddLut: K.23.0 0.0.041667 0.072936.0.083333 0.144825.0.125000 0.193066.0.166667 0.249716.0.208333 0.302334.0.250000 0.342984.0.291667 0.386044.0.333333 0.425084.0.375000 0.458522.0.416667 0.520504.0.458333 0.577275.0.500000 0.605041.0.541667 0.652086.0.583333 0.679372.0.625000 0.703745.0.666667 0.727044.0.708333 0.750855.0.750000 0.765267.0.791667 0.920270.0.833333 0.992157.0.875000 0.996076.0.916667 1.000000.AddLut: K.4.0 0.0 0.5.0.15 0.75.0.65 1.AddLut: k.23.0 0.0.041667 0.072936.0.083333 0.144825.0.125000 0.193066.0.166667 0.249716.0.208333 0.302334.0.250000 0.342984.0.291667 0.386044.0.333333 0.425084.0.375000 0.458522.0.416667 0.520504.0.458333 0.577275.0.500000 0.605041.0.541667 0.652086.0.583333 0.679372.0.625000 0.703745.0.666667 0.727044.0.708333 0.750855.0.750000 0.765267.0.791667 0.920270.0.833333 0.992157.0.875000 0.996076.0.916667 1.000000.AddLut: k.5.0 0.0.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\rollconv.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	12533
Entropy (8bit):	4.841594512185899
Encrypted:	false
SSDEEP:
MD5:	624281B83F37FB4A779E08B311FDE47C
SHA1:	0503A30EBA74C48F5F3956810BA781D251A27484
SHA-256:	A716347C0FB717B28A4075590E95518D01E58B09C351579630D6CD0921E91D24
SHA-512:	377EE27AD5D5E3A256DA102714D5E10D206302D76463EE5F5A83B63AB3BFD028DE471DF290EE9FE4B71B3118C5253DE97CEC8BB88A6EF2AB554739B318FA7674
Malicious:	false
Reputation:	unknown
Preview:	%!.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Utility program for converting Japanese fonts produced by Macromedia's.% Rollup program to Type 0 fonts suitable for use with Ghostscript..%.% Rollup produces the following files, where xxx is the font name:.%.xxx-H, xxx-SA, xxx-SB, xxx-SK, xxx-SR, xxx-UG.%.JIS83-1_COD.%.JIS83-1_CSA.% The _COD and _CSA files are large files containing the actual.% character outline data; they may theoretically be shared between.%

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\showchar.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2796
Entropy (8bit):	4.759527778487614
Encrypted:	false
SSDEEP:
MD5:	BBE2A99E2F566FED1874D1BFECCA6EED
SHA1:	3DCBE3BEFF243A7DC1A6855E56EDB98BED56A4AD
SHA-256:	62FA1275AC8ACFBA28FFC5B7EA8EB7A9F2F05A7A0E0A66F417749214EAD02ADB
SHA-512:	B28BCFE64C151405273BA28EE50A57F3B0057788E10A80D8769A38A0CECE79D914D8F5DDEAA36FC94E19B2FF16ABD861E56E7B82539C1E097A82287E51A19D1D
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% showchar.ps.% Show the outline and rasterized forms of a character.../F where { pop } { /F /Times-Roman def } ifelse./P where { pop } { /P 16 def } ifelse./Rx where { pop } { /Rx 100 def } ifelse./Ry where { pop } { /Ry 100 def } ifelse./Cs where { pop } { /Cs (M) def } ifelse./Pr where { pop } { /Pr false def } ifelse./Delay where { pop } { /Delay 0 def } ifelse..0 setgray.(markpath.ps) runlibfile.(markhint.ps) runl

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\showpage.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:
MD5:	D9D23D093FD5C53C61089498CE26D735
SHA1:	D7F2947AB3D98B783C7C9147DF8A9C7D9D3FFA94
SHA-256:	1CFCED39C2F03453FD6AAA03387ED144143CB77C38E44DD90DB8F91545420C03
SHA-512:	DC8FEC9C1DA8A0D85C879B345295BD70EEF1F3CF53BABBAFB00466E255B2471C374F64CB50B97AB3F23805D33B17F6FBB65B8B7A0840E843D08B3024C8303C77
Malicious:	false
Reputation:	unknown
Preview:	showpage.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\st640ih.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	4.829642125669626
Encrypted:	false
SSDEEP:
MD5:	5FCA0AFB8214DEA2B62F8F8CD6EFC5CB
SHA1:	AAC88872C68359C96ED536D39B8B71C2C32BAB79
SHA-256:	AB17A5A51E7348EA73884703544C0841690CC3388F4665745F59FCBE29DF2112
SHA-512:	F247826F42D7C5D3073963389823368B77EB09DBB712398AD8DA3A491F8CBE7493170057ECCA79A3574DA810E627A72D5D921D0320CEC195321D8967F33B3536
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 1440x720DpI, Inkjet Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/EscP2XY.-r1440x720.-dupMargins="{ 9.0 24.0 9.0 9.0}".-dupBlackTransfer="{ . 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.}".-dupCyanTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.}".-dupMagentaTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.3000

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\st640ihg.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1508
Entropy (8bit):	5.025976149540954
Encrypted:	false
SSDEEP:
MD5:	AB4C6FD1634E2791E7DF3F670244018A
SHA1:	19C06EE1F568571F04D24C57AAA14E1640FB6D28
SHA-256:	7090E923A47E1C0910AE4167C56AB5283FCFBC88595199B8FD1DF9CD1A6B1432
SHA-512:	567DAE663A9D0127EF7C0B380D41687870C4626F985134FC09B38ADE6DAA7E09314E04520B700A476208FC45486723A1AF08A15551334209C696ECF4EE5483C9
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 1440x720DpI, Grayscale, Inkjet Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2XY.-r1440x720.-dupMargins="{ 9.0 24.0 9.0 9.0}".-dupWhiteTransfer="{ . 0.30000000 0.25411765 0.20862745 0.18509804 0.16313725 0.14588235 0.12862745. 0.11450980 0.10196078 0.09098039 0.08156863 0.07215686 0.06431373 0.05490196. 0.04549020 0.03764706 0.02980392 0.02196078 0.01254902 0.00627451 0.00000000.}".-dupOutputComponentOrder="{ 0 }".-dupWeaveXPasses=2.-dupOutputXStep=2.-dupWeaveYPasses=8.-dupOutputPins=30.-dupWeaveYFeeds="{15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15}".-dupWeaveXStarts="{0 1 0 1 0 1 0 1 1 0 1 0 1 0 1 0}".-dupWeaveYOffset=38.-dupWeaveInitialYFeeds="{ 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 15}".-dupWeaveInitialXStarts="{0 1 0 1 0 1 0 1 1 0 1 0 1 0 1 0}".-dupWeaveInitialPins="{ 15 9 18 12 6 15 9 18 27 21 30 24 18 27 21 30}".-dupFormatYa

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\st640p.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1914
Entropy (8bit):	4.834834425735493
Encrypted:	false
SSDEEP:
MD5:	B64FB615CA608B1F5D3DBED9E21A3DD0
SHA1:	2EDFB8B4BAFEE4F4A5C1237BA283A5E758A00A2D
SHA-256:	2155E58AC44CBC41E9D9E94D838DA4058DB39EED036F5591BC355B5DBE814CD6
SHA-512:	9CC85D28B4F91CCA904D52DC064CF84D4CC40F326B0E1CEC7A389650450A3F14A89D89A45DF73355C29A950C8FC4337CEE3BCE663F286B228604808F3AD8BDD6
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 720x720DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 24.0 9.0 9.0}".-dupBlackTransfer="{ . 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.}".-dupCyanTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.}".-dupMagentaTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\st640pg.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	5.149750561616583
Encrypted:	false
SSDEEP:
MD5:	819E9B73F25FC4DB54258F761D6EDD9B
SHA1:	1A46E3D1F74ACA348A09A20297C4E6E17544E584
SHA-256:	01B3A4FD615AA11247917EA6C8002EAE723007AE664D59C21534FEE197B8FC64
SHA-512:	45B1A57D84E4CB9D1BABAB9166EFA558A4FFC0644C933182CF7E981EA00031C90A74A427305551488F58F4CBE4035F8A91C7BF0970327D7684A36CF91513161D
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 720x720DpI, Grayscale, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 24.0 9.0 9.0}".-dupWhiteTransfer="{ . 0.30000000 0.25411765 0.20862745 0.18509804 0.16313725 0.14588235 0.12862745. 0.11450980 0.10196078 0.09098039 0.08156863 0.07215686 0.06431373 0.05490196. 0.04549020 0.03764706 0.02980392 0.02196078 0.01254902 0.00627451 0.00000000.}".-dupOutputComponentOrder="{ 0 }".-dupWeaveYPasses=8.-dupOutputPins=32.-dupWeaveYFeeds="{31 31 31 31 37 33 33 29}".-dupWeaveInitialYFeeds="{1 1 1 1 1 1 1 25}".-dupWeaveInitialPins="{ 4 24 28 32 19 15 11 7}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 05. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMargi

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\st640pl.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1878
Entropy (8bit):	4.852133328731872
Encrypted:	false
SSDEEP:
MD5:	7C9025FCBA2EADFAB79F8A0B0A785DD8
SHA1:	A088E5F4A76EA17BDDE1B4D009C496280EABABAC
SHA-256:	46B3BF1C57F92C2235CC2342E449AFFE1664988AC609F566133913CE963DBEE1
SHA-512:	4A890B68F0CD06F8CCD437ECE978ED1B1DDFBA2AE4C5A3E76202DE493A64DE5524752DE34DEFA38BF8998D1AE3D0662719FBFC798F4233C744B6451ECF4EEE9C
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/FSCMYK32.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 24.0 9.0 9.0}".-dupBlackTransfer="{ . 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.}".-dupCyanTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.}".-dupMagentaTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.30000000.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\st640plg.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1105
Entropy (8bit):	5.183958020642382
Encrypted:	false
SSDEEP:
MD5:	D5E8D1E13C6857A37C8D757DEBBD6F89
SHA1:	A7D62AC3E8AE8CB154891499F617FAA291A27C9F
SHA-256:	64DE0F0E8BAF1C730F723A39BC18DBB9A294C6EEDE14AF728AC2C6FE4D8E27B9
SHA-512:	4AAFEE5E5A4843FD74A279B47CEE0624F459730FF4FA4582B5E02DD51F411A41EFEBA8A88C3E6639A6F25F98B6F140F4E66C1248E63B0D58566CB3A91363E236
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 360x360DpI, Grayscale, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 24.0 9.0 9.0}".-dupWhiteTransfer="{ . 0.30000000 0.25411765 0.20862745 0.18509804 0.16313725 0.14588235 0.12862745. 0.11450980 0.10196078 0.09098039 0.08156863 0.07215686 0.06431373 0.05490196. 0.04549020 0.03764706 0.02980392 0.02196078 0.01254902 0.00627451 0.00000000.}".-dupOutputComponentOrder="{ 0 }".-dupWeaveYPasses=4.-dupOutputPins=32.-dupWeaveYFeeds="{33 30 35 30}".-dupWeaveInitialYFeeds="{1 1 1 29}".-dupWeaveInitialPins="{ 8 16 32 23}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 0A. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMarginComma

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1923
Entropy (8bit):	4.724213569772992
Encrypted:	false
SSDEEP:
MD5:	9C60F975678B4CBA950A15865346AD76
SHA1:	C76C94077C815882EC2A7FD795F6537EE26D86FB
SHA-256:	247D754856B9615613AAB92AA89A84DE5E42AC4740F9756D001B22D4488512FB
SHA-512:	0C0882C60002FC8C073B7334678F3542DA9BFC30F47838794807C1E6293442FB81EF3642AA3747CDC088852C2C11232ACB47354CC3FC03A8D507F1DE5DB658A3
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color I (and PRO Series), 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=4.-dupOutputPins=15.-dupWeaveYFeeds="{15 15 15 15}".-dupWeaveInitialYFeeds="{1 1 1 13}".-dupWeaveInitialPins="{ 4 15 11 7}".-dupBlackTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.057

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc1520h.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	4.9106412217646
Encrypted:	false
SSDEEP:
MD5:	231FD9DA6A5412283333237DABAA8023
SHA1:	CCD5C014595331865BCB6773E7CE320CB76F12ED
SHA-256:	FC8A80C1936CE51A2BAD1A5E85A4BE12C502C3529FB75642C815D6D5ED266910
SHA-512:	6E09A4E10F237373767053B30D229FE054DB516DEBFC857DB49DF41AE7C097E0211B608E0F5908A25A69F46617DB145ABD0B62761CC9483EB3ECDA7BA0666276
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 1520, 1440x720DpI, Inkjet Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2XY.-r1440x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ . 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000000.}".-dupCyanTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000000.}".-dupMagentaTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.4000

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc2.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1904
Entropy (8bit):	4.716713653373825
Encrypted:	false
SSDEEP:
MD5:	2707D0FA3A0FAAC12BDE144253A89E40
SHA1:	8F1F951ADBD2B3FD62202360E93029EECDE1355A
SHA-256:	21E117CE4EADF813C3EE269D165C994785FB7B5926DBF997E4851000603965BC
SHA-512:	BF24B3CF8D2BBB53CC0AC16B4C71B5C367B7C29B4513F2FE49C5814D171B2620DC1E9384C6A7776C203A4BB9A7DBD65DBBF2D44753662DD4164E861D16935EF3
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color II / IIs, 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=3.-dupOutputPins=20.-dupWeaveYFeeds="{20 20 20}".-dupWeaveInitialYFeeds="{1 1 19}".-dupWeaveInitialPins="{ 7 20 13}".-dupBlackTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc200_h.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	4.663920745485749
Encrypted:	false
SSDEEP:
MD5:	A29F41C0B304A314099C19CCD963A6C4
SHA1:	0FF53B98F0CA19AA64F44C14063A42C7E4CD6FDE
SHA-256:	6FDC33E38660E3DDA0A404C0052490F96EA6DA22318A84441E56D53DDECAD9AB
SHA-512:	FE0B7230772B947BDE9670486EB10D055B317E9A7A01807481C77965D23C114B0868248AC49B7BF14368D8C011CA1C2416D1E51F484D5B0282D0B8011F025274
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 200 , 360x720DpI".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2XY.-r360x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupOutputPins=19.-dupWeaveYPasses=6.-dupWeaveXPasses=1.-dupWeaveYFeeds="{19 19 19 19 19 19}".-dupBlackTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.27

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc2_h.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1879
Entropy (8bit):	4.723097158191983
Encrypted:	false
SSDEEP:
MD5:	EA71CB1E749281697C8A90515B3F307B
SHA1:	3926E70F57AE7B2312B808ED5A7EED6709F0E033
SHA-256:	41A85F3A0BF7885C87ACCF148C8474A4EF444C2F49A915E6C2E7D564A94F0EDD
SHA-512:	4F143A0E76500D9478CD918A492A59DFE1368FC0FA4CED9D00590F1D2A01432B758E7303AA3A367FFB5D6B77AE82CAEFAC39DBAA730D78C4A05F9DD97153B43C
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color II, 720x720DpI, Special Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=6.-dupOutputPins=20.-dupWeaveYFeeds="{20 20 19 22 16 23}".-dupWeaveInitialYFeeds="{1 1 1 1 1 19}".-dupWeaveInitialPins="{ 4 20 7 17 10 13}".-dupBlackTransfer="{. 0.0000 0.0011 0.0079 0.0151 0.0217 0.0287 0.0354 0.0425. 0.0492 0.0562 0.0633 0.0700 0.0766 0.0835 0.0900 0.0975. 0.1054 0.1147 0.1243 0.1364 0.1489 0.1641 0.1833 0.2012. 0.2217 0.2492 0.2814 0.3139 0.3487 0.3996 0.4527 0.5195.}".-dupCyanTransfer="{. 0.0000 0.0011 0.0079 0.0151 0.0217 0.0287 0.0354 0.0425. 0.0492 0.0562 0.0633 0.0700 0.0766 0.0835 0.0900 0.0975. 0.1054 0.1147 0.1243 0.1364 0.1489 0.1641 0.1833 0.2012. 0.2217 0.2492 0.2814 0.3139 0.3487 0.3996 0.4527 0.5195.}".-dupMagentaTransfer="{. 0.0000 0.0011 0.0079 0.0151 0.0217 0.0287 0.0354 0.0425.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc2s_h.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	4.48996732014665
Encrypted:	false
SSDEEP:
MD5:	DCE0AC9BC9329106E068D70D044C51B4
SHA1:	67C9DCC74A09AC5C01AB4C4360B35C4E41A1DE92
SHA-256:	AF6F2D136E880CE0E2CE911C33DD6BD41ADBB5BFFB976D90A04587C625277997
SHA-512:	D7F272E30E08A18DB07FADA37D280C1C416CDDC43B70E87648B203BD32761A780ADC22D9094CA70D1B064F02BB0AA0C28150D1DB8E429BD51ED2BC037299BA1E
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color IIs, 720x720DpI, Special Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2XY.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{. 0.0000 0.0003 0.0027 0.0056 0.0085 0.0120 0.0156 0.0196. 0.0227 0.0260 0.0292 0.0323 0.0354 0.0386 0.0416 0.0450. 0.0503 0.0564 0.0630 0.0711 0.0799 0.0905 0.1038 0.1169. 0.1321 0.1522 0.1761 0.2011 0.2285 0.2678 0.3102 0.3637.}".-dupCyanTransfer="{. 0.0000 0.0008 0.0055 0.0106 0.0152 0.0201 0.0248 0.0298. 0.0344 0.0393 0.0443 0.0490 0.0536 0.0585 0.0630 0.0683. 0.0738 0.0803 0.0870 0.0955 0.1042 0.1149 0.1283 0.1408. 0.1552 0.1744 0.1970 0.2197 0.2441 0.2797 0.3169 0.3637.}".-dupMagentaTransfer="{. 0.0000 0.0008 0.0055 0.0106 0.0152 0.0201 0.0248 0.0298. 0.0344 0.0393 0.0443 0.0490 0.0536 0.0585 0.063

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc300.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2136
Entropy (8bit):	4.831312470310488
Encrypted:	false
SSDEEP:
MD5:	40663120844F58D713B026D0D7D434D1
SHA1:	89732E6B0A5C85A83CF83E062EEE9F6138292D19
SHA-256:	EB5289C412586D316A9458A852672D8D6B3F3AFA79D3A6A80CC1168642F62B94
SHA-512:	CEAC289B1A1B0B2A64C4002D8973F720B969C448FDCD7CC50C817F26A1884C48C7388F1858ACF1E6B37920ED5A6AFD2A807149011940A17AD67AD5445B56EEFF
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 300, 360x360 dpi, colour, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscNozzleMap.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=6.-dupOutputPins=11.-dupWeaveYFeeds="{11 11 11 11 11 11}".-dupWeaveInitialYFeeds="{1 1 1 1 1 7}".-dupWeaveInitialPins="{ 2 11 9 7 5 3}".-dupWeaveYOffset=0.-dupNozzleMapRowsPerPass=64.-dupNozzleMapPatternRepeat=6.-dupNozzleMapRowMask="{ 2 4 1 3 0 0 }".-dupNozzleMapMaskScanOffset="{ 0 1 2 3 0 0 }".-dupBlackTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.3209 0.3496 0.3820 0.4145 0.4505 0.4907 0.5344 0.5840. 0.6445 0.7093 0.8154 0.9816 0.9983 0.9988 0.9994 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0034 0.0185 0.0377 0.0574 0.0769 0.0952 0.1147. 0.1337 0.1540 0.1759 0.1985 0.2209 0.2457 0.2706 0.2949. 0.32

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc300bl.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1341
Entropy (8bit):	5.119219054093829
Encrypted:	false
SSDEEP:
MD5:	5CE3B76061E96F2A62F7EF6A3EBC9E66
SHA1:	F2070199751FE88F0A5041D89A93741EF36ACF17
SHA-256:	29DD2819ECEDE70EB20FAB8AC1E18981F2DC602A57F2FA99431F57A9D60BEFDA
SHA-512:	FAEFBA4FBBFE994164E52C018AAFDF34C48FD4B533FB423919C7AADA9B97FF1F2C5155D51F7D06F43383F326C907A6EC04588790B868FC6CC356DB8C8B09EB5B
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 300, 180x180 dpi, black only, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscNozzleMap.-r360x180.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=1.-dupOutputPins=31.-dupNozzleMapRowsPerPass=64.-dupNozzleMapPatternRepeat=6.-dupNozzleMapRowMask="{ 0 0 1 0 1 1}".-dupNozzleMapMaskScanOffset="{ 0 0 0 0 1 2 }".-dupWhiteTransfer="{.1.0 0.921295345 0.846429467 0.775337517 0.707954228.0.644212425 0.584044278 0.527380228 0.474149585 0.424279869.0.377697408 0.334326446 0.294089675 0.256907612 0.222698912.0.191379622 0.162863538 0.137061611 0.113881744 0.0932285339.0.0750028 0.0591011234 0.0454152822 0.0338314585 0.0242292974.0.0164806321 0.0104477014 0.00598061318 0.00291339168 0.00105723308.0.000186894162 0.0.}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc300bm.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	5.180274063984284
Encrypted:	false
SSDEEP:
MD5:	46433CA4F28AC29AB85AF92E101B7EC6
SHA1:	B600C7D3FB61F9A503EE2A8868A9A97B082C7AFC
SHA-256:	6564A9E4E1F7E1ADA4F33BA25323F47B5683D3FC3601BB193EBF47785FB1B2DD
SHA-512:	613AAED1760EE09D3890B4DA00F81690B960D6021D98A37CCADCC4235B6FDCACFB5EFF3A85DAA14469957BB3E2B5115022B4B13EC259E9464B91ED769A078DE8
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 300, 360x360 dpi, black only, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceGray.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscNozzleMap.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=2.-dupOutputPins=31.-dupWeaveYFeeds="{31 31}".-dupWeaveInitialYFeeds="{1 31}".-dupWeaveInitialPins="{16 31}".-dupNozzleMapRowsPerPass=64.-dupNozzleMapPatternRepeat=6.-dupNozzleMapRowMask="{ 0 0 1 0 1 1}".-dupNozzleMapMaskScanOffset="{ 0 0 0 0 2 4 }".-dupWhiteTransfer="{.1.0 0.921295345 0.846429467 0.775337517 0.707954228.0.644212425 0.584044278 0.527380228 0.474149585 0.424279869.0.377697408 0.334326446 0.294089675 0.256907612 0.222698912.0.191379622 0.162863538 0.137061611 0.113881744 0.0932285339.0.0750028 0.0591011234 0.0454152822 0.0338314585 0.0242292974.0.0164806321 0.0104477014 0.00598061318 0.00291339168 0.00105723308.0.000186894162 0.0.}".-dupBeginPageCommand="<. 00 00

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc500p.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1903
Entropy (8bit):	4.448967104456061
Encrypted:	false
SSDEEP:
MD5:	B787ADD9536CE456161215395911AB59
SHA1:	785C679820E5112D15C7FDD2938DB5685FFB52FA
SHA-256:	A551D8D5FAB7E6A1EEEC78BA74C0311E2CE192109AF1398346986D3BC8D87CA9
SHA-512:	47C00FC298496FE9B0EF0587FB21BE1C49525AAAE8073DE2BAD3CE86C6D269C261ECB83CA73A1DE656CD160387233A7C835BB8869B0CFAC062A5B6B5515C7FB4
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 500, 360x360DpI, not Weaved, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{. 0.0000 0.0008 0.0075 0.0155 0.0235 0.0331 0.0430 0.0540. 0.0625 0.0714 0.0804 0.0889 0.0973 0.1061 0.1143 0.1239. 0.1382 0.1551 0.1732 0.1956 0.2196 0.2488 0.2854 0.3215. 0.3633 0.4185 0.4841 0.5529 0.6284 0.7365 0.8529 1.0000.}".-dupCyanTransfer="{. 0.0000 0.0021 0.0152 0.0291 0.0418 0.0552 0.0681 0.0818. 0.0947 0.1082 0.1218 0.1347 0.1474 0.1607 0.1732 0.1877. 0.2029 0.2208 0.2393 0.2626 0.2866 0.3159 0.3528 0.3873. 0.4268 0.4797 0.5417 0.6042 0.6712 0.7692 0.8714 1.0000.}".-dupMagentaTransfer="{. 0.0000 0.0021 0.0152 0.0291 0.0418 0.0552 0.0681 0.0818. 0.0947 0.1082 0.1218 0.1347 0.1474 0.160

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc500ph.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1903
Entropy (8bit):	4.3828888993220625
Encrypted:	false
SSDEEP:
MD5:	48CF4EDA3EC438CD4D8EE96015BAA318
SHA1:	969D5ED1CDDEE81D23AFD9991736C57BEB51FDED
SHA-256:	4D7B8032C41CA4A06F93FA233FD2FDF3246DD97501AD49B729246BABF8A55032
SHA-512:	56F51AD877215DA05097E2DFE2F13CE9CA4C34EC29BFBD2A7373DDED3FDD8C4C01AACAB7392AA9D12D8C16120A0008AFFAF5189C80F207A3CE8811A775FB3217
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 500, 720x720DpI, not Weaved, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{. 0.0000 0.0003 0.0027 0.0056 0.0085 0.0120 0.0156 0.0196. 0.0227 0.0260 0.0292 0.0323 0.0354 0.0386 0.0416 0.0450. 0.0503 0.0564 0.0630 0.0711 0.0799 0.0905 0.1038 0.1169. 0.1321 0.1522 0.1761 0.2011 0.2285 0.2678 0.3102 0.3637.}".-dupCyanTransfer="{. 0.0000 0.0008 0.0055 0.0106 0.0152 0.0201 0.0248 0.0298. 0.0344 0.0393 0.0443 0.0490 0.0536 0.0585 0.0630 0.0683. 0.0738 0.0803 0.0870 0.0955 0.1042 0.1149 0.1283 0.1408. 0.1552 0.1744 0.1970 0.2197 0.2441 0.2797 0.3169 0.3637.}".-dupMagentaTransfer="{. 0.0000 0.0008 0.0055 0.0106 0.0152 0.0201 0.0248 0.0298. 0.0344 0.0393 0.0443 0.0490 0.0536 0.058

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc600ih.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	4.8298681534837415
Encrypted:	false
SSDEEP:
MD5:	9574D665E541B93D406B0DD67EB5AF16
SHA1:	2FB8D287E88A528E9932FE7613E58FD7614D98D4
SHA-256:	6B91EF9E999C01A0E2448A7FFA9D878F281F23C7681062C71E7435ADC4F977BC
SHA-512:	ADDC33B4EC9C6D2B85B61811A00952864C0C769E5F8B2290C08AB98CAADEA84E65DDF31D560E83C5651CB2BD4C69B32D3D932B25B7DFC5469E71DF031E8821B4
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 600, 1440x720DpI, Inkjet Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2XY.-r1440x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ . 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000000.}".-dupCyanTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000000.}".-dupMagentaTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc600p.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1151
Entropy (8bit):	5.16901176249905
Encrypted:	false
SSDEEP:
MD5:	558DF40CE790F56ABCF53D861398FD31
SHA1:	439FACED252D5B1D53F512E151FE5D20F1B65F47
SHA-256:	3169F3EE3785E2300B3C68EAE6E4A95E48C686D5B3D098A019A13B1AC039FA1D
SHA-512:	B4C67468EA059BA5DBA231E1176B2D30D5A243B7A9006DE6C6D93B50D0D7FF78EF564595613291B5336BE5941403645DDADAC01ECE37D41362952AC4ECB78DFC
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 600, 720x720DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ 0.0000 0.0329 0.0706 0.1160 0.2392 0.7955 }".-dupCyanTransfer="{ 0.0000 0.0602 0.1133 0.1961 0.2945 0.3885 }".-dupMagentaTransfer="{ 0.0000 0.0452 0.0836 0.1215 0.1493 0.1749 }".-dupYellowTransfer="{ 0.0000 0.0350 0.0914 0.1567 0.2430 0.2934 }".-dupOutputComponentOrder="{ 1 2 3 0 }".-dupWeaveYPasses=8.-dupOutputPins=32.-dupWeaveYFeeds="{31 31 31 31 37 33 33 29}".-dupWeaveInitialYFeeds="{1 1 1 1 1 1 1 25}".-dupWeaveInitialPins="{ 4 24 28 32 19 15 11 7}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 05. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjus

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc600pl.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	5.21105933788501
Encrypted:	false
SSDEEP:
MD5:	40CBC7F551FE61FCFAC7615A73C3BCAC
SHA1:	038CD849CD4D53692E97ABD7D0152465046621FF
SHA-256:	6148B5FA462C886F82C4C520C95C9F4B68802D5660E49C4806450027BE62A20C
SHA-512:	6A2A5367AE01B2CC7EB7F382CD2BDA91A13B3E07276D208C5BD3343156566EDEF8E2BA4806D3A049EF69087A268DBE56737D20D16FB62E2149D5E2793AE85354
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 600, 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ 0.0000 0.0553 0.1158 0.1998 0.4321 1.0000 }".-dupCyanTransfer="{ 0.0000 0.1188 0.2272 0.3745 0.5396 0.6145 }".-dupMagentaTransfer="{ 0.0000 0.0851 0.1512 0.2111 0.2606 0.2818 }".-dupYellowTransfer="{ 0.0000 0.0679 0.1742 0.3129 0.4587 0.5389 }".-dupOutputComponentOrder="{ 1 2 3 0 }".-dupWeaveYPasses=4.-dupOutputPins=32.-dupWeaveYFeeds="{33 30 35 30}".-dupWeaveInitialYFeeds="{1 1 1 29}".-dupWeaveInitialPins="{ 8 16 32 23}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 0A. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMa

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc640p.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	5.187444977990113
Encrypted:	false
SSDEEP:
MD5:	2F7F06D14F94016C8F752AE500AB81A3
SHA1:	BBAFA7059F40AFA584523BD8EA265281863734BA
SHA-256:	8BA67E9F7BE498834512BC64C04469492973FD3272914D01262A8ABB0CE9D47C
SHA-512:	E2C2444204C0652B99F4F278645C48C6AFBD773FBBC78DDBA59BBF2312F55D51879AD60690A5F7E9D663C2310CC4417FEDFD6A6F22AAB26114D2671FBB9EC97A
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 640, 720x720DpI, Inkjet Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ 0.0 0.04 0.08 0.16 0.20 0.35}".-dupCyanTransfer="{ 0.0 0.06 0.12 0.18 0.24 0.45}".-dupMagentaTransfer="{ 0.0 0.05 0.10 0.15 0.20 0.42}".-dupYellowTransfer="{ 0.0 0.04 0.08 0.16 0.20 0.37}".-dupOutputComponentOrder="{ 1 2 3 0 }".-dupWeaveYPasses=8.-dupOutputPins=32.-dupWeaveYFeeds="{31 31 31 31 37 33 33 29}".-dupWeaveInitialYFeeds="{1 1 1 1 1 1 1 25}".-dupWeaveInitialPins="{ 4 24 28 32 19 15 11 7}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 05. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMarginCommand.-dupEnd

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc800ih.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2158
Entropy (8bit):	4.905194510511353
Encrypted:	false
SSDEEP:
MD5:	C171334BD16559AA6AFF8694CF7C1C5B
SHA1:	9CF68843C316C5FC7521708FCAED909016416303
SHA-256:	CC472D6BFEB66B0F6CDE0A423E7E8AE0DE0F61105C348B813769EF98EF58426D
SHA-512:	8216887056CA636257F0CA3B4988D0BB74073D33F5E06B2B02FC689E693A1C3C9939821C9029F3CA5118E73060D40B886DCBD68E1776DCF1F7BF59F8C72B5716
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 800, 1440x720DpI, Inkjet Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2XY.-r1440x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ . 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000000.}".-dupCyanTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000000.}".-dupMagentaTransfer="{. 0.00000000 0.00627451 0.01254902 0.02196078 0.02980392 0.03764706 0.04549020. 0.05490196 0.06431373 0.07215686 0.08156863 0.09098039 0.10196078 0.11450980. 0.12862745 0.14588235 0.16313725 0.18509804 0.20862745 0.25411765 0.40000

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc800p.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	5.213745743837414
Encrypted:	false
SSDEEP:
MD5:	ABB8D346E3DB0758F55C59705AFF36E8
SHA1:	DF54246AC44DD9C1BEB7FE533F73514A050BD1EC
SHA-256:	DD8F952868DB0697CD010CE75E83D4B32AFF69733C896A7F71B0234974A4109A
SHA-512:	60BC00104E0626631713017A12EAA79713D1014C074518AAB0A1890B6CDFBF8D00E239D92E507883BE12845B842B871C581DFD8D7A3FC97D97D5FD9D9CC86415
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 800, 720x720DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ 0.0000 0.0329 0.0706 0.1160 0.2392 0.7955 }".-dupCyanTransfer="{ 0.0000 0.0602 0.1133 0.1961 0.2945 0.3885 }".-dupMagentaTransfer="{ 0.0000 0.0452 0.0836 0.1215 0.1493 0.1749 }".-dupYellowTransfer="{ 0.0000 0.0350 0.0914 0.1567 0.2430 0.2934 }".-dupOutputComponentOrder="{ 1 2 3 0 }".-dupWeaveYPasses=4.-dupOutputPins=64.-dupWeaveYFeeds="{63 63 67 63}".-dupWeaveInitialYFeeds="{1 1 1 61}".-dupWeaveInitialPins="{ 16 64 47 31}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 05. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMa

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc800pl.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	5.236103602970793
Encrypted:	false
SSDEEP:
MD5:	CB23638C899636EA29CDA3BC0E6F50AC
SHA1:	142CA9830A1DCC9E249DE6D9D66983F333317142
SHA-256:	C1940CD5C900F597842A1118DC9643865FCD06CAA63F7ED87CCA9B2794F4381F
SHA-512:	0E4A4DFEF9CACB0E58A4A4BD6B213B5D970837B3B47EDFC4C54F57F7FEF0615D71E19763945816875558B282655262FDD96BE21A01F3E2A0ADB0A0DA23BF84B9
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color 800, 360x360DpI, Plain Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupBlackTransfer="{ 0.0000 0.0553 0.1158 0.1998 0.4321 1.0000 }".-dupCyanTransfer="{ 0.0000 0.1188 0.2272 0.3745 0.5396 0.6145 }".-dupMagentaTransfer="{ 0.0000 0.0851 0.1512 0.2111 0.2606 0.2818 }".-dupYellowTransfer="{ 0.0000 0.0679 0.1742 0.3129 0.4587 0.5389 }".-dupOutputComponentOrder="{ 1 2 3 0 }".-dupWeaveYPasses=2.-dupOutputPins=64.-dupWeaveYFeeds="{63 65}".-dupWeaveInitialYFeeds="{1 65}".-dupWeaveInitialPins="{ 33 64}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2855 0100 0A. 1b5501. 1b2865 0200 0002. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMarginCommand.-dupEn

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc_h.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1913
Entropy (8bit):	4.728526092284791
Encrypted:	false
SSDEEP:
MD5:	FB1DE5C60E3D531663156C4C20DD5235
SHA1:	69D8758A8EF12620934DFE2F16469775241F3388
SHA-256:	4E4F78576D00346A5CB6961DAA5E99570CC91C06975DC9414D41144E2CFA3E32
SHA-512:	852B12A0C177F314D4956C2AA0378035947E09C890C07E4FDECFD3BC387F946719F2A1A2DDB355E0240F07F5D639112C9DBE7BCD5084CA33DC810CF375569ACF
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color I (and PRO Series), 720x720DpI, Special Paper".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupWeaveYPasses=8.-dupOutputPins=15.-dupWeaveYFeeds="{15 15 15 15 15 15 15 15}".-dupWeaveInitialYFeeds="{1 1 1 1 1 1 1 8}".-dupWeaveInitialPins="{ 15 13 11 9 7 5 3 1}".-dupBlackTransfer="{. 0.0000 0.0011 0.0079 0.0151 0.0217 0.0287 0.0354 0.0425. 0.0492 0.0562 0.0633 0.0700 0.0766 0.0835 0.0900 0.0975. 0.1054 0.1147 0.1243 0.1364 0.1489 0.1641 0.1833 0.2012. 0.2217 0.2492 0.2814 0.3139 0.3487 0.3996 0.4527 0.5195.}".-dupCyanTransfer="{. 0.0000 0.0011 0.0079 0.0151 0.0217 0.0287 0.0354 0.0425. 0.0492 0.0562 0.0633 0.0700 0.0766 0.0835 0.0900 0.0975. 0.1054 0.1147 0.1243 0.1364 0.1489 0.1641 0.1833 0.2012. 0.2217 0.2492 0.2814 0.3139 0.3487 0.3996 0.4527 0.5195.}".-dupMagentaTransfer="{. 0.0000 0.0011 0.0079 0

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stc_l.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	734
Entropy (8bit):	5.238198007197284
Encrypted:	false
SSDEEP:
MD5:	A291C454D9D0BBC3C96D6411B756D808
SHA1:	0258A34DB3E55D4DA8475FBFA6C955F3C7A25111
SHA-256:	E91B3D96CFE1A1DA5021E0564E761575AEA4963B087A240D158A6E1C78423EB8
SHA-512:	9B3600E90D478E94C9B0024A74687826FB0E23F3725195192D71BE9AA2FDE248D81D67F052679E3150F5DFE2221361B29404D99D5B7C5D133B9ADEB5C627F5EE
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Epson Stylus Color I (and PRO Series), 360x360DpI, noWeave".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupComponentBits="{1 1 1 1}".-dupWeaveYPasses=4.-dupOutputPins=15.-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2869 0100 00. 1b2855 0100 0A. 1b5500. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMarginCommand.-dupEndPageCommand="(\033@\014)".-dupAbortCommand="(\033@\15\12\12\12\12 Printout-Aborted\15\014)".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stcany.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	673
Entropy (8bit):	5.190624222742467
Encrypted:	false
SSDEEP:
MD5:	3C16D262280385F30F9C4502D2506F43
SHA1:	5D6BE95C085646D81A8D9B2C944E645900B6ABA1
SHA-256:	DEE624E837AD678DECEEFA2820DC5358A6725CE9B40D549DA599529D184A809E
SHA-512:	ED9804AF469996CE106211B8442C2BA78857A3FE8E1720C662CF7D54CF401380EE315E52F88175838507F43520F7D0BADA1B75E2EA415F1F5CC3DDFFB4E0785E
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Any Epson Stylus Color, 360x360DpI".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYK.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r360x360.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupComponentBits="{1 1 1 1}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2869 0100 01. 1b2855 0100 0A. 1b5500. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMarginCommand.-dupEndPageCommand="(\033@\014)".-dupAbortCommand="(\033@\15\12\12\12\12 Printout-Aborted\15\014)".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stcany_h.upp

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	681
Entropy (8bit):	5.194777248577838
Encrypted:	false
SSDEEP:
MD5:	58DD939F9FA7EFB21C18373385FBB524
SHA1:	149E6C3079928224032DF57EBCCD534B1B28E4E8
SHA-256:	27F353A5BD71C3D1FA7C983782A13C47462B7837EFDE44B83E02A93DF3210ECE
SHA-512:	01253AD5363ED21DC39EBE920EB4E0574FB0C1AE135C5388C5A33ADFE0AC6BFB6A6D07DCE5133A7D831C5A1B0C1E746A2314E5A7A606829253B24131D59EC7C8
Malicious:	false
Reputation:	unknown
Preview:	-supModel="Any Epson Stylus Color, 720x720DpI".-sDEVICE=uniprint.-dNOPAUSE.-P- -dSAFER.-dupColorModel=/DeviceCMYKgenerate.-dupRendering=/ErrorDiffusion.-dupOutputFormat=/EscP2.-r720x720.-dupMargins="{ 9.0 39.96 9.0 9.0}".-dupComponentBits="{1 1 1 1}".-dupBeginPageCommand="<. 00 00 00 . 1b01 40 45 4a 4c 20 31 32 38 34 2e 34 0a . 40 45 4a 4c 20 20 20 20 20 0a . 1b40 1b40. 1b2847 0100 01. 1b2869 0100 01. 1b2855 0100 05. 1b5500. 1b2843 0200 0000. 1b2863 0400 0000 0000.>".-dupAdjustPageLengthCommand.-dupAdjustTopMarginCommand.-dupAdjustBottomMarginCommand.-dupEndPageCommand="(\033@\014)".-dupAbortCommand="(\033@\15\12\12\12\12 Printout-Aborted\15\014)".

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stcinfo.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	25525
Entropy (8bit):	4.551698167158333
Encrypted:	false
SSDEEP:
MD5:	DB154EB6EB344BCC37B41D653326FAA3
SHA1:	7249F0E2B21382976CAFADEBCAEED0075520809B
SHA-256:	5FC0B5303CC06C75697D3E25DE043C19D2566C22D5230EC8585F9354B27EC15D
SHA-512:	A6C86ABDB6376AFE8EDBAC59121B40C13E5D474D3D5D3CB418431613B20F5BCA62DFFAE6AD6825D04B7B34E534A16015FBFE337C75132676F37AA01896FC9CDA
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% stcinfo.ps.% Epson Stylus-Color Printer-Driver..% The purpose of this file is to print & show Parameters of the.% stcolor-driver. If not run on ghostscript/stcolor, it prints.% something like a color-chart...% use either existing STCinfo-dictionary, retrieve new one or create dummy..statusdict begin product end.dup (Ghostscript) eq 1 index (Artifex Ghostscript) eq or.exch (AFPL Ghostscript) eq or{.. currentdevice ge

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stcolor.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5073
Entropy (8bit):	4.773823346310021
Encrypted:	false
SSDEEP:
MD5:	08728B1BB00F3A5F07AD03E5C4C52C3C
SHA1:	641AE7FD9BCFD5E7B01B93E5CE73B8C5AE76FB7D
SHA-256:	9F5650CA1C386BA4F416E6602B7EBACEFFF23DEC0625E7D1AF7C470E362A79AC
SHA-512:	9F5EE1CA968DCD85F9B38CA3A7B3163EE0DE574F802A1CBF0F4811FAC6B6EAEF652B4F21B7C001F38E0394C55060008F465E8270F3BC5E08ADF5012BFD889C63
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% stcolor.ps.% Epson Stylus-Color Printer-Driver..% The purpose of this file is to configure the stcolor-printer driver..%.% It is useless and dangerous to interpret the following code with anything.% else than Ghostscript, so this condition is verified first. If this fails.% a message is send to the output. If this message bothers you, remove it,.% but I prefer to know why the device-setup failed...statusdict begin pr

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\stocht.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	4.7794953290124225
Encrypted:	false
SSDEEP:
MD5:	6C567ADE08FBD501B99078A180AC183F
SHA1:	26CDC3FB872B04124207758B8D71D71C34E49C6F
SHA-256:	874C471E41B2B7B32B5C02716B8153F166DFA86CCD0E2D70133214E7200C50F1
SHA-512:	A3DD4C791F73BC13DB39DA410BD81849EF7F82A689B5A8A0393FF386BF760D34EF90A4CD72E655A79A4B505E84F3DB7C21F180D2F74DE154D41115C53927B5AB
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% helper file to simplify use of Stochastic Halftone - uses ht_ccsto.ps..% This file sets the /StochasticDefault /Halftone as the current.% and the /Default halftoning, loading the Stochastic halftone.% if required...% Stochastic halftoning is recommended for inkjet printers, and may.% produce output as pleasing as the more computationally expensive.% "error diffusion" that some device drivers provide...% For printin

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\traceimg.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1390
Entropy (8bit):	4.816439610579005
Encrypted:	false
SSDEEP:
MD5:	6D486006313AC159903F9524AB1A2A75
SHA1:	26C187337CE962FBC60E20B7DE2123A6CBE01524
SHA-256:	A14E913EF05C5BAF23C7583DB78C73AB7183B51609327B2FBC5AAF63A2D5C6B6
SHA-512:	5AF14147DD97D76F4CCCD7E98E6832191F28C94B1AB9C301FC7646CAF20D9DEF5643763DAA21C14099032B23ABFCD7F2B34EFC5B5DB4F96E6D64F25F024DDF57
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% traceimg.ps.% Trace the data supplied to the 'image' operator...% This code currently handles only the (Level 2) dictionary form of image,.% with a single data source and 8-bit pixels.../traceimage...% <dict> traceimage -. { currentcolorspace == (setcolorspace\n) print. (<<) print. dup { (\t) print exch ==only ( ) print == } forall. (>>\n) print flush. begin /i_left Width Height mul store /i_dict currentdict

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\traceop.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2586
Entropy (8bit):	4.697033548613344
Encrypted:	false
SSDEEP:
MD5:	1772D4541ABE3DC6D10478156FCB7E31
SHA1:	E3515C7DD820E3957780E93F5C2526733624F7FB
SHA-256:	2C71111C6A17AF209C27AA7D598EF76A23B599EC14403C4066B5FCC92D086A8D
SHA-512:	CE7F9DB88E56EE42A9F1780661E2DB99FC93D1567BB0CB050E5A2B9990190CD90CE3B34AA004F2F58BEDE5FF505B568C6F45E2F56318DFC9382B430FBA50A4FC
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Trace individual operators or procedures..% <opref> is <opname> or <opname> <dict>.% (dict defaults to dict where op is currently defined, if writable;.% otherwise uses userdict).% <opref> traceop prints vmem usage before;.% <opref> <numargs\|preproc> prints arguments or runs proc before;.% <opref> <numargs\|preproc> <numresults\|postproc>.% also prints results or runs proc after..% If traceflush is true, flush

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\type1enc.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2406
Entropy (8bit):	4.903551690189293
Encrypted:	false
SSDEEP:
MD5:	17A9735C3129858AE0674CA77A4CA8BA
SHA1:	C4599FEEEF9D7A7E9E6A926F98469B6A412F8301
SHA-256:	5587216B4B84D236991C2EC9ABCAD92B9DABC1974DD5804A8FA47374C1EB0E0C
SHA-512:	012A595161D983898FD3E531E401599D8FC0217A12C22335DC932AFC9E0270DF52D72EF1A048C41DCF6EAC2F49723C03FAFBBEB6BF6F2EE19C69F5148BC255EC
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% type1enc.ps.% PostScript language versions of the Type 1 encryption/decryption algorithms...% This file is normally not needed with Ghostscript, since Ghostscript.% implements these algorithms in C. For the specifications, see Chapter 7 of.% "Adobe Type 1 Font Format," ISBN 0-201-57044-0, published by Addison-Wesley.../.type1crypt.% <R> <from> <to> <proc> .type1crypt <R'> <to>. % (auxiliary procedure)

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\type1ops.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	4.837813886449519
Encrypted:	false
SSDEEP:
MD5:	EA98F63550E9D8871665F47E01363E7F
SHA1:	DDFF6DCEC940444C02EA5F99E0035BAC02C9269E
SHA-256:	F93223C26CB1F0211C2517D3E5439B8EB3B4BAB7AA46867F8B8E8160310E503F
SHA-512:	F393416A6BC7768DE45819871832D0A1115F773093D5DBC5C4E77F9D7D0A25DF8EE5A9217334D952C6555A22ADFF9E5A5DC3D3F2A75D312997346D0ED3FE731F
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% type1ops.ps.% Define the Type 1 and Type 2 font opcodes for use by Ghostscript utilities...% Define the default value of lenIV..% Note that this expects the current font to be on the dictionary stack.../lenIV { FontType 2 eq { -1 } { 4 } ifelse } def..% ---------------- Encoding ---------------- %../Type1encode 70 dict.. % Data types..dup /nulltype {. pop ().} put.dup /nametype {. Type1encode exch get.} put.

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\uninfo.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	5994
Entropy (8bit):	4.24559860995686
Encrypted:	false
SSDEEP:
MD5:	EA635826E181D9CA90D2254898401817
SHA1:	523404BA2DE9524D2052D3621BCEE052A45DC24A
SHA-256:	51F7511438923C4FAF08AAD7A2F8CDAE008C2EC9C4F2D0048DCD9BEAEC7433F9
SHA-512:	EE2234E41B1C3D38DDF44053946745EA9236C4B77D7108D90988B96A7206F1D88A99F1E6A11C144880B12F6226968F622334CBB51C08C1F025151B1AEDE976D9
Malicious:	false
Reputation:	unknown
Preview:	%!.% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% uninfo.ps: Utilities for "printing" PostScript items, especially dictionaries.% Usage:.% (prefix-string) dict unprint..% Maximum Print-Width./HSpwidth 80 def..% any HScvs string./HScvs {.% Number-Syntax. dup type % stack: any /anytype. dup /integertype eq 1 index /realtype eq or { pop. 16 string cvs. }{.% Logical-Type. dup /booleantype eq { pop. 5 string cvs. }{.% Identifiers. dup /nametype

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\unix-lpr.sh

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	4165
Entropy (8bit):	5.115327559945199
Encrypted:	false
SSDEEP:
MD5:	FB19ADC8AE5C928D0322788B84B02167
SHA1:	FBC3ED197A0FB76178130C8BB5B5D2746593DD09
SHA-256:	1A280C011C113D1741AED0B5E14B8A14C5EF6C38E599DC0248A452367C99EF93
SHA-512:	F93EA6A61053F743679F89A10DDEB53F7E13DDA7B1E2F0106569E58AEBBD0FFCE2A83103A24D0F9C2012E2B2875590B04BF6932B7983CCEB1415BE4DBB228FC9
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh.#.# Unix lpr filter. The default setup sends output directly to a pipe,.# which requires the Ghostscript process to fork, and thus may cause .# small systems to run out of memory/swap space. An alternative strategy,.# based on a suggestion by Andy Fyfe (andy@cs.caltech.edu), uses a named.# pipe for output, which avoids the fork and can thus save a lot of memory..#.# Unfortunately this approach can cause problems when a print job is aborted, .# as the abort can cause one of the processes to die, leaving the process .# at the other end of the pipe hanging forever..#.# Because of this, the named pipe method has not been made the default,.# but it may be restored by commenting out the lines referring to.# 'gsoutput' and uncommenting the lines referring to 'gspipe'..#..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs..PBMPLUSPATH=/usr/local/bin.PSFILTERPATH=/usr/local/lib/ghostscript.LOCALPATH=/usr/local/bin.X11HOME=/usr/X

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\unprot.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	4.729570137057908
Encrypted:	false
SSDEEP:
MD5:	A7D97750D71FDB03CB004821BC237F47
SHA1:	40A62F9B5A08B030CC4452FB32676B0DC8A4354E
SHA-256:	341454FA6ABC03F96AE2CFCE2D1F946A42F74A5974A4125F4FCEB681ECDF924E
SHA-512:	6CA3B060DD1512F46A71D8BDA00CBDDB636D1E37361A61F7B7880DCF7B12D6B30E5BFD914FD257BE1ACCB6C9361712E8DDBFBEEF388930F5F3415CBFB3BD9850
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Disable all access checks. This is useful for printing out.% eexec-encrypted Type 1 fonts, and similar purposes...systemdict wcheck. { /protdict systemdict def. }. { (Please restart Ghostscript with the -dWRITESYSTEMDICT switch.\n) print. (Some access checks will remain active if you do not do this.\n) print. flush. /protdict userdict def. }.ifelse..% The procedures we're about to define will go in systemdict,

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewcmyk.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1991
Entropy (8bit):	4.859422057851018
Encrypted:	false
SSDEEP:
MD5:	8C176C67550C798B0F74CD051AEBADC0
SHA1:	E962C3D9B5CD2951A683715954A30ACC469EA9B0
SHA-256:	216A608CAD2C09DA0E57EE9CC2985EACB106C88B32E21EB1C68A3F294C2DE3D1
SHA-512:	DDB5E812D4FFED6E7CBC5EE25D544022A14048A0450F3B8AE000C8C467FFC050E2B42D268A4892CA5272A670AAD348DE5238252F02FA9909AADC7671DFAEC9CC
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% viewcmyk.ps.% Display a raw CMYK file..% Requires the colorimage operator..% If SCALE is defined, maps input pixels to output pixels with that scale;.% if SCALE is undefined, scales the image to fit the page..% If BITS is defined, it is the number of bits per sample (1,2,4,8,12);.% if BITS is undefined, its default value is 1.../viewcmyk {...% <filename> <width> viewcmyk -. 20 dict begin. /w exch def. /fname exch

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewgif.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.614574479648201
Encrypted:	false
SSDEEP:
MD5:	89282C992C8F96B9660184366EDDD075
SHA1:	AD7F4D85A7D1A92311D9ABE136BD5E1BB8AB25D4
SHA-256:	21B1EC356F4821244FF3DDDB45E045B38656C38E48E9D6BC39E61BD793A60F99
SHA-512:	D1D30AEABB071E08B40A50B9E1BCF96FB81573B3A52F4013EADD01A2C12620DBCBF2C7519DFCBF7B15767EE88F4965E00BC8C80538FFD2CA2DF739A0B119CAAA
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% viewgif.ps.% Display a GIF file.../read1...% <file> read1 <int>. { read pop. } bind def./read2...% <file> read2 <int>. { dup read1 exch read1 8 bitshift add. } bind def../readGIFheader..% <file> readGIFheader <dict>. { 20 dict begin. dup 6 string readstring pop. dup (GIF87a) eq exch (GIF89a) eq or not. { (Not a GIF file.\n) print cleartomark stop. } if. dup read2 /Width exch def. dup read2 /Height exch

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewjpeg.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	5135
Entropy (8bit):	4.797423625756058
Encrypted:	false
SSDEEP:
MD5:	0F8FE4B6E941C9C9972E04D2A72E7704
SHA1:	0338F491F15CF22D8FAADCDEAD14B515F82E5F86
SHA-256:	173A7699B6893C9618746C016C0BF544860F0C63B00516783551AF1E79F39361
SHA-512:	605B49D12B8AFABCCE0E4FBA3718BBB2EB49D4215FB6D45351665C9AD35A717C182316AC96C37447280B0753EBB73B932650EC45BFD7B2E68F6ABA26DFB0BE19
Malicious:	false
Reputation:	unknown
Preview:	%! viewjpeg.ps Copyright (C) 1994 Thomas Merz <tm@pdflib.com>.%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% For more information about licensing, please refer to.% http://www.ghostscript.com/licensing/. For information on.% commercial licensing, go to http://www.artifex.com/licensing/ or.% contact Artifex Software, Inc., 101 Lucas Valley Road #110,.% San Rafael, CA 94903, U.S.A., +1(415)492-9861...% View JPEG files with Ghostscript.%.% This PostScript code relies on level 2 features..%.% Only JPEG baseline, extended sequential, and progressive files.% are supported. Note that Adobe PostScript level 2 does not include.% progressive-JPEG support. Ghostscript with IJG JPEG v6 or later.% will decode progressive JPEG, but only if you edi

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewmiff.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3906
Entropy (8bit):	4.58031921945182
Encrypted:	false
SSDEEP:
MD5:	49D16CBB59B1A913E86288C1D7E63CF1
SHA1:	DF4D8B6CE86378E3848AB4B306C3E7EFF9E4BD01
SHA-256:	371D86847B631880BA6323125DB3B8A80A07316E748028396812D26C5FC17286
SHA-512:	A456E00CB2250D0BDEEECEDD933A0B215801FD151F910FB88D5C9397D7501BBDF6EB08FE21FC06D8B91A62F7E676667C2CFFDBDBEF4C9077B7AA132965D862F3
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% viewmiff.ps.% Display a MIFF file. You would think the 'display' command would do this,.% but many versions of 'display' either core-dump or require unacceptably.% large amounts of memory...% Recognize MIFF keywords../miffwords mark. /class { cvn /class exch def }. /colors { cvi /colors exch def }. /columns { cvi /Width exch def }. /compression { cvn /compression exch def }. /depth { cvi /depth exch def }. /pa

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewpbm.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5257
Entropy (8bit):	4.710630347927043
Encrypted:	false
SSDEEP:
MD5:	E98EF5795F0FCB11E9DED9CA1A0A2438
SHA1:	BCD78AD5EDE56A03AFA4F1EC24584D4EA7AECD93
SHA-256:	D0C968DA71E68413BF2E5083299CECA9338FE5A269015BC5B7E18C4EF96FF850
SHA-512:	755B774BF1D3B50907680BBFAB8CFF9F5D1B1B09900C1D559B6387F95781065481BAABBF140FED5FD2620CED6BCDC0717A006D90A40CC61CDDEA0B347FE1DF34
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% viewpbm.ps.% Display a PBM/PGM/PPM file..% Requires the Level 2 `image' operator (to handle variable pixel widths)..% If SCALE is defined, maps input pixels to output pixels with that scale;.% if SCALE is undefined, scales the image to fit the page.../s 100 string def./readmaxv {..% <file> readmaxv -. 10 string readline pop cvx exec /maxv exch def.} bind def./readrow {..% <file> <row> readrow <row>. 0 1 2 index len

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewpcx.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4398
Entropy (8bit):	4.543649149249078
Encrypted:	false
SSDEEP:
MD5:	8FA10F6D491D698E854F9D660D1DA7A4
SHA1:	5F5A9BB6DABB3FB690E9F444E5025D74E9ACA032
SHA-256:	E5D4532BA0FB671DCE8BBC24E128DED2A947A2D0B2854C3BAFC67E79498FAFB9
SHA-512:	55BBB0A9BC26A63B9AD365EE86497B342305B4D22A7AD51EDC29A0A3CEBDC127A31480FBC8520D75CB90EC7A1274C0C1569CA28F8C722A2A68D319E077776207
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% viewpcx.ps.% Display a PCX file..% Requires the Level 2 `image' operator (to handle variable pixel widths)..% If SCALE is defined, maps input pixels to output pixels with that scale;.% if SCALE is undefined, scales the image to fit the page..% ****NOTE: does not handle multi-plane images with palette.../pcxbytes [. 0 1 255 {. 64 string exch 0 1 63 {. 3 copy exch put pop. } for pop. } for.] readonly def./

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewps2a.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	4.796702075283819
Encrypted:	false
SSDEEP:
MD5:	52749FD7B1E04318D03C671486167A71
SHA1:	D3C94619BD2487D16A447DF793AEAEEC3EA2560B
SHA-256:	E8120EF93CE08E0AD1485FBB03D4AE56C905555C149E9C4690A537EA1341DE19
SHA-512:	0A8BBB2BEAE413B9E3F1963864C0A95AF05601EA470A6132AD65F836439E5BDE7509B09F9B81E465E9F2C07395CD63634EFE7C4548148816CAA6F13B98653CE8
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%..% Display a file produced by ps2ascii with no switch or with -dCOMPLEX..% This is just a procset to read in before the file to display.../init { 0.1 0.1 scale } bind def.init./next { currentfile token pop } bind def./F { next next pop next exch selectfont } bind def./P { showpage init } bind def./S. { next next moveto. next dup stringwidth pop next exch div. gsave 1 scale show grestore. } bind def./C { next next ne

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\viewrgb.ps

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	3.9641052852498078
Encrypted:	false
SSDEEP:
MD5:	C84C42205E94F796F8562FA0E1B81A3C
SHA1:	442E979C3AD986608057F88F46D9D689754CF31E
SHA-256:	449CC300B3ED360C110C6998DA8FE1FFB718F59A433B2F3899D9392609DACA38
SHA-512:	245B061DCBEB2E48B46B63455CAD68BE5F8BAE1DA48CF6E1A596E092D191C07515D296FB28BB6B7A273CB23DF1874D568B3DB4F16B30EA7E970D760E5FB9F826
Malicious:	false
Reputation:	unknown
Preview:	% Copyright (C) 2001-2012 Artifex Software, Inc..% All Rights Reserved..%.% This software is provided AS-IS with no warranty, either express or.% implied..%.% This software is distributed under license and may not be copied,.% modified or distributed except as expressly authorized under the terms.% of the license contained in the file LICENSE in this distribution..%.% Refer to licensing information at http://www.artifex.com or contact.% Artifex Software, Inc., 7 Mt. Lassen Drive - Suite A-134, San Rafael,.% CA 94903, U.S.A., +1(415)492-9861, for further information..%...% viewrgb.ps.% Display a raw RGB file created by -sDEVICE=bitrgb..% If SCALE is defined, maps input pixels to output pixels with that scale;.% if SCALE is undefined, scales the image to fit the page..% If BITS is defined, it is the number of bits per sample (1,2,8,12)..% NB: BITS=4 (corresponding to -dGrayValues=16) is not supported..% if BITS is undefined, its default value is 1.../viewrgb {...% <filename> <width> v

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa

Download File

Process:	C:\Users\user\AppData\Local\Temp\converter.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237684779483571
Encrypted:	false
SSDEEP:
MD5:	4C767DA5D4CDD625EBDF1A464E3B96EF
SHA1:	26DA3CCF278B113B3480A98143F0D5A8078A57BF
SHA-256:	979C4D2BA85F1FB915623ACEC63E1EE1EB6CB299FF240BBC906404615EE3D02A
SHA-512:	3C79EAC0C6B99644EC2512341A64BF60A6D009EB98381C07D2042773FEF90C4B25239DD3D96C4CB3564D833F051D8447DDD455F8E667885280C9F289226B8910
Malicious:	false
Reputation:	unknown
Preview:	#!/bin/sh..# This definition is changed on install to match the.# executable name set in the makefile.GS_EXECUTABLE=gs.gs="`dirname \"$0\"`/$GS_EXECUTABLE".if test ! -x "$gs"; then..gs="$GS_EXECUTABLE".fi.GS_EXECUTABLE="$gs"..exec "$GS_EXECUTABLE" -q -P- -dNODISPLAY -- wftopfa.ps "$@".

C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224144.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	240
Entropy (8bit):	4.956617782377167
Encrypted:	false
SSDEEP:
MD5:	2F03B610BE7A64BB580FC89F4327BEAD
SHA1:	453BF01D915212E44A5834D02330B495B0FDCCED
SHA-256:	38050CBA4DD5E479B6722305430E9D2CA40CCDC01BA405EDEBC73A3A2638C6E0
SHA-512:	CA6F919C780429E62B349B308088FF8CA6CE71218BD282DC520C7B1158945464E035761B966CEEA4BC60B656F20A2D08D34722D6A660F1DD60E7615E51695A58
Malicious:	false
Reputation:	unknown
Preview:	[0417/224144.469:INFO:assistant_installer_main.cc(177)] Running assistant installer with command line "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --version.

C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224227.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
File Type:	ASCII text, with very long lines (327)
Category:	modified
Size (bytes):	478
Entropy (8bit):	5.141893628766527
Encrypted:	false
SSDEEP:
MD5:	A4C84A8FAE4D6380A69C9826F45E46B3
SHA1:	A3742761CEC8A1EC1347B0A296CFC7366407B8BA
SHA-256:	B50778FCC4042B93D5BB53778F1E0D5DBEC03804D6029FE8EC7E778C7D9AAD71
SHA-512:	AA3DE8E03A00AC520217510538BBF793B9A1F73E6AF4444854AA88D9AF3EC2EB80394062FEEB523938C2DA654855D9576B0E5350F07D5C56F897D2DE02151CFD
Malicious:	false
Reputation:	unknown
Preview:	[0417/224227.347:INFO:assistant_installer_main.cc(177)] Running assistant installer with command line "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0.[0417/224227.769:INFO:assistant_installer.cc(322)] Setting up the registry.[0417/224227.956:INFO:assistant_installer.cc(382)] Creating scheduled task.

C:\Users\user\AppData\Local\Temp\assistant_installer_20240417224228.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	352
Entropy (8bit):	4.9556822168317956
Encrypted:	false
SSDEEP:
MD5:	EF655DB3979364428F393BE1839A4B41
SHA1:	3E52C3A44ACA4832C6A1AD2F4E7C44031745071D
SHA-256:	CB223A4689C2ABF73AD8AE20F8DBCA135B0C1549440E41CC6DD16AF10337A0FF
SHA-512:	74EA04296A5063A84DB2F0CCFDB8CE3CEFDE6001067BC152D2E3FB5C930A7CA247E7B74440D6E2267E8C4E6BFC67647FE83509AD94D482D273AAEAB4E0238A09
Malicious:	false
Reputation:	unknown
Preview:	[0417/224228.138:INFO:assistant_installer_main.cc(177)] Running assistant installer with command line "C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0.[0417/224228.138:INFO:assistant_installer.cc(281)] Running Assistant.

C:\Users\user\AppData\Local\Temp\converter.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8108488
Entropy (8bit):	7.99875147360848
Encrypted:	true
SSDEEP:
MD5:	BF9F58A65F6954406E6DCD29BB458A19
SHA1:	9302E9671FD31D6CE714817D354194897AC42BDC
SHA-256:	AD578753BFC7F03FBFDE3DEA1DA4C281153B12EE9369709A616F6B0149A7434C
SHA-512:	6F3CDAAD855157E94E93208D218C2526D339B0D1EB67E89EDD26D94213D12C1808EA2040862F4B17F5C899574AB10E09B6149919766FCA3146B7A92B391A83B0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...F...F...@...F...Z...F..Rich.F..........................PE..L.....[:.................V...*.......?.......p....@...........................{.....~.{......}.......}...............{..2....q..P.....................{..............................................................p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data...5............f..............@....rsrc................t..............@..@_winzip_. {...... {..z..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CPWSave.exe.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	642
Entropy (8bit):	4.905333753716299
Encrypted:	false
SSDEEP:
MD5:	D8385D9758B759942365B1ACC0E414FE
SHA1:	09EA59189959295B260B6165CAE34FED4EB33EEE
SHA-256:	278BCF994BFBD8C625E1FCC67610280200908BA984DC6C99DF5EBAF379754491
SHA-512:	5162CEBC3B4CEFF55818AF845E7174023F4ADB7FFD0B298D142590BA566BD09A25B80C4CF5E8368BEE75D26D8E58F3E4AF5527EBD935A17D5A63EDAB701ACCBB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> .. <assemblyIdentity version="3.0.0.1".. processorArchitecture="X86".. name="CPWSave".. type="win32"/> .. <description>CutePDF Writer Application</description> .. Identify the application security requirements. -->.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel.. level="asInvoker".. uiAccess="false"/>.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CPWriter2.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138576
Entropy (8bit):	5.956624180380583
Encrypted:	false
SSDEEP:
MD5:	CB9A520B70BF242E8B41AD4F70D2BF46
SHA1:	5A3C0BD8C1133F45FA55E269284169549F1503E0
SHA-256:	AE7C73975E6C4DA06DC378D595CC0E71C482705242845FAB0FE3AF34E0DD875E
SHA-512:	3FFE489720AC481BA1E23DB013A45060495CABB3C43EF45F2F02C71CD59E75B457D81856445E96AD9E1F93B69AC0DE72DF13ADD9F8001D43112D9DDE2252052C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./%.tkD.'kD.'kD.'.[.'cD.'.[.'jD.'kD.'hD.'.K.'zD.'kD.'.E.'.X.'qD.']b.'.D.']b.'_D.'.B.'jD.'RichkD.'................PE..L.....].................@...........(.......P....@..........................0....................................................... ..................P-...........................................................P..X............................text....>.......@.................. ..`.rdata...K...P...P...P..............@..@.data....u.......@..................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CuteEdit.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 16x16
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	4.974114265981653
Encrypted:	false
SSDEEP:
MD5:	A68EF3A5FC089796C7275B46A3D5AA68
SHA1:	024380444D5C22BA6257AB46BF382998348F8208
SHA-256:	B24E29CDC992531DB2213E85F200E2E659EB78B0C91BFF9C657269DF7992B907
SHA-512:	8A5578D4EE7DD994040A28635F43E578DD36633E26EEB6AE7398CB2D9ACC6458107005B7103F8F1299443DBB68DFA1623C85E1FEF587CAF0B173C74656C8E864
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&...........h.......(... ...@...............................1)..H........t.........................................................................................k...........................k..s.....R..{s..1..............................1..9..........B...R...c......!...1..............................................J...B...................9........Z..1{..t....c...........B...t..H...9c.......J..1Z.......B..!R..Jk...1...){..1...B..)R..9Z..Bc.......)..1R..9Z..c{.......H...9..!B..Zk..BZ..Jc..JZ.......!...)..cs......Zk.......)..Rc..k{....k...s...k..!..!1....s...{.JZ..Rc..Zc..!1..9B..BJ..Zc..JR..RZ..s{..!){.9B..Zc..ck..ck..!)..!)..)1..JR..RZ............{...s...s...{...s.!!..!!{.))..))..11..99..11..JJ..RR..ZZ..ss......))1.............................ccc.999.111...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\CutePDFWriter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5000016
Entropy (8bit):	6.969265682618029
Encrypted:	false
SSDEEP:
MD5:	493173739B3B0D330A3FEC50F5EE10E0
SHA1:	6243D31FBEAA2270615205943FD5719BE5D1B4D1
SHA-256:	8A6DA523F1E171EEEE2AD1ACA62D70C5ED29459DA8219B5A357CBE112F28C3A7
SHA-512:	22027A27B38D0DE38DDBBB7026439D41AE042C4BBB142EFC164458333B9DAC8E0173D4A6BDF9AF467063A71FD8E5AC3034693D99B163EB963F1980A2BF4D5C82
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........fj...9...9...9...8...9...8...9...8...9...8...9...8...9...8...9...8...9...8...9...9...9...9...9.."9...9.0e9...98..8...98..8...98..9...9...9...98..8...9Rich...9........................PE..L......e..................)..p".......%..........@...........................L.......M...@...................................0.\|.....2.h.............L.P-....I..... @..p....................A.......@..@..............d............................text.....).......)................. ..`.rdata........*.......).............@..@.data...L....01.......1.............@....rsrc...h.....2.......1.............@..@.reloc........I......DI.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\CUTEPDFW.PPD (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	31736
Entropy (8bit):	5.360568407736167
Encrypted:	false
SSDEEP:
MD5:	4C4C993507312E1D744EAF74C878BA1D
SHA1:	5E88BFD6FE9C79389C7206FF8907E7969EAEB1B5
SHA-256:	454216087ACA9C7A3326BB247B84C782281C5E71AE43EE8A977A480B0FA4ED25
SHA-512:	79494149692FB5804FD5A64A0F31DC4C79DCC4E717FB15D23A9A03901FF6E701D2B76431BECF1CF49EB57BE0F9727B4589E05C3A23FF85D6C52D03D5C72F6C56
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 2008 CUTEPDF..% All Rights Reserved. ..% Permission is granted for redistribution of this file as..% long as this copyright notice is intact and the contents..% of the file is not altered in any way from its original form...% End of Copyright statement....FormatVersion: "4.3"..FileVersion: "1.0"..LanguageEncoding: ISOLatin1..LanguageVersion: English..PCFileName: "cutepdfw.ppd"..Manufacturer: "CUTEPDF"..Product: "(CutePDF Writer)"..PSVersion: "(2014.108) 0"..ModelName: "CutePDF Writer"..ShortNickName: "CutePDF Writer"..NickName: "CutePDF Writer"....% === Options and Constraints =========....% ==== Device Capabilities ===============..ColorDevice: True..DefaultColorSpace: RGB..FileSystem: True..?FileSystem: "(True) == flush"..LanguageLevel: "3"..FreeVM: "4194304"..VMOption None/Standard: "4194304"..FCacheSize None/Standard: 204800..Throughput: "400"..*VariablePaperSize: Tru

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\Cutepdfw.spd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	16697
Entropy (8bit):	5.199270003902307
Encrypted:	false
SSDEEP:
MD5:	97BE5B2A50B2089BDEA807A819367160
SHA1:	08555B6ECE70FF55A901337762A50976378DA22A
SHA-256:	40FCA15E1C3556CDBEA32079DD67A26DA4C9E0AB0D824DE6B50C719CD3BD101E
SHA-512:	3913D83F728E9500B6B16607B28086915BB343393A72DC000CC229D859424F1A16EE8A102FC9E23437F83FC088EB8A3AB79BF154109F308074E7885D33D13596
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.3"..% APLWCSB1.spd: Simplified form of APLWCSB1.ppd..LanguageEncoding: ISOLatin1..PCFileName: "APLWCSB1.PPD"..Product: "(CutePDF Writer)"..PSVersion: "(2014.108) 2"..ModelName: "CutePDF Writer"..ShortNickName: "CutePDF Writer"..NickName: "CutePDF Writer"..OpenGroup: InstallableOptions/Options Installed..OpenUI InstalledMemory/Memory Configuration: PickOne..DefaultInstalledMemory: 16Meg..InstalledMemory 16Meg/Standard 16 MB: ""..InstalledMemory 24Meg/24 MB Upgrade: ""..InstalledMemory 25Meg/25 MB Upgrade: ""..InstalledMemory 28Meg/28 MB Upgrade: ""..InstalledMemory 40Meg/40 MB Upgrade: ""..?InstalledMemory: ".. save.. currentsystemparams /RamSize get.. 1048576 div cvi 6 string cvs dup length dup 3 add string dup 0 4 index .. putinterval dup 2 index (Meg) putinterval exch pop exch pop = flush.. restore.."..End..CloseUI: InstalledMemory..OpenUI OptionalCassette1/Cassette (Optional): PickOne..DefaultOptionalCassette1: False..OptionalCassett

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\FONTS.MFM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	95719
Entropy (8bit):	6.148180556378838
Encrypted:	false
SSDEEP:
MD5:	0429BC080C0571EB67C958DF9B46932D
SHA1:	EA05FA033B5EA5FBF4385ABAB49CA39503E796F8
SHA-256:	4E8FA2D66ECA983F0E14C9338E6F81A06998A490C865D96ABE6616F12FE68296
SHA-512:	DEEF560CAE29664FEAB59DD84220EA332CE3FB8F277BCD98968EA7D26B965253AA70904B99BBCF502202F02EE34FA015AC0B1450DF068668628302C024526D23
Malicious:	false
Reputation:	unknown
Preview:	..................................................)...'Fr.....'2.g'..k...E.HVB_____.PFM.................].HVBO____.PFM.................].HVO_____.PFM.................].SY______.PFM.,...............].TIB_____.PFM.................].TIBI____.PFM..$..............].TII_____.PFM..+..............].TIR_____.PFM..2..............].HVN_____.PFM..:..............].HVNB____.PFM..@..............].HVNBO___.PFM..F..............].HVNO____.PFM..L..............].HV______.PFM.JS..............].COO_____.PFM..Y..............].POB_____.PFM..\..?...........].POBI____.PFM..`..a...........].POI_____.PFM. e..U...........].POR_____.PFM.ui..h...........].GDB_____.PFM..m..............].GDBI____.PFM..y..............].GDI_____.PFM.W...K...........].GDRG____.PFM.................].GDSBI___.PFM.................].HVBL____.PFM................].HVBLO___.PFM.Y...............].HVL_____.PFM................].HVLO____.PFM.`...............].HVC_____.PFM................].HVCB____.PFM.n...............].HVCBO___.PFM.....

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\ICONLIB.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	118144
Entropy (8bit):	2.4693988654637775
Encrypted:	false
SSDEEP:
MD5:	9DE3278966747FD3D36C6A6E8469EECA
SHA1:	D8D7762FFE6F7B97AE4DA300A6A208126A4AD855
SHA-256:	D50E32DFAC6C05E20572C0A6279C37F622DA290D5A7BCA4D84A28039F32CC16A
SHA-512:	77619D227C5BC9EFEC80E2DBF5CC2EAC922B76341B20F4C646C8DC06CD53FEF0E430366392084344D9A766F3B67507241DE2938BBF131B7805304A99478309F2
Malicious:	false
Reputation:	unknown
Preview:	MZ...... .........e@....@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.This program requires Microsoft Windows...$ Z.....!..L.!......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PS5UI.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	728576
Entropy (8bit):	6.000364854330154
Encrypted:	false
SSDEEP:
MD5:	A8C4D265F14C4F977C399D51971041B6
SHA1:	A8183D193B8C1F7E032FC75B3E98F6BA41BCC967
SHA-256:	8B105E50EB3289B7A52E70CFE4644800EFF98D8A50288B55F5EB0C3E8B2F16E1
SHA-512:	32B8FD3039D50F94EAED007C1FB07F4C55B7230BF73C598C77622281221FDF3737E1532B8D811C3839FFDD6188C68C2569C2B8DC5BECDE016A89CC39981D1D38
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+S..J=..J=..J=..@..J=..J<..J=..F..J=..P..J=..G..J=..S..J=..C..J=..A..J=..E..J=.Rich.J=.........PE..L...?.IE...........!.....R..................p.....2.........................P...........@.........................`_..:...LR..........._...........................................................<..@............................................text....Q.......R.................. ..`.data....2...p...0...V..............@....rsrc....`.......`..................@..@.reloc...6.......8..................@..Ba.IEP....IE[.....IEf.....IEp....IE}....IE....*.IE.....IE......IE............msvcrt.dll.USER32.dll.ole32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll..................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT.DRV (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	395472
Entropy (8bit):	6.902468892049908
Encrypted:	false
SSDEEP:
MD5:	7196A6992C91776B9E6EC50357C412B2
SHA1:	E197A4E385F0A7C491CBF6D7A485842E83F4AA85
SHA-256:	9B7EF4226B9450FA16B30C6830370777134CE45F41C245863CC031DCCE2CAA73
SHA-512:	4E02036DAE299E4F25888CB78837A9BACA244DA884C943D0C99930E517E4E08C54E9556C9A0BB35619656704B822A35FAA35642A29D3EFF0E1427CA4FEB1BE91
Malicious:	false
Reputation:	unknown
Preview:	MZ...... .........e@....@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.This program requires Microsoft Windows...$ Z.....!..L.!......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT.HLP (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:49 2001, 26038 bytes
Category:	dropped
Size (bytes):	26038
Entropy (8bit):	4.55580668806265
Encrypted:	false
SSDEEP:
MD5:	02C3F8C32018F3AAF66E7421400F1781
SHA1:	A04F2E40287AF78867161FA3F1606045088DA212
SHA-256:	6FAEF4C998E810FFF139958F28722C79879EC2FD66C97C7E3E2C5040FD5550D9
SHA-512:	C30FEE64D74A536117DE46C81B6E22EC82634D1284783A317BC15E85CFD561FAD7D50A63CA863EA6520B5CBAECF9061F7B52D3D99050484CE8A004F81DAB7990
Malicious:	false
Reputation:	unknown
Preview:	?_..J........e..:...1.....(),.aadv@ancedA.@a.ndareasa ssign..ut.omaticav.ailableb.ebitmapb oxbyc<.ha.ngeclick@Commun+.t.ionscomp.uterconn.ectedCTR.Ldefault.dependin@gdialo..f.ferentdiFr.=.disl.d docum..owpnloa...0..r.iverEdge.e..n. erro.rexample.featuref.i..ine-tu@nefont..s@forFor..m...-to-tra.y..atfrom.Generall.ygraphic.s..yIfima.geinin.....telyin50..(isl..u".le.tslevelL.istsmaym.S.....memor...ta....j.gb..vr.tworko...onlyop...t$.Optimi8zeo..... so.routl....g..p..pa1.pa.. elpla..Po.stScript.P..c.cesprHint. ed.0r..@-specif\ic.@0..P.@p.rovi}.rel.. resetr...rs..s..ctsq..ser......s@houlds..s@ourceSd0e.sm0yspoo...gsuchtha@ttheTh8.h...ghtoTru.eTyph.m.g...us..>.want.Whenw. e8..rw..hwill.wt.Yesyou...r),).+-.011.3Aal.waysanan.yASCIIat*a..b..r..st.binaryB. ...B.2."sboo2k..ca...2sC.."los........`ntrol....t.cR.tecur...cusS.CutDjdw.D.Rn..H.y.fi...sfarf-..F....g..avpehig... ".o.w..tItits.job..slon.gL..m%.man.ualmaximXummp...m?.tVm....i0.No.tbO..onek...O.T"PT"..pixe2l..rt..@2sP.rotocolR@GBRoll..l.s

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT.INI (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	365
Entropy (8bit):	4.540680934314414
Encrypted:	false
SSDEEP:
MD5:	7E7FF4E86258ED8360218DB6445F5B74
SHA1:	059F9E63451DDD50395AECD02F8626E2C01E651D
SHA-256:	24504B2AD45C5E7F845CBA1D90D6331311E51862C2B515A61F1301DE0C467805
SHA-512:	2A85418D8D8B019FA758A145CF95712DBAEA556935F525D35680A2E52E8BBB745E16558064EA63B7CB0D6190F8C5CD41C02DF905803DBDABA403F49B5709F707
Malicious:	false
Reputation:	unknown
Preview:	[DEFAULT_USE_PORTABILITY]..printer1="QMS 420 Print System" ..printer2="QMS 860 Print System" ..printer3="QMS 860+ Print System" ..printer4="QMS 1725 Print System" ..printer5="QMS 3225 Print System" ..printer6="QMS 4525 Print System" ..printer7="Microtek TrueLaser"..printer8="Apple LaserWriter II NTX"..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT.NTF (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	1060548
Entropy (8bit):	5.335948247757904
Encrypted:	false
SSDEEP:
MD5:	ACD06CCD864E483846B624642A0114B3
SHA1:	0453FED86FB7BBDEC1399F762941D3B77F50E903
SHA-256:	C19D4922DF0298D693F08D67557D48C1DE14EBFABA6BAD2CD69B1B4DDD5F0B82
SHA-512:	EAC81875BADC3363F726EEEB1464A0E188AABADEF07495FB789ACF1800AF13817F124C9ECFCFD8D7EE2721F0715AAF2CBD3744A9CAC0C8DF193C20BC31C64C4D
Malicious:	false
Reputation:	unknown
Preview:	1FTNSPTN............................0...........@$......x....$...................&...........&...................,......T....,..................$/......L.......................p1..Q.......@1..................,4..1........3...................6..5...<....6...................8...........8...................@...........@...................K......d....K..................LN..q5..\|....N...................P..q........P...................V....1.....\V...................Y..r.k.....\Y...................a...........a..................Po......\....n...................x..m...H...$x...................~..y.......l~....................._...,...<......................l.......h...............................\|...................................................................................................................p..............................D...}...H...........................................................................................................................m...................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSCRIPT5.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	543232
Entropy (8bit):	6.824368415346773
Encrypted:	false
SSDEEP:
MD5:	28E60CEF92843C1EA5C221DDC308B766
SHA1:	8890030A6F8931CF7F93C234D6BF5CD139786661
SHA-256:	DC0956AAB89BABBCC6F335192F7FBF1DC5349E13B1746C429FEFF75427A47030
SHA-512:	6A99D9AD28CBBADF771FD7297363E04A3119620B1DB6D98AA05307CD85021EB3571F3177C57136EC77CF74C1E34DA0ABBC5F92B623049562C3E3426417D762C8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..+.v.x.v.x.v.x2..x.v.x.v.x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.xRich.v.x................PE..L...@.IE...........!.........j......AL.......................................p......]0....@.........................@................0.......................@...$.....................................@............................................text............................... ..`.data....1.......0..................@....rsrc........0......................@..@.reloc..^+...@...,..................@..Ba.IEP....IE[...*.IEe.....IEr....IE[....IE.....IE....G.IE......IE............msvcrt.dll.ntdll.dll.WINSPOOL.DRV.KERNEL32.dll.GDI32.dll.USER32.dll.mscms.dll.ole32.dll.........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\PSMON.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.561884845096913
Encrypted:	false
SSDEEP:
MD5:	28E9EC320646CC0779422F5F9DC9129A
SHA1:	129BF703A689F235D9EFB30C409091E54DFD651B
SHA-256:	6F9AAECB57DE35D7ABD922E6514D62EA3F66FF114B4ACE6011085D17C603F566
SHA-512:	0C0523C7913DEB0E6B9AE5EC863EE2DED6CD5ACED725EFED60E71FF3F7A99DD4CC26C438B30CF387D3C9DBAD6930EADAAFCF4BA7673A8B7E55C9043FF65580DD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+<@9...........!...<.8...p......9........P.....v.................................................................F..h.......P.......\|#...........................................................................................................text....7.......@.................. ..`.data....;...P...@...P..............@....idata..............................@..@.rsrc...\|#.......0..................@..@.reloc..J...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\TESTPS.TXT (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	3317
Entropy (8bit):	4.513373547975265
Encrypted:	false
SSDEEP:
MD5:	667BDCF7167048569D0FE44060DE3574
SHA1:	55E4AC26ABC998413A0AD9D3ECF1833157346190
SHA-256:	EBCEA08C1EF7E6146AD74FEC109E682E5C12A99E45C9D6E5F9B43A2309F7A0B2
SHA-512:	A4F1B31BBE323A00F85AF00048761244ED8B73D3025F1EB2AD1145D51254BCF18F71B9A4CFC81D44A0876900EDF9E1C6FA7D0A5A81BE1308BC63DBD4DD04FF5F
Malicious:	false
Reputation:	unknown
Preview:	-----------------------------------------------------------.. Microsoft Windows 98 README for Testing Postscript.. April 1998 ..-----------------------------------------------------------....(c) Copyright Microsoft Corporation, 1998......This document provides complementary or late-breaking ..information to supplement the Microsoft Windows 98 ..documentation.....------------------------..HOW TO USE THIS DOCUMENT..------------------------....To view Testps.txt on-screen in Notepad, maximize the ..Notepad window.....To print Testps.txt, open it in Notepad or another word ..processor, click the File menu, and then click Print.....% This is a PostScript program that will print out the current..% communications settings of a PostScript printer that supports..% the sccbatch operator...%..% To use: copy this file to the port connected to the PostScript printer...%..% (c) Copyright 1998, Microsoft Corporation..%../buf 10 string def../Courier findfont 10 scale

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-3BEAI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	543232
Entropy (8bit):	6.824368415346773
Encrypted:	false
SSDEEP:
MD5:	28E60CEF92843C1EA5C221DDC308B766
SHA1:	8890030A6F8931CF7F93C234D6BF5CD139786661
SHA-256:	DC0956AAB89BABBCC6F335192F7FBF1DC5349E13B1746C429FEFF75427A47030
SHA-512:	6A99D9AD28CBBADF771FD7297363E04A3119620B1DB6D98AA05307CD85021EB3571F3177C57136EC77CF74C1E34DA0ABBC5F92B623049562C3E3426417D762C8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..+.v.x.v.x.v.x2..x.v.x.v.x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.x2..x.v.xRich.v.x................PE..L...@.IE...........!.........j......AL.......................................p......]0....@.........................@................0.......................@...$.....................................@............................................text............................... ..`.data....1.......0..................@....rsrc........0......................@..@.reloc..^+...@...,..................@..Ba.IEP....IE[...*.IEe.....IEr....IE[....IE.....IE....G.IE......IE............msvcrt.dll.ntdll.dll.WINSPOOL.DRV.KERNEL32.dll.GDI32.dll.USER32.dll.mscms.dll.ole32.dll.........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-6BH7F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	3317
Entropy (8bit):	4.513373547975265
Encrypted:	false
SSDEEP:
MD5:	667BDCF7167048569D0FE44060DE3574
SHA1:	55E4AC26ABC998413A0AD9D3ECF1833157346190
SHA-256:	EBCEA08C1EF7E6146AD74FEC109E682E5C12A99E45C9D6E5F9B43A2309F7A0B2
SHA-512:	A4F1B31BBE323A00F85AF00048761244ED8B73D3025F1EB2AD1145D51254BCF18F71B9A4CFC81D44A0876900EDF9E1C6FA7D0A5A81BE1308BC63DBD4DD04FF5F
Malicious:	false
Reputation:	unknown
Preview:	-----------------------------------------------------------.. Microsoft Windows 98 README for Testing Postscript.. April 1998 ..-----------------------------------------------------------....(c) Copyright Microsoft Corporation, 1998......This document provides complementary or late-breaking ..information to supplement the Microsoft Windows 98 ..documentation.....------------------------..HOW TO USE THIS DOCUMENT..------------------------....To view Testps.txt on-screen in Notepad, maximize the ..Notepad window.....To print Testps.txt, open it in Notepad or another word ..processor, click the File menu, and then click Print.....% This is a PostScript program that will print out the current..% communications settings of a PostScript printer that supports..% the sccbatch operator...%..% To use: copy this file to the port connected to the PostScript printer...%..% (c) Copyright 1998, Microsoft Corporation..%../buf 10 string def../Courier findfont 10 scale

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-82ASD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	365
Entropy (8bit):	4.540680934314414
Encrypted:	false
SSDEEP:
MD5:	7E7FF4E86258ED8360218DB6445F5B74
SHA1:	059F9E63451DDD50395AECD02F8626E2C01E651D
SHA-256:	24504B2AD45C5E7F845CBA1D90D6331311E51862C2B515A61F1301DE0C467805
SHA-512:	2A85418D8D8B019FA758A145CF95712DBAEA556935F525D35680A2E52E8BBB745E16558064EA63B7CB0D6190F8C5CD41C02DF905803DBDABA403F49B5709F707
Malicious:	false
Reputation:	unknown
Preview:	[DEFAULT_USE_PORTABILITY]..printer1="QMS 420 Print System" ..printer2="QMS 860 Print System" ..printer3="QMS 860+ Print System" ..printer4="QMS 1725 Print System" ..printer5="QMS 3225 Print System" ..printer6="QMS 4525 Print System" ..printer7="Microtek TrueLaser"..printer8="Apple LaserWriter II NTX"..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-FDP4K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	728576
Entropy (8bit):	6.000364854330154
Encrypted:	false
SSDEEP:
MD5:	A8C4D265F14C4F977C399D51971041B6
SHA1:	A8183D193B8C1F7E032FC75B3E98F6BA41BCC967
SHA-256:	8B105E50EB3289B7A52E70CFE4644800EFF98D8A50288B55F5EB0C3E8B2F16E1
SHA-512:	32B8FD3039D50F94EAED007C1FB07F4C55B7230BF73C598C77622281221FDF3737E1532B8D811C3839FFDD6188C68C2569C2B8DC5BECDE016A89CC39981D1D38
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+S..J=..J=..J=..@..J=..J<..J=..F..J=..P..J=..G..J=..S..J=..C..J=..A..J=..E..J=.Rich.J=.........PE..L...?.IE...........!.....R..................p.....2.........................P...........@.........................`_..:...LR..........._...........................................................<..@............................................text....Q.......R.................. ..`.data....2...p...0...V..............@....rsrc....`.......`..................@..@.reloc...6.......8..................@..Ba.IEP....IE[.....IEf.....IEp....IE}....IE....*.IE.....IE......IE............msvcrt.dll.USER32.dll.ole32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll..................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-GRVTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	16697
Entropy (8bit):	5.199270003902307
Encrypted:	false
SSDEEP:
MD5:	97BE5B2A50B2089BDEA807A819367160
SHA1:	08555B6ECE70FF55A901337762A50976378DA22A
SHA-256:	40FCA15E1C3556CDBEA32079DD67A26DA4C9E0AB0D824DE6B50C719CD3BD101E
SHA-512:	3913D83F728E9500B6B16607B28086915BB343393A72DC000CC229D859424F1A16EE8A102FC9E23437F83FC088EB8A3AB79BF154109F308074E7885D33D13596
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.3"..% APLWCSB1.spd: Simplified form of APLWCSB1.ppd..LanguageEncoding: ISOLatin1..PCFileName: "APLWCSB1.PPD"..Product: "(CutePDF Writer)"..PSVersion: "(2014.108) 2"..ModelName: "CutePDF Writer"..ShortNickName: "CutePDF Writer"..NickName: "CutePDF Writer"..OpenGroup: InstallableOptions/Options Installed..OpenUI InstalledMemory/Memory Configuration: PickOne..DefaultInstalledMemory: 16Meg..InstalledMemory 16Meg/Standard 16 MB: ""..InstalledMemory 24Meg/24 MB Upgrade: ""..InstalledMemory 25Meg/25 MB Upgrade: ""..InstalledMemory 28Meg/28 MB Upgrade: ""..InstalledMemory 40Meg/40 MB Upgrade: ""..?InstalledMemory: ".. save.. currentsystemparams /RamSize get.. 1048576 div cvi 6 string cvs dup length dup 3 add string dup 0 4 index .. putinterval dup 2 index (Meg) putinterval exch pop exch pop = flush.. restore.."..End..CloseUI: InstalledMemory..OpenUI OptionalCassette1/Cassette (Optional): PickOne..DefaultOptionalCassette1: False..OptionalCassett

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-IGGEH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	395472
Entropy (8bit):	6.902468892049908
Encrypted:	false
SSDEEP:
MD5:	7196A6992C91776B9E6EC50357C412B2
SHA1:	E197A4E385F0A7C491CBF6D7A485842E83F4AA85
SHA-256:	9B7EF4226B9450FA16B30C6830370777134CE45F41C245863CC031DCCE2CAA73
SHA-512:	4E02036DAE299E4F25888CB78837A9BACA244DA884C943D0C99930E517E4E08C54E9556C9A0BB35619656704B822A35FAA35642A29D3EFF0E1427CA4FEB1BE91
Malicious:	false
Reputation:	unknown
Preview:	MZ...... .........e@....@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.This program requires Microsoft Windows...$ Z.....!..L.!......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-KT3FM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	118144
Entropy (8bit):	2.4693988654637775
Encrypted:	false
SSDEEP:
MD5:	9DE3278966747FD3D36C6A6E8469EECA
SHA1:	D8D7762FFE6F7B97AE4DA300A6A208126A4AD855
SHA-256:	D50E32DFAC6C05E20572C0A6279C37F622DA290D5A7BCA4D84A28039F32CC16A
SHA-512:	77619D227C5BC9EFEC80E2DBF5CC2EAC922B76341B20F4C646C8DC06CD53FEF0E430366392084344D9A766F3B67507241DE2938BBF131B7805304A99478309F2
Malicious:	false
Reputation:	unknown
Preview:	MZ...... .........e@....@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.This program requires Microsoft Windows...$ Z.....!..L.!......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-LDLTG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.561884845096913
Encrypted:	false
SSDEEP:
MD5:	28E9EC320646CC0779422F5F9DC9129A
SHA1:	129BF703A689F235D9EFB30C409091E54DFD651B
SHA-256:	6F9AAECB57DE35D7ABD922E6514D62EA3F66FF114B4ACE6011085D17C603F566
SHA-512:	0C0523C7913DEB0E6B9AE5EC863EE2DED6CD5ACED725EFED60E71FF3F7A99DD4CC26C438B30CF387D3C9DBAD6930EADAAFCF4BA7673A8B7E55C9043FF65580DD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+<@9...........!...<.8...p......9........P.....v.................................................................F..h.......P.......\|#...........................................................................................................text....7.......@.................. ..`.data....;...P...@...P..............@....idata..............................@..@.rsrc...\|#.......0..................@..@.reloc..J...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-QK469.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:49 2001, 26038 bytes
Category:	dropped
Size (bytes):	26038
Entropy (8bit):	4.55580668806265
Encrypted:	false
SSDEEP:
MD5:	02C3F8C32018F3AAF66E7421400F1781
SHA1:	A04F2E40287AF78867161FA3F1606045088DA212
SHA-256:	6FAEF4C998E810FFF139958F28722C79879EC2FD66C97C7E3E2C5040FD5550D9
SHA-512:	C30FEE64D74A536117DE46C81B6E22EC82634D1284783A317BC15E85CFD561FAD7D50A63CA863EA6520B5CBAECF9061F7B52D3D99050484CE8A004F81DAB7990
Malicious:	false
Reputation:	unknown
Preview:	?_..J........e..:...1.....(),.aadv@ancedA.@a.ndareasa ssign..ut.omaticav.ailableb.ebitmapb oxbyc<.ha.ngeclick@Commun+.t.ionscomp.uterconn.ectedCTR.Ldefault.dependin@gdialo..f.ferentdiFr.=.disl.d docum..owpnloa...0..r.iverEdge.e..n. erro.rexample.featuref.i..ine-tu@nefont..s@forFor..m...-to-tra.y..atfrom.Generall.ygraphic.s..yIfima.geinin.....telyin50..(isl..u".le.tslevelL.istsmaym.S.....memor...ta....j.gb..vr.tworko...onlyop...t$.Optimi8zeo..... so.routl....g..p..pa1.pa.. elpla..Po.stScript.P..c.cesprHint. ed.0r..@-specif\ic.@0..P.@p.rovi}.rel.. resetr...rs..s..ctsq..ser......s@houlds..s@ourceSd0e.sm0yspoo...gsuchtha@ttheTh8.h...ghtoTru.eTyph.m.g...us..>.want.Whenw. e8..rw..hwill.wt.Yesyou...r),).+-.011.3Aal.waysanan.yASCIIat*a..b..r..st.binaryB. ...B.2."sboo2k..ca...2sC.."los........`ntrol....t.cR.tecur...cusS.CutDjdw.D.Rn..H.y.fi...sfarf-..F....g..avpehig... ".o.w..tItits.job..slon.gL..m%.man.ualmaximXummp...m?.tVm....i0.No.tbO..onek...O.T"PT"..pixe2l..rt..@2sP.rotocolR@GBRoll..l.s

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-QLTDT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	31736
Entropy (8bit):	5.360568407736167
Encrypted:	false
SSDEEP:
MD5:	4C4C993507312E1D744EAF74C878BA1D
SHA1:	5E88BFD6FE9C79389C7206FF8907E7969EAEB1B5
SHA-256:	454216087ACA9C7A3326BB247B84C782281C5E71AE43EE8A977A480B0FA4ED25
SHA-512:	79494149692FB5804FD5A64A0F31DC4C79DCC4E717FB15D23A9A03901FF6E701D2B76431BECF1CF49EB57BE0F9727B4589E05C3A23FF85D6C52D03D5C72F6C56
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 2008 CUTEPDF..% All Rights Reserved. ..% Permission is granted for redistribution of this file as..% long as this copyright notice is intact and the contents..% of the file is not altered in any way from its original form...% End of Copyright statement....FormatVersion: "4.3"..FileVersion: "1.0"..LanguageEncoding: ISOLatin1..LanguageVersion: English..PCFileName: "cutepdfw.ppd"..Manufacturer: "CUTEPDF"..Product: "(CutePDF Writer)"..PSVersion: "(2014.108) 0"..ModelName: "CutePDF Writer"..ShortNickName: "CutePDF Writer"..NickName: "CutePDF Writer"....% === Options and Constraints =========....% ==== Device Capabilities ===============..ColorDevice: True..DefaultColorSpace: RGB..FileSystem: True..?FileSystem: "(True) == flush"..LanguageLevel: "3"..FreeVM: "4194304"..VMOption None/Standard: "4194304"..FCacheSize None/Standard: 204800..Throughput: "400"..*VariablePaperSize: Tru

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-QT877.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	1060548
Entropy (8bit):	5.335948247757904
Encrypted:	false
SSDEEP:
MD5:	ACD06CCD864E483846B624642A0114B3
SHA1:	0453FED86FB7BBDEC1399F762941D3B77F50E903
SHA-256:	C19D4922DF0298D693F08D67557D48C1DE14EBFABA6BAD2CD69B1B4DDD5F0B82
SHA-512:	EAC81875BADC3363F726EEEB1464A0E188AABADEF07495FB789ACF1800AF13817F124C9ECFCFD8D7EE2721F0715AAF2CBD3744A9CAC0C8DF193C20BC31C64C4D
Malicious:	false
Reputation:	unknown
Preview:	1FTNSPTN............................0...........@$......x....$...................&...........&...................,......T....,..................$/......L.......................p1..Q.......@1..................,4..1........3...................6..5...<....6...................8...........8...................@...........@...................K......d....K..................LN..q5..\|....N...................P..q........P...................V....1.....\V...................Y..r.k.....\Y...................a...........a..................Po......\....n...................x..m...H...$x...................~..y.......l~....................._...,...<......................l.......h...............................\|...................................................................................................................p..............................D...}...H...........................................................................................................................m...................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\is-RSJOB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	95719
Entropy (8bit):	6.148180556378838
Encrypted:	false
SSDEEP:
MD5:	0429BC080C0571EB67C958DF9B46932D
SHA1:	EA05FA033B5EA5FBF4385ABAB49CA39503E796F8
SHA-256:	4E8FA2D66ECA983F0E14C9338E6F81A06998A490C865D96ABE6616F12FE68296
SHA-512:	DEEF560CAE29664FEAB59DD84220EA332CE3FB8F277BCD98968EA7D26B965253AA70904B99BBCF502202F02EE34FA015AC0B1450DF068668628302C024526D23
Malicious:	false
Reputation:	unknown
Preview:	..................................................)...'Fr.....'2.g'..k...E.HVB_____.PFM.................].HVBO____.PFM.................].HVO_____.PFM.................].SY______.PFM.,...............].TIB_____.PFM.................].TIBI____.PFM..$..............].TII_____.PFM..+..............].TIR_____.PFM..2..............].HVN_____.PFM..:..............].HVNB____.PFM..@..............].HVNBO___.PFM..F..............].HVNO____.PFM..L..............].HV______.PFM.JS..............].COO_____.PFM..Y..............].POB_____.PFM..\..?...........].POBI____.PFM..`..a...........].POI_____.PFM. e..U...........].POR_____.PFM.ui..h...........].GDB_____.PFM..m..............].GDBI____.PFM..y..............].GDI_____.PFM.W...K...........].GDRG____.PFM.................].GDSBI___.PFM.................].HVBL____.PFM................].HVBLO___.PFM.Y...............].HVL_____.PFM................].HVLO____.PFM.`...............].HVC_____.PFM................].HVCB____.PFM.n...............].HVCBO___.PFM.....

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PS5UI.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	850432
Entropy (8bit):	5.950880465848191
Encrypted:	false
SSDEEP:
MD5:	1EDE62E047F4BB3D0398EBA367C16484
SHA1:	99B797B6B70EE104B725F71A2E716DFD1FC6E808
SHA-256:	277D1DA8C6FD51C3CC958A459ECC18BA5551ADBC1C1D8588082C9583324C8953
SHA-512:	02A0B9B9F1307DE817E7CD90083C0823818E5BD8C8ACF2A78442050F87BA6C4EA288D96E05B1AD803428BDF7319C3C081320867319F28A15E157B2DD28C6AB55
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2$..vE..vE..vE..Q..wE..Q..yE..vE...E..Q...gE..Q..ME..Q...wE..Q...E..Q..wE..Q..wE..Q..wE..RichvE..........................PE..d.....IE.........." ...........................K............................. ......Zn....@.............................................:................_...p..\|/..................@................................................................................text...*........................... ..`.data...pL... ...F..................@....pdata..\|/...p...0...V..............@..@.rsrc....`.......`..................@..@.reloc..R...........................@..B..IEX...r.IEc...4.IEm.....IEx...(.IE....r.IEc...6.IE....\|.IE....s.IE......IE............msvcrt.dll.NTDLL.DLL.USER32.dll.ole32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll..........................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.HLP (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:49 2001, 26038 bytes
Category:	dropped
Size (bytes):	26038
Entropy (8bit):	4.55580668806265
Encrypted:	false
SSDEEP:
MD5:	02C3F8C32018F3AAF66E7421400F1781
SHA1:	A04F2E40287AF78867161FA3F1606045088DA212
SHA-256:	6FAEF4C998E810FFF139958F28722C79879EC2FD66C97C7E3E2C5040FD5550D9
SHA-512:	C30FEE64D74A536117DE46C81B6E22EC82634D1284783A317BC15E85CFD561FAD7D50A63CA863EA6520B5CBAECF9061F7B52D3D99050484CE8A004F81DAB7990
Malicious:	false
Reputation:	unknown
Preview:	?_..J........e..:...1.....(),.aadv@ancedA.@a.ndareasa ssign..ut.omaticav.ailableb.ebitmapb oxbyc<.ha.ngeclick@Commun+.t.ionscomp.uterconn.ectedCTR.Ldefault.dependin@gdialo..f.ferentdiFr.=.disl.d docum..owpnloa...0..r.iverEdge.e..n. erro.rexample.featuref.i..ine-tu@nefont..s@forFor..m...-to-tra.y..atfrom.Generall.ygraphic.s..yIfima.geinin.....telyin50..(isl..u".le.tslevelL.istsmaym.S.....memor...ta....j.gb..vr.tworko...onlyop...t$.Optimi8zeo..... so.routl....g..p..pa1.pa.. elpla..Po.stScript.P..c.cesprHint. ed.0r..@-specif\ic.@0..P.@p.rovi}.rel.. resetr...rs..s..ctsq..ser......s@houlds..s@ourceSd0e.sm0yspoo...gsuchtha@ttheTh8.h...ghtoTru.eTyph.m.g...us..>.want.Whenw. e8..rw..hwill.wt.Yesyou...r),).+-.011.3Aal.waysanan.yASCIIat*a..b..r..st.binaryB. ...B.2."sboo2k..ca...2sC.."los........`ntrol....t.cR.tecur...cusS.CutDjdw.D.Rn..H.y.fi...sfarf-..F....g..avpehig... ".o.w..tItits.job..slon.gL..m%.man.ualmaximXummp...m?.tVm....i0.No.tbO..onek...O.T"PT"..pixe2l..rt..@2sP.rotocolR@GBRoll..l.s

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	1062732
Entropy (8bit):	5.327224938603629
Encrypted:	false
SSDEEP:
MD5:	C18E8DA3F5C91760E00DFAE8B6364BED
SHA1:	566D28948DAE855C8E5F560EAD7E0D8CC73DC1D5
SHA-256:	F49C950531E485BBC4B35161CF049ADF8363D0BD222CFED2EEDE2A13FE418187
SHA-512:	65C7F8C129D71DE9B887B5741760D86955035F977B32B89CF43A31EB973178AF6BAE1E5D39DCA19B56F6BB0139634F44E90C31CFAC00F75E64908D7B36A75D3A
Malicious:	false
Reputation:	unknown
Preview:	1FTNSPTN............................0...........@$......x....$...................&...........&...................,......T....,..................$/......L.......................p1..Q.......@1..................,4..1........3...................6..5...<....6...................8...........8...................@...........@...................K......d....K..................LN..q5..\|....N...................P..q........P...................V....1.....\V...................Y..r.k.....\Y...................a...........a..................Xo......d....n...................x..m...P...4x......................y........~....................._...4...\.......................l...........................4...............................D..........................................P..............................`...............................8.......................}...P...................................d...............................l...............................\|.......................m...................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT5.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	628736
Entropy (8bit):	6.679545194217932
Encrypted:	false
SSDEEP:
MD5:	FB270D281F4929B9E0894AFC816C9DBE
SHA1:	370EC45A41CF15097B7B2FC14A217A739ECB675B
SHA-256:	9F0DC9C094AE73AA052817E0233F5DEB5C18C7C8EF63733E95D4CDE65E0386F0
SHA-512:	E4B6E6C80043AB86A00D674ED3A636EA15249FF956C95730C203E0EECC263D19217DE720082531A1A51CC3B752E3EEAD64DF43E0C3425F9E49B807FC62A71C24
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.ye"..6"..6"..6.gj6#..6.gy6-..6"..6..6.gl63..6.gz6...6.gm6#..6.gf6l..6.gi6#..6.gk6#..6.go6#..6Rich"..6........PE..d.....IE.........." ...........................G....................................\|P....@.........................................P........................p...(.................. ................................................................................text............................... ..`.data....I... ...D..................@....pdata...(...p...*...L..............@..@.rsrc................v..............@..@.reloc..B...........................@..B..IEX...r.IEc...r.IEc...\|.IEm...(.IEz...r.IEc...s.IE....4.IE......IE......IE............msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.GDI32.dll.USER32.dll.mscms.dll.ole32.dll.........................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-0HCHF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	850432
Entropy (8bit):	5.950880465848191
Encrypted:	false
SSDEEP:
MD5:	1EDE62E047F4BB3D0398EBA367C16484
SHA1:	99B797B6B70EE104B725F71A2E716DFD1FC6E808
SHA-256:	277D1DA8C6FD51C3CC958A459ECC18BA5551ADBC1C1D8588082C9583324C8953
SHA-512:	02A0B9B9F1307DE817E7CD90083C0823818E5BD8C8ACF2A78442050F87BA6C4EA288D96E05B1AD803428BDF7319C3C081320867319F28A15E157B2DD28C6AB55
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2$..vE..vE..vE..Q..wE..Q..yE..vE...E..Q...gE..Q..ME..Q...wE..Q...E..Q..wE..Q..wE..Q..wE..RichvE..........................PE..d.....IE.........." ...........................K............................. ......Zn....@.............................................:................_...p..\|/..................@................................................................................text...*........................... ..`.data...pL... ...F..................@....pdata..\|/...p...0...V..............@..@.rsrc....`.......`..................@..@.reloc..R...........................@..B..IEX...r.IEc...4.IEm.....IEx...(.IE....r.IEc...6.IE....\|.IE....s.IE......IE............msvcrt.dll.NTDLL.DLL.USER32.dll.ole32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll..........................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-327TJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	628736
Entropy (8bit):	6.679545194217932
Encrypted:	false
SSDEEP:
MD5:	FB270D281F4929B9E0894AFC816C9DBE
SHA1:	370EC45A41CF15097B7B2FC14A217A739ECB675B
SHA-256:	9F0DC9C094AE73AA052817E0233F5DEB5C18C7C8EF63733E95D4CDE65E0386F0
SHA-512:	E4B6E6C80043AB86A00D674ED3A636EA15249FF956C95730C203E0EECC263D19217DE720082531A1A51CC3B752E3EEAD64DF43E0C3425F9E49B807FC62A71C24
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.ye"..6"..6"..6.gj6#..6.gy6-..6"..6..6.gl63..6.gz6...6.gm6#..6.gf6l..6.gi6#..6.gk6#..6.go6#..6Rich"..6........PE..d.....IE.........." ...........................G....................................\|P....@.........................................P........................p...(.................. ................................................................................text............................... ..`.data....I... ...D..................@....pdata...(...p...*...L..............@..@.rsrc................v..............@..@.reloc..B...........................@..B..IEX...r.IEc...r.IEc...\|.IEm...(.IEz...r.IEc...s.IE....4.IE......IE......IE............msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.GDI32.dll.USER32.dll.mscms.dll.ole32.dll.........................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-E1QSQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:49 2001, 26038 bytes
Category:	dropped
Size (bytes):	26038
Entropy (8bit):	4.55580668806265
Encrypted:	false
SSDEEP:
MD5:	02C3F8C32018F3AAF66E7421400F1781
SHA1:	A04F2E40287AF78867161FA3F1606045088DA212
SHA-256:	6FAEF4C998E810FFF139958F28722C79879EC2FD66C97C7E3E2C5040FD5550D9
SHA-512:	C30FEE64D74A536117DE46C81B6E22EC82634D1284783A317BC15E85CFD561FAD7D50A63CA863EA6520B5CBAECF9061F7B52D3D99050484CE8A004F81DAB7990
Malicious:	false
Reputation:	unknown
Preview:	?_..J........e..:...1.....(),.aadv@ancedA.@a.ndareasa ssign..ut.omaticav.ailableb.ebitmapb oxbyc<.ha.ngeclick@Commun+.t.ionscomp.uterconn.ectedCTR.Ldefault.dependin@gdialo..f.ferentdiFr.=.disl.d docum..owpnloa...0..r.iverEdge.e..n. erro.rexample.featuref.i..ine-tu@nefont..s@forFor..m...-to-tra.y..atfrom.Generall.ygraphic.s..yIfima.geinin.....telyin50..(isl..u".le.tslevelL.istsmaym.S.....memor...ta....j.gb..vr.tworko...onlyop...t$.Optimi8zeo..... so.routl....g..p..pa1.pa.. elpla..Po.stScript.P..c.cesprHint. ed.0r..@-specif\ic.@0..P.@p.rovi}.rel.. resetr...rs..s..ctsq..ser......s@houlds..s@ourceSd0e.sm0yspoo...gsuchtha@ttheTh8.h...ghtoTru.eTyph.m.g...us..>.want.Whenw. e8..rw..hwill.wt.Yesyou...r),).+-.011.3Aal.waysanan.yASCIIat*a..b..r..st.binaryB. ...B.2."sboo2k..ca...2sC.."los........`ntrol....t.cR.tecur...cusS.CutDjdw.D.Rn..H.y.fi...sfarf-..F....g..avpehig... ".o.w..tItits.job..slon.gL..m%.man.ualmaximXummp...m?.tVm....i0.No.tbO..onek...O.T"PT"..pixe2l..rt..@2sP.rotocolR@GBRoll..l.s

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\is-PL7JN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	data
Category:	dropped
Size (bytes):	1062732
Entropy (8bit):	5.327224938603629
Encrypted:	false
SSDEEP:
MD5:	C18E8DA3F5C91760E00DFAE8B6364BED
SHA1:	566D28948DAE855C8E5F560EAD7E0D8CC73DC1D5
SHA-256:	F49C950531E485BBC4B35161CF049ADF8363D0BD222CFED2EEDE2A13FE418187
SHA-512:	65C7F8C129D71DE9B887B5741760D86955035F977B32B89CF43A31EB973178AF6BAE1E5D39DCA19B56F6BB0139634F44E90C31CFAC00F75E64908D7B36A75D3A
Malicious:	false
Reputation:	unknown
Preview:	1FTNSPTN............................0...........@$......x....$...................&...........&...................,......T....,..................$/......L.......................p1..Q.......@1..................,4..1........3...................6..5...<....6...................8...........8...................@...........@...................K......d....K..................LN..q5..\|....N...................P..q........P...................V....1.....\V...................Y..r.k.....\Y...................a...........a..................Xo......d....n...................x..m...P...4x......................y........~....................._...4...\.......................l...........................4...............................D..........................................P..............................`...............................8.......................}...P...................................d...............................l...............................\|.......................m...................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Opera.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PC bitmap, Windows 3.x format, 623 x 289 x 24, image size 541008, cbSize 541062, bits offset 54
Category:	dropped
Size (bytes):	541062
Entropy (8bit):	6.052720492644266
Encrypted:	false
SSDEEP:
MD5:	78A3F5A7F68E45A98CED9AED62127C5D
SHA1:	07301176A6922AF2C67BB131E9FDADC2B0C1FDFC
SHA-256:	0399E76AEE6F6638AD143D14BD55ADB5B2BEA7D183DD14E5C9EA3A8CA451F5D6
SHA-512:	41FE9A63D384210D19356D3026DE3936EEE7DCDBD3BA1F75572D9205669129DAFF5A69BFC802CCF5105014DB9348511B628B8683A3E8D9628B168C210603054A
Malicious:	false
Reputation:	unknown
Preview:	BM.A......6...(...o...!...........PA...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960944
Entropy (8bit):	7.768238813655888
Encrypted:	false
SSDEEP:
MD5:	3C51B6EED283BBE7D10772DDE9BFFFB7
SHA1:	F30269E23BCDD815EFE305E25C796C2E211EC085
SHA-256:	92092018F15CE77E2FCEABB90830762EF3273EB4BCA3673881EB3EA68855FBED
SHA-512:	F0D89788B556EE93A697C1DCCC7C79FE19E3573F2CF0485CC988FA9515D943BF43003C0F4275A0ACAAB7BFF032CA841C3E53F78325A0B6DBD2BFDCF57CBF2BBC
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.e..........".......,......`&.@.R..p&...R...@...........................S.......-...@..................................pS.......R..............-.0,...qS...............................R.....$.R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!....I....3b.l.R.-z,..VR.&..ta.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Opera_Logo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PC bitmap, Windows 3.x format, 55 x 55 x 8, image size 3080, resolution 3780 x 3780 px/m, cbSize 4158, bits offset 1078
Category:	dropped
Size (bytes):	4158
Entropy (8bit):	3.081704528536239
Encrypted:	false
SSDEEP:
MD5:	C9651987DBA439F486798F7C236BDFE7
SHA1:	48A39E48043B528D76F449A57045410AB4A8B4D9
SHA-256:	A535A6A672DA6411BEFD42E3F41EF8EC58BDD5FE5E6CC196D0C966025638B5F2
SHA-512:	07D29E9EB626CA4286323D5DB0B54938232DB5DEC49BD3A7D964DF0E8724B0DE609EA2CBE0222B8838E07AF92F9287EFFC886AB23D07968F431AE97326833F11
Malicious:	false
Reputation:	unknown
Preview:	BM>.......6...(...7...7....................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\PDFWrite.rsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.139730271830087
Encrypted:	false
SSDEEP:
MD5:	FEF862EB25DFDC61A328B941960629EE
SHA1:	8E20F7C17D890545AA28C2BDAB1845C4DCE673A8
SHA-256:	C21B6FC73A4D92EE282C927699B892A8D7207AC1C78475A530C1D1E4264940D6
SHA-512:	52AB438CC25D63B5697E04F6B3840B7CD8FBAD637593DC3686EC0786786AFD70C9D0C2604850E5F5733C7D8A33AC5E687096698B9889EC39075A4CBC0D5713E9
Malicious:	false
Reputation:	unknown
Preview:	-sDEVICE=pdfwrite..-q..-dPDFSETTINGS=/prepress..-dAutoRotatePages=/All..-dCompatibilityLevel=1.4..-dNOPAUSE..-dBATCH..-dMonoImageFilter=/FlateEncode..-dEncodeMonoImages=true

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Readme.htm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	HTML document, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5941
Entropy (8bit):	5.543261233847591
Encrypted:	false
SSDEEP:
MD5:	1444D84C8D78209F0BBAC83F2290EFB5
SHA1:	D414CA3330A30CA727DF7CA600017917B1E35F38
SHA-256:	61E862557C4032005457B16FC9D8E7F50A40C6686DFE159B156DE2A2F8713A45
SHA-512:	0783931ADFF1975A0CF3B9199B4F0FC4E3FDE4D2CAEE9D0F745BF891A4B0D7CD2B2296119FAF7BDE15893E2AAEDF4805DA3B02EC75F7C50F1D0E55D2058C3776
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<HTML><HEAD><TITLE>CutePDF Writer Readme</TITLE>..<META http-equiv=Content-Type content="text/html; charset=windows-1252">..<style type="Text/css" title="global">..BODY {...FONT-SIZE: 75%; BACKGROUND: #fffff4; LINE-HEIGHT: 125%; FONT-FAMILY: Verdana, Arial, Helvetica..}..A:link {...COLOR: #0000ff..}..A:active {...COLOR: #ff33cc..}..A:visited {...COLOR: #800080..}..H1 {...FONT-SIZE: 145%; MARGIN-BOTTOM: 0.5em..}..H2 {...MARGIN-TOP: 1.5em; FONT-SIZE: 125%; MARGIN-BOTTOM: 0.5em..}..H3 {...MARGIN-TOP: 1.2em; FONT-SIZE: 110%; MARGIN-BOTTOM: 0.5em..}..P {...MARGIN-TOP: 0pt; MARGIN-BOTTOM: 0pt..}..LI P {...MARGIN-TOP: 0.6em; MARGIN-BOTTOM: 0em..}..BIG {...FONT-WEIGHT: bold; FONT-SIZE: 105%..}..OL {...MARGIN-TOP: 0.5em; MARGIN-BOTTOM: 0em..}..UL {...MARGIN-TOP: 0.6em; MARGIN-BOTTOM: 0em; MARGIN-LEFT: 2.75em..}..OL UL {...MARGIN-TOP: 2em; LIST-STYLE-TYPE: disc..}..LI {...PADDING-BOTTOM: 0.7em; MARGIN-LEFT: -1.25em..}..DL UL {...MAR

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64848
Entropy (8bit):	5.908378642611226
Encrypted:	false
SSDEEP:
MD5:	A8EFE2A017079497FE948191F8904A17
SHA1:	FD34EEB232B3FC8298FA86EE1E173825F655AAA3
SHA-256:	6E06D7662AE2D0A3EA0300D5FF305F7B2CD4BB95DE52DAE366C8D40670AC454D
SHA-512:	3749DBB059F2BE59451D2A782166A19DB1C53A356CACFFBC1855806E18CD33D1C4B2D77BBE71B896BB8CFF7914FFD028DB5E27D08A14883B9467315C0611368B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.>.V.m.V.m.V.m.V.m.V.m"Y.m.V.mbJ.m.V.m.I.m.V.m.I.m.V.m.I.m.V.m.p.m.V.m.V.m.W.m"Y.m.V.m.p.m.V.m&P.m.V.mRich.V.m........PE..L..._.&^.................p...p.......p............@.........................................................................h...........0...............P-..............................................................,............................text....h.......p.................. ..`.rdata........... ..................@..@.data...x'..........................@....rsrc...0........ ..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	325
Entropy (8bit):	7.20106642973316
Encrypted:	false
SSDEEP:
MD5:	67035D9C58C47711636B51DD93446FDB
SHA1:	47A6CD944187EE8DB6DAC222C38C7D175FB032B6
SHA-256:	1E34D78C2BF339A20867107244BDC5EBC36DFF14A36BB4ABAC133F89A41AC602
SHA-512:	B200DEF063446D2093D82AB67904307D4B1AF08E21E706EB2B64B4A2ECFDD90D7D7F05FDDC11BC66986ACFC7D4144530469B0C15D5C1A8B737AA2054DF943751
Malicious:	false
Reputation:	unknown
Preview:	........[....w..N&J...%.5P.IU..\|..$..y..d.+.`;.....0N7 .o...6t../....z.....J.yT...X.r..hl........ ....J.=.. ;..b.......K\{[p.......V..Od,..o..........@r...P.m.y..Ne?...a.... !..y..$....b.+.,^.....0N7c_....#...].L.....r.#g.H..........}.jy.....p;..V.#aXl. ;.......G..95.>........V..Od,..a...>.....h....A..N&

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\WizModernSmallImage-IS.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PC bitmap, Windows 3.x format, 55 x 55 x 8, image size 3080, resolution 2834 x 2834 px/m, cbSize 4158, bits offset 1078
Category:	dropped
Size (bytes):	4158
Entropy (8bit):	6.546195443722105
Encrypted:	false
SSDEEP:
MD5:	B747DC945B4672F955DB5F55CA163765
SHA1:	1F4C0C300123789EEB6EC87AC758EE747BC09FBB
SHA-256:	F6731FDA2D388389D74DE9A5961B6175EDC091F9DFD755D6D6C402621C5E1279
SHA-512:	70C391EB1F0B143414789BF28B9B2D1AC3866B844205D9B036FC98779CD9C2A631DFE634CE64EE057033DB99CF5091FFF97153CD0E0BD28FB9743D8F4AC7E71E
Malicious:	false
Reputation:	unknown
Preview:	BM>.......6...(...7...7...............................fe..................C=;.#....................................60.........................................................................................................................q...........................................................vM..J1..nJ..mI...3.nJ...5...0.wQ...7..<..@..B..B..;.oM..hH...9...L..I...R..d......{....................................................kE......;............P..m2...X..X...]..\..M..^.._...f..b...e.....m...............................................nfZ.......q....taD.....................................................eI..lP.......h.................................}ua.tm\.................to_....................UTE..................$Y...H...-..S...M...@...>...<...;...:...7...k...a..8...^....[...G...D...-r...:..C...<...;...H...=...Q...V...S..&\..5t../f..Co..P...]....@...:...."...................9.............................$$

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon32_v40.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93520
Entropy (8bit):	5.430937966579142
Encrypted:	false
SSDEEP:
MD5:	118B7719D2CCD16BFC258863FD1CCB46
SHA1:	1FEE24FC5C3B2C376B7F430D06C9C43BF4BC5A36
SHA-256:	C9965E33337D4CE50F40051EA0385F8FE6CB311A2C64DCCF1FECF367C52CE1C2
SHA-512:	E482D780ED9E0FBB1F408C8173E9ECC14EA50934C8770E2DF88E1A49F8593C8E7461979A2EFD3D3D19050E22676A0244162C69C08B6059094F950A5904192C59
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RerB............ "................A............. "..,....$......Rich............................PE..L.....]...........!.................q.......................................P..................................................d....................@..P-...0..(....................................................................................text............................... ..`.rdata........... ..................@..@.data....Z.......P..................@....reloc.......0... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon64_v40.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93008
Entropy (8bit):	6.099295993738916
Encrypted:	false
SSDEEP:
MD5:	F61F21FEECD660939F51765F31AC7A68
SHA1:	0D9601939D048463E3E13D32353FD64A2BCDFE26
SHA-256:	BA0102BB46557BB6DDB58482F7F12811DF772110CF9B2482F945F407106A1AC7
SHA-512:	0B3D31BF51D776430B31FC3736D116CC57839DF122704397F17DA606C9C59D2018E9CC6F57C2D4EF027A141735CBBE2C78FF536816FA7C3373489F9165886FB5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2.h.a.h.a.h.a...a.h.a...a.h.a...a.h.a.h.a.h.a...a.h.a...a.h.a...a.h.aRich.h.a................PE..d......].........." ................`............................................................................................... -...... ...d............`..p....>..P-...p..........................................................0............................text............................... ..`.rdata...M.......N..................@..@.data........0....... ..............@....pdata..p....`......................@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-2AGL8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64848
Entropy (8bit):	5.908378642611226
Encrypted:	false
SSDEEP:
MD5:	A8EFE2A017079497FE948191F8904A17
SHA1:	FD34EEB232B3FC8298FA86EE1E173825F655AAA3
SHA-256:	6E06D7662AE2D0A3EA0300D5FF305F7B2CD4BB95DE52DAE366C8D40670AC454D
SHA-512:	3749DBB059F2BE59451D2A782166A19DB1C53A356CACFFBC1855806E18CD33D1C4B2D77BBE71B896BB8CFF7914FFD028DB5E27D08A14883B9467315C0611368B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.>.V.m.V.m.V.m.V.m.V.m"Y.m.V.mbJ.m.V.m.I.m.V.m.I.m.V.m.I.m.V.m.p.m.V.m.V.m.W.m"Y.m.V.m.p.m.V.m&P.m.V.mRich.V.m........PE..L..._.&^.................p...p.......p............@.........................................................................h...........0...............P-..............................................................,............................text....h.......p.................. ..`.rdata........... ..................@..@.data...x'..........................@....rsrc...0........ ..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-39C8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36176
Entropy (8bit):	6.125794494968039
Encrypted:	false
SSDEEP:
MD5:	7B17AE1C9AED3C8C89FF6CDEF68F9FD5
SHA1:	409CFA7BE022E9ECEBFC03B031B1DB4CF795BF3B
SHA-256:	A7246D0AFF1BC7843BD345903A667974DB97E9B9D935679C7BFE587DE074D496
SHA-512:	D082DBD57460DEFF9B8E072479F5789C42F65EA9677BF7CE976C66F52EBF369253A6C941F09CE4ACD7F0073AEAD886E23970DF2CDC49E34A203C9DF397F7888E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E..$...$...$..\...$..\...$......$...$...$......$......$......$......$......$..Rich.$..........PE..d.....&^..........#.........T.......4........@.....................................D........................................................P..........8.......t....`..P-...........................................................@..`............................text....(......................... ..`.rdata.......@......................@..@.data...P#...`.......L..............@....pdata..t............N..............@..@.rsrc...8............P..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-5DJ27.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	325
Entropy (8bit):	7.20106642973316
Encrypted:	false
SSDEEP:
MD5:	67035D9C58C47711636B51DD93446FDB
SHA1:	47A6CD944187EE8DB6DAC222C38C7D175FB032B6
SHA-256:	1E34D78C2BF339A20867107244BDC5EBC36DFF14A36BB4ABAC133F89A41AC602
SHA-512:	B200DEF063446D2093D82AB67904307D4B1AF08E21E706EB2B64B4A2ECFDD90D7D7F05FDDC11BC66986ACFC7D4144530469B0C15D5C1A8B737AA2054DF943751
Malicious:	false
Reputation:	unknown
Preview:	........[....w..N&J...%.5P.IU..\|..$..y..d.+.`;.....0N7 .o...6t../....z.....J.yT...X.r..hl........ ....J.=.. ;..b.......K\{[p.......V..Od,..o..........@r...P.m.y..Ne?...a.... !..y..$....b.+.,^.....0N7c_....#...].L.....r.#g.H..........}.jy.....p;..V.#aXl. ;.......G..95.>........V..Od,..a...>.....h....A..N&

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-5QB8K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.139730271830087
Encrypted:	false
SSDEEP:
MD5:	FEF862EB25DFDC61A328B941960629EE
SHA1:	8E20F7C17D890545AA28C2BDAB1845C4DCE673A8
SHA-256:	C21B6FC73A4D92EE282C927699B892A8D7207AC1C78475A530C1D1E4264940D6
SHA-512:	52AB438CC25D63B5697E04F6B3840B7CD8FBAD637593DC3686EC0786786AFD70C9D0C2604850E5F5733C7D8A33AC5E687096698B9889EC39075A4CBC0D5713E9
Malicious:	false
Reputation:	unknown
Preview:	-sDEVICE=pdfwrite..-q..-dPDFSETTINGS=/prepress..-dAutoRotatePages=/All..-dCompatibilityLevel=1.4..-dNOPAUSE..-dBATCH..-dMonoImageFilter=/FlateEncode..-dEncodeMonoImages=true

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-AUL34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PC bitmap, Windows 3.x format, 55 x 55 x 8, image size 3080, resolution 2834 x 2834 px/m, cbSize 4158, bits offset 1078
Category:	dropped
Size (bytes):	4158
Entropy (8bit):	6.546195443722105
Encrypted:	false
SSDEEP:
MD5:	B747DC945B4672F955DB5F55CA163765
SHA1:	1F4C0C300123789EEB6EC87AC758EE747BC09FBB
SHA-256:	F6731FDA2D388389D74DE9A5961B6175EDC091F9DFD755D6D6C402621C5E1279
SHA-512:	70C391EB1F0B143414789BF28B9B2D1AC3866B844205D9B036FC98779CD9C2A631DFE634CE64EE057033DB99CF5091FFF97153CD0E0BD28FB9743D8F4AC7E71E
Malicious:	false
Reputation:	unknown
Preview:	BM>.......6...(...7...7...............................fe..................C=;.#....................................60.........................................................................................................................q...........................................................vM..J1..nJ..mI...3.nJ...5...0.wQ...7..<..@..B..B..;.oM..hH...9...L..I...R..d......{....................................................kE......;............P..m2...X..X...]..\..M..^.._...f..b...e.....m...............................................nfZ.......q....taD.....................................................eI..lP.......h.................................}ua.tm\.................to_....................UTE..................$Y...H...-..S...M...@...>...<...;...:...7...k...a..8...^....[...G...D...-r...:..C...<...;...H...=...Q...V...S..&\..5t../f..Co..P...]....@...:...."...................9.............................$$

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-ER5M7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138576
Entropy (8bit):	5.956624180380583
Encrypted:	false
SSDEEP:
MD5:	CB9A520B70BF242E8B41AD4F70D2BF46
SHA1:	5A3C0BD8C1133F45FA55E269284169549F1503E0
SHA-256:	AE7C73975E6C4DA06DC378D595CC0E71C482705242845FAB0FE3AF34E0DD875E
SHA-512:	3FFE489720AC481BA1E23DB013A45060495CABB3C43EF45F2F02C71CD59E75B457D81856445E96AD9E1F93B69AC0DE72DF13ADD9F8001D43112D9DDE2252052C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./%.tkD.'kD.'kD.'.[.'cD.'.[.'jD.'kD.'hD.'.K.'zD.'kD.'.E.'.X.'qD.']b.'.D.']b.'_D.'.B.'jD.'RichkD.'................PE..L.....].................@...........(.......P....@..........................0....................................................... ..................P-...........................................................P..X............................text....>.......@.................. ..`.rdata...K...P...P...P..............@..@.data....u.......@..................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-GF721.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8109283062792874
Encrypted:	false
SSDEEP:
MD5:	C442F0DC65635AD58F399894EF9D92CA
SHA1:	C1BBAB9E5FF16D34A0F09A0742F12B13DBB8E3DC
SHA-256:	78254629FE90C549B6E7B8901EB67D7A738CA6B57BA84656A3C00F0C088CE3BE
SHA-512:	A114017DACBC99254C6DD5C5B3222D61F83F765076A1268DBAECDBD614F6BB82B3B326F9379FE23F91ECED2B1F9FAFE413F52EAD9201B3E1320AC770EE20FEA7
Malicious:	false
Reputation:	unknown
Preview:	[Preferences]..Concurrent=1..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-HHT93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	642
Entropy (8bit):	4.905333753716299
Encrypted:	false
SSDEEP:
MD5:	D8385D9758B759942365B1ACC0E414FE
SHA1:	09EA59189959295B260B6165CAE34FED4EB33EEE
SHA-256:	278BCF994BFBD8C625E1FCC67610280200908BA984DC6C99DF5EBAF379754491
SHA-512:	5162CEBC3B4CEFF55818AF845E7174023F4ADB7FFD0B298D142590BA566BD09A25B80C4CF5E8368BEE75D26D8E58F3E4AF5527EBD935A17D5A63EDAB701ACCBB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> .. <assemblyIdentity version="3.0.0.1".. processorArchitecture="X86".. name="CPWSave".. type="win32"/> .. <description>CutePDF Writer Application</description> .. Identify the application security requirements. -->.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel.. level="asInvoker".. uiAccess="false"/>.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-ICRHC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5000016
Entropy (8bit):	6.969265682618029
Encrypted:	false
SSDEEP:
MD5:	493173739B3B0D330A3FEC50F5EE10E0
SHA1:	6243D31FBEAA2270615205943FD5719BE5D1B4D1
SHA-256:	8A6DA523F1E171EEEE2AD1ACA62D70C5ED29459DA8219B5A357CBE112F28C3A7
SHA-512:	22027A27B38D0DE38DDBBB7026439D41AE042C4BBB142EFC164458333B9DAC8E0173D4A6BDF9AF467063A71FD8E5AC3034693D99B163EB963F1980A2BF4D5C82
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........fj...9...9...9...8...9...8...9...8...9...8...9...8...9...8...9...8...9...8...9...9...9...9...9.."9...9.0e9...98..8...98..8...98..9...9...9...98..8...9Rich...9........................PE..L......e..................)..p".......%..........@...........................L.......M...@...................................0.\|.....2.h.............L.P-....I..... @..p....................A.......@..@..............d............................text.....).......)................. ..`.rdata........*.......).............@..@.data...L....01.......1.............@....rsrc...h.....2.......1.............@..@.reloc........I......DI.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-INHJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93008
Entropy (8bit):	6.099295993738916
Encrypted:	false
SSDEEP:
MD5:	F61F21FEECD660939F51765F31AC7A68
SHA1:	0D9601939D048463E3E13D32353FD64A2BCDFE26
SHA-256:	BA0102BB46557BB6DDB58482F7F12811DF772110CF9B2482F945F407106A1AC7
SHA-512:	0B3D31BF51D776430B31FC3736D116CC57839DF122704397F17DA606C9C59D2018E9CC6F57C2D4EF027A141735CBBE2C78FF536816FA7C3373489F9165886FB5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2.h.a.h.a.h.a...a.h.a...a.h.a...a.h.a.h.a.h.a...a.h.a...a.h.a...a.h.aRich.h.a................PE..d......].........." ................`............................................................................................... -...... ...d............`..p....>..P-...p..........................................................0............................text............................... ..`.rdata...M.......N..................@..@.data........0....... ..............@....pdata..p....`......................@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-KP2BA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8109283062792874
Encrypted:	false
SSDEEP:
MD5:	98D4F595778E7FD9C0D0FD54E4BE16A1
SHA1:	60DF3C869EB52F749D298B8ADA532076C2DFCC05
SHA-256:	CC7146A7DDE8BDAF039607DD230627D3B95DCAE75FE8222315B7DA02F1E1C11E
SHA-512:	ECB0227475F9E5042D99E1739B7623BB9247C13A9BD91078E007CFB6DF856DFBF928A480ADB6E481D2925808A04EF41F930B52696BE819637515C5C36B67ED48
Malicious:	false
Reputation:	unknown
Preview:	[Preferences]..Concurrent=0..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-LD694.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47952
Entropy (8bit):	6.092206964821143
Encrypted:	false
SSDEEP:
MD5:	E51710187732025BA13E1AB2B093CF50
SHA1:	A4EA6D9ACEFAEA9D33A99058AEA0FEF5F7DA8E53
SHA-256:	4694DC1D06A72BBA2DB202B86A18A74F9293520A9125229202671B09B3DB9497
SHA-512:	050C9470A6FAA47E70B30672FECAFF361DCCD62A17973CE4B94852359AB9622686A3A8879A96F94DAD02594942FF79B2835EA08C79EB96894587F961249C722C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w-=.3LSH3LSH3LSHe4=H0LSHe4(H1LSHE.(H"LSH3LRH.LSHE.>H8LSHE..H1LSHE.=H7LSHE./H2LSHE.+H2LSHRich3LSH................PE..d....8.^..........#......P...@.......[........@..............................................................................................y..........................P-...........................................................`...............................text...LO.......P.................. ..`.rdata...&...`...(...T..............@..@.data...@............\|..............@....pdata...............~..............@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-MC5O4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	HTML document, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5941
Entropy (8bit):	5.543261233847591
Encrypted:	false
SSDEEP:
MD5:	1444D84C8D78209F0BBAC83F2290EFB5
SHA1:	D414CA3330A30CA727DF7CA600017917B1E35F38
SHA-256:	61E862557C4032005457B16FC9D8E7F50A40C6686DFE159B156DE2A2F8713A45
SHA-512:	0783931ADFF1975A0CF3B9199B4F0FC4E3FDE4D2CAEE9D0F745BF891A4B0D7CD2B2296119FAF7BDE15893E2AAEDF4805DA3B02EC75F7C50F1D0E55D2058C3776
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<HTML><HEAD><TITLE>CutePDF Writer Readme</TITLE>..<META http-equiv=Content-Type content="text/html; charset=windows-1252">..<style type="Text/css" title="global">..BODY {...FONT-SIZE: 75%; BACKGROUND: #fffff4; LINE-HEIGHT: 125%; FONT-FAMILY: Verdana, Arial, Helvetica..}..A:link {...COLOR: #0000ff..}..A:active {...COLOR: #ff33cc..}..A:visited {...COLOR: #800080..}..H1 {...FONT-SIZE: 145%; MARGIN-BOTTOM: 0.5em..}..H2 {...MARGIN-TOP: 1.5em; FONT-SIZE: 125%; MARGIN-BOTTOM: 0.5em..}..H3 {...MARGIN-TOP: 1.2em; FONT-SIZE: 110%; MARGIN-BOTTOM: 0.5em..}..P {...MARGIN-TOP: 0pt; MARGIN-BOTTOM: 0pt..}..LI P {...MARGIN-TOP: 0.6em; MARGIN-BOTTOM: 0em..}..BIG {...FONT-WEIGHT: bold; FONT-SIZE: 105%..}..OL {...MARGIN-TOP: 0.5em; MARGIN-BOTTOM: 0em..}..UL {...MARGIN-TOP: 0.6em; MARGIN-BOTTOM: 0em; MARGIN-LEFT: 2.75em..}..OL UL {...MARGIN-TOP: 2em; LIST-STYLE-TYPE: disc..}..LI {...PADDING-BOTTOM: 0.7em; MARGIN-LEFT: -1.25em..}..DL UL {...MAR

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-O5QNJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 16x16
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	4.974114265981653
Encrypted:	false
SSDEEP:
MD5:	A68EF3A5FC089796C7275B46A3D5AA68
SHA1:	024380444D5C22BA6257AB46BF382998348F8208
SHA-256:	B24E29CDC992531DB2213E85F200E2E659EB78B0C91BFF9C657269DF7992B907
SHA-512:	8A5578D4EE7DD994040A28635F43E578DD36633E26EEB6AE7398CB2D9ACC6458107005B7103F8F1299443DBB68DFA1623C85E1FEF587CAF0B173C74656C8E864
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&...........h.......(... ...@...............................1)..H........t.........................................................................................k...........................k..s.....R..{s..1..............................1..9..........B...R...c......!...1..............................................J...B...................9........Z..1{..t....c...........B...t..H...9c.......J..1Z.......B..!R..Jk...1...){..1...B..)R..9Z..Bc.......)..1R..9Z..c{.......H...9..!B..Zk..BZ..Jc..JZ.......!...)..cs......Zk.......)..Rc..k{....k...s...k..!..!1....s...{.JZ..Rc..Zc..!1..9B..BJ..Zc..JR..RZ..s{..!){.9B..Zc..ck..ck..!)..!)..)1..JR..RZ............{...s...s...{...s.!!..!!{.))..))..11..99..11..JJ..RR..ZZ..ss......))1.............................ccc.999.111...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-PO6AU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93520
Entropy (8bit):	5.430937966579142
Encrypted:	false
SSDEEP:
MD5:	118B7719D2CCD16BFC258863FD1CCB46
SHA1:	1FEE24FC5C3B2C376B7F430D06C9C43BF4BC5A36
SHA-256:	C9965E33337D4CE50F40051EA0385F8FE6CB311A2C64DCCF1FECF367C52CE1C2
SHA-512:	E482D780ED9E0FBB1F408C8173E9ECC14EA50934C8770E2DF88E1A49F8593C8E7461979A2EFD3D3D19050E22676A0244162C69C08B6059094F950A5904192C59
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RerB............ "................A............. "..,....$......Rich............................PE..L.....]...........!.................q.......................................P..................................................d....................@..P-...0..(....................................................................................text............................... ..`.rdata........... ..................@..@.data....Z.......P..................@....reloc.......0... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-QV01T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64848
Entropy (8bit):	5.650785673620689
Encrypted:	false
SSDEEP:
MD5:	9EFEC9D941A823B786429C3DC2BE0163
SHA1:	17EB451C84E6F5DEC6E402967AB18C258558C162
SHA-256:	2ECAAB95A9772F669997D0FF6865B75DEFBEDD7CF6DD24BD8D04F408FD85D635
SHA-512:	CCDB6112F6F3DB49179968ACA77E609478529C78DDA5DD55E147EC779F86D54F806BC1FC9C9C07F0F018C15D18E543AAA17494818C4DD06D8F42EF70E8EED7CB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................9.....y....................}.......Rich............................PE..L...e.&^.................p...........0............@.................................G...................................................................P-...........................................................................................text....j.......p.................. ..`.rdata..............................@..@.data....a.......0..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\is-UFSC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44368
Entropy (8bit):	5.5629635646502145
Encrypted:	false
SSDEEP:
MD5:	4B2A60DAA4907AEF53792C3267A5A661
SHA1:	95E3D4EF32344930D8CBCDB1E8F4C669CD69298F
SHA-256:	94B9DDDA3B6425968DE362E0FADFBA721495C29C2291786090176632F2DD8CA2
SHA-512:	1214AB83DF4EA9CC945EFB810667B9674B5AAFA15CC83B1C46A2BDFBDDC32E9D47DAC4C66028121776D30561CA3CE3042745EFF63FC81CE03E574A1C0739A88E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9\|K4}.%g}.%g}.%g..+g..%g../gv.%g..!g..%gK;!g..%g}.$g..%g..xgr.%gK;.gz.%g..#g\|.%gRich}.%g........................PE..L....8.^.................@...0.......@.......P....@........................................................................0V.......p..................P-...........................................................P...............................text...R3.......@.................. ..`.rdata..2....P.......P..............@..@.data...\|....`.......`..............@....rsrc........p.......p..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\pdfwriter32.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44368
Entropy (8bit):	5.5629635646502145
Encrypted:	false
SSDEEP:
MD5:	4B2A60DAA4907AEF53792C3267A5A661
SHA1:	95E3D4EF32344930D8CBCDB1E8F4C669CD69298F
SHA-256:	94B9DDDA3B6425968DE362E0FADFBA721495C29C2291786090176632F2DD8CA2
SHA-512:	1214AB83DF4EA9CC945EFB810667B9674B5AAFA15CC83B1C46A2BDFBDDC32E9D47DAC4C66028121776D30561CA3CE3042745EFF63FC81CE03E574A1C0739A88E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9\|K4}.%g}.%g}.%g..+g..%g../gv.%g..!g..%gK;!g..%g}.$g..%g..xgr.%gK;.gz.%g..#g\|.%gRich}.%g........................PE..L....8.^.................@...0.......@.......P....@........................................................................0V.......p..................P-...........................................................P...............................text...R3.......@.................. ..`.rdata..2....P.......P..............@..@.data...\|....`.......`..............@....rsrc........p.......p..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\pdfwriter64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47952
Entropy (8bit):	6.092206964821143
Encrypted:	false
SSDEEP:
MD5:	E51710187732025BA13E1AB2B093CF50
SHA1:	A4EA6D9ACEFAEA9D33A99058AEA0FEF5F7DA8E53
SHA-256:	4694DC1D06A72BBA2DB202B86A18A74F9293520A9125229202671B09B3DB9497
SHA-512:	050C9470A6FAA47E70B30672FECAFF361DCCD62A17973CE4B94852359AB9622686A3A8879A96F94DAD02594942FF79B2835EA08C79EB96894587F961249C722C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w-=.3LSH3LSH3LSHe4=H0LSHe4(H1LSHE.(H"LSH3LRH.LSHE.>H8LSHE..H1LSHE.=H7LSHE./H2LSHE.+H2LSHRich3LSH................PE..d....8.^..........#......P...@.......[........@..............................................................................................y..........................P-...........................................................`...............................text...LO.......P.................. ..`.rdata...&...`...(...T..............@..@.data...@............\|..............@....pdata...............~..............@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\setup.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8109283062792874
Encrypted:	false
SSDEEP:
MD5:	98D4F595778E7FD9C0D0FD54E4BE16A1
SHA1:	60DF3C869EB52F749D298B8ADA532076C2DFCC05
SHA-256:	CC7146A7DDE8BDAF039607DD230627D3B95DCAE75FE8222315B7DA02F1E1C11E
SHA-512:	ECB0227475F9E5042D99E1739B7623BB9247C13A9BD91078E007CFB6DF856DFBF928A480ADB6E481D2925808A04EF41F930B52696BE819637515C5C36B67ED48
Malicious:	false
Reputation:	unknown
Preview:	[Preferences]..Concurrent=0..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\setup_svr.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8109283062792874
Encrypted:	false
SSDEEP:
MD5:	C442F0DC65635AD58F399894EF9D92CA
SHA1:	C1BBAB9E5FF16D34A0F09A0742F12B13DBB8E3DC
SHA-256:	78254629FE90C549B6E7B8901EB67D7A738CA6B57BA84656A3C00F0C088CE3BE
SHA-512:	A114017DACBC99254C6DD5C5B3222D61F83F765076A1268DBAECDBD614F6BB82B3B326F9379FE23F91ECED2B1F9FAFE413F52EAD9201B3E1320AC770EE20FEA7
Malicious:	false
Reputation:	unknown
Preview:	[Preferences]..Concurrent=1..

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64848
Entropy (8bit):	5.650785673620689
Encrypted:	false
SSDEEP:
MD5:	9EFEC9D941A823B786429C3DC2BE0163
SHA1:	17EB451C84E6F5DEC6E402967AB18C258558C162
SHA-256:	2ECAAB95A9772F669997D0FF6865B75DEFBEDD7CF6DD24BD8D04F408FD85D635
SHA-512:	CCDB6112F6F3DB49179968ACA77E609478529C78DDA5DD55E147EC779F86D54F806BC1FC9C9C07F0F018C15D18E543AAA17494818C4DD06D8F42EF70E8EED7CB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................9.....y....................}.......Rich............................PE..L...e.&^.................p...........0............@.................................G...................................................................P-...........................................................................................text....j.......p.................. ..`.rdata..............................@..@.data....a.......0..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36176
Entropy (8bit):	6.125794494968039
Encrypted:	false
SSDEEP:
MD5:	7B17AE1C9AED3C8C89FF6CDEF68F9FD5
SHA1:	409CFA7BE022E9ECEBFC03B031B1DB4CF795BF3B
SHA-256:	A7246D0AFF1BC7843BD345903A667974DB97E9B9D935679C7BFE587DE074D496
SHA-512:	D082DBD57460DEFF9B8E072479F5789C42F65EA9677BF7CE976C66F52EBF369253A6C941F09CE4ACD7F0073AEAD886E23970DF2CDC49E34A203C9DF397F7888E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E..$...$...$..\...$..\...$......$...$...$......$......$......$......$......$..Rich.$..........PE..d.....&^..........#.........T.......4........@.....................................D........................................................P..........8.......t....`..P-...........................................................@..`............................text....(......................... ..`.rdata.......@......................@..@.data...P#...`.......L..............@....pdata..t............N..............@..@.rsrc...8............P..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp

Download File

Process:	C:\Users\user\Desktop\CuteWriter.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	711168
Entropy (8bit):	6.513782388052726
Encrypted:	false
SSDEEP:
MD5:	FFCF263A020AA7794015AF0EDEE5DF0B
SHA1:	BCE1EB5F0EFB2C83F416B1782EA07C776666FDAB
SHA-256:	1D07CFB7104B85FC0DFFD761F6848AD176117E146BBB4079FE993EFA06B94C64
SHA-512:	49F2B062ADFB99C0C7F1012C56F0B52A8850D9F030CC32073B90025B372E4EB373F06A351E9B33264967427B8174C060C8A6110979F0EAF0872F7DA6D5E4308A
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&........................................................... ......................................................CODE....$........................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls.....................................rdata....... ......................@..P.reloc......0......................@..P.rsrc...............................@..P.....................f..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera browser.lnk

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Apr 17 19:42:21 2024, mtime=Wed Apr 17 19:42:21 2024, atime=Thu Apr 11 06:46:32 2024, length=1581984, window=hide
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	4.909321732813992
Encrypted:	false
SSDEEP:
MD5:	B372FB6372011621253BFC3F603E670C
SHA1:	8AD71EA23C496CB5DB96D230908A76D540C4480C
SHA-256:	7097A0DC59283DF93F5EAD232F61B1C14A2DFD4FEA69B2E85F5E9BA26BFA384B
SHA-512:	609D8F3DFE13D11CFC7F7CDD8E8706E1A3FFFB1ACC20DB75FB7144396B2727CBE81BF7B7B39C97807EC27AC6166455160EA1F6FF69F45334CBDE034B9422008F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....@......@.....z.G_....#........................:..DG..Yr?.D..U..k0.&...&......vk.v.......y.....e..........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.............................%..A.p.p.D.a.t.a...B.P.1......X....Local.<......CW.^.X......b.....................O&/.L.o.c.a.l.....Z.1......X...Programs..B......X...X............................:s.P.r.o.g.r.a.m.s.....P.1......XK...Opera.<......X*..XK......C......................9.O.p.e.r.a.....\.2..#...X.= .opera.exe.D......XK..XK............................=..o.p.e.r.a...e.x.e.......d...............-.......c..............o.....C:\Users\user\AppData\Local\Programs\Opera\opera.exe..$.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.\.o.p.e.r.a...e.x.e.+.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.............:...........\|....I.J.H..K..:...`.......X.......849224...........hT..CrF.f4... ..........,.......hT..CrF.f4... .....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera browser.lnk

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Apr 17 19:42:21 2024, mtime=Wed Apr 17 19:42:21 2024, atime=Thu Apr 11 06:46:32 2024, length=1581984, window=hide
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	4.909321732813992
Encrypted:	false
SSDEEP:
MD5:	B372FB6372011621253BFC3F603E670C
SHA1:	8AD71EA23C496CB5DB96D230908A76D540C4480C
SHA-256:	7097A0DC59283DF93F5EAD232F61B1C14A2DFD4FEA69B2E85F5E9BA26BFA384B
SHA-512:	609D8F3DFE13D11CFC7F7CDD8E8706E1A3FFFB1ACC20DB75FB7144396B2727CBE81BF7B7B39C97807EC27AC6166455160EA1F6FF69F45334CBDE034B9422008F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....@......@.....z.G_....#........................:..DG..Yr?.D..U..k0.&...&......vk.v.......y.....e..........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.............................%..A.p.p.D.a.t.a...B.P.1......X....Local.<......CW.^.X......b.....................O&/.L.o.c.a.l.....Z.1......X...Programs..B......X...X............................:s.P.r.o.g.r.a.m.s.....P.1......XK...Opera.<......X*..XK......C......................9.O.p.e.r.a.....\.2..#...X.= .opera.exe.D......XK..XK............................=..o.p.e.r.a...e.x.e.......d...............-.......c..............o.....C:\Users\user\AppData\Local\Programs\Opera\opera.exe..$.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.\.o.p.e.r.a...e.x.e.+.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.............:...........\|....I.J.H..K..:...`.......X.......849224...........hT..CrF.f4... ..........,.......hT..CrF.f4... .....

C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.39546184423832
Encrypted:	false
SSDEEP:
MD5:	0AFB946C9D1B7415643D6DED4E481B0C
SHA1:	051DB756BE1705C976D851D02732FB6271965FC6
SHA-256:	284060B514EEF1800D94D6581C3A6C8775DB6A1E54FE5F7D553D31F7DFDA1022
SHA-512:	49AA7124315341F55EC6553AE0F3E0380EFBA2BCA28497F8FC7DEA599F9DD18FACE49300412ABF17BF9D9651EF2C2E3223B42FBF3AA5020A8AFB28FF211056CB
Malicious:	false
Reputation:	unknown
Preview:	sdPC..........................qJ..&.V..v

C:\Users\user\Desktop\Opera browser.lnk

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Apr 17 19:42:21 2024, mtime=Wed Apr 17 19:42:21 2024, atime=Thu Apr 11 06:46:32 2024, length=1581984, window=hide
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	4.909321732813992
Encrypted:	false
SSDEEP:
MD5:	B372FB6372011621253BFC3F603E670C
SHA1:	8AD71EA23C496CB5DB96D230908A76D540C4480C
SHA-256:	7097A0DC59283DF93F5EAD232F61B1C14A2DFD4FEA69B2E85F5E9BA26BFA384B
SHA-512:	609D8F3DFE13D11CFC7F7CDD8E8706E1A3FFFB1ACC20DB75FB7144396B2727CBE81BF7B7B39C97807EC27AC6166455160EA1F6FF69F45334CBDE034B9422008F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....@......@.....z.G_....#........................:..DG..Yr?.D..U..k0.&...&......vk.v.......y.....e..........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.............................%..A.p.p.D.a.t.a...B.P.1......X....Local.<......CW.^.X......b.....................O&/.L.o.c.a.l.....Z.1......X...Programs..B......X...X............................:s.P.r.o.g.r.a.m.s.....P.1......XK...Opera.<......X*..XK......C......................9.O.p.e.r.a.....\.2..#...X.= .opera.exe.D......XK..XK............................=..o.p.e.r.a...e.x.e.......d...............-.......c..............o.....C:\Users\user\AppData\Local\Programs\Opera\opera.exe..$.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.\.o.p.e.r.a...e.x.e.+.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a.............:...........\|....I.J.H..K..:...`.......X.......849224...........hT..CrF.f4... ..........,.......hT..CrF.f4... .....

C:\Windows\System32\cpwmon64_v40.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93008
Entropy (8bit):	6.099295993738916
Encrypted:	false
SSDEEP:
MD5:	F61F21FEECD660939F51765F31AC7A68
SHA1:	0D9601939D048463E3E13D32353FD64A2BCDFE26
SHA-256:	BA0102BB46557BB6DDB58482F7F12811DF772110CF9B2482F945F407106A1AC7
SHA-512:	0B3D31BF51D776430B31FC3736D116CC57839DF122704397F17DA606C9C59D2018E9CC6F57C2D4EF027A141735CBBE2C78FF536816FA7C3373489F9165886FB5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2.h.a.h.a.h.a...a.h.a...a.h.a...a.h.a.h.a.h.a...a.h.a...a.h.a...a.h.aRich.h.a................PE..d......].........." ................`............................................................................................... -...... ...d............`..p....>..P-...p..........................................................0............................text............................... ..`.rdata...M.......N..................@..@.data........0....... ..............@....pdata..p....`......................@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\spool\drivers\x64\CUTEPDFW.PPD

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	31736
Entropy (8bit):	5.360568407736167
Encrypted:	false
SSDEEP:
MD5:	4C4C993507312E1D744EAF74C878BA1D
SHA1:	5E88BFD6FE9C79389C7206FF8907E7969EAEB1B5
SHA-256:	454216087ACA9C7A3326BB247B84C782281C5E71AE43EE8A977A480B0FA4ED25
SHA-512:	79494149692FB5804FD5A64A0F31DC4C79DCC4E717FB15D23A9A03901FF6E701D2B76431BECF1CF49EB57BE0F9727B4589E05C3A23FF85D6C52D03D5C72F6C56
Malicious:	false
Reputation:	unknown
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 2008 CUTEPDF..% All Rights Reserved. ..% Permission is granted for redistribution of this file as..% long as this copyright notice is intact and the contents..% of the file is not altered in any way from its original form...% End of Copyright statement....FormatVersion: "4.3"..FileVersion: "1.0"..LanguageEncoding: ISOLatin1..LanguageVersion: English..PCFileName: "cutepdfw.ppd"..Manufacturer: "CUTEPDF"..Product: "(CutePDF Writer)"..PSVersion: "(2014.108) 0"..ModelName: "CutePDF Writer"..ShortNickName: "CutePDF Writer"..NickName: "CutePDF Writer"....% === Options and Constraints =========....% ==== Device Capabilities ===============..ColorDevice: True..DefaultColorSpace: RGB..FileSystem: True..?FileSystem: "(True) == flush"..LanguageLevel: "3"..FreeVM: "4194304"..VMOption None/Standard: "4194304"..FCacheSize None/Standard: 204800..Throughput: "400"..*VariablePaperSize: Tru

C:\Windows\System32\spool\drivers\x64\PS5UI.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	850432
Entropy (8bit):	5.950880465848191
Encrypted:	false
SSDEEP:
MD5:	1EDE62E047F4BB3D0398EBA367C16484
SHA1:	99B797B6B70EE104B725F71A2E716DFD1FC6E808
SHA-256:	277D1DA8C6FD51C3CC958A459ECC18BA5551ADBC1C1D8588082C9583324C8953
SHA-512:	02A0B9B9F1307DE817E7CD90083C0823818E5BD8C8ACF2A78442050F87BA6C4EA288D96E05B1AD803428BDF7319C3C081320867319F28A15E157B2DD28C6AB55
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2$..vE..vE..vE..Q..wE..Q..yE..vE...E..Q...gE..Q..ME..Q...wE..Q...E..Q..wE..Q..wE..Q..wE..RichvE..........................PE..d.....IE.........." ...........................K............................. ......Zn....@.............................................:................_...p..\|/..................@................................................................................text...*........................... ..`.data...pL... ...F..................@....pdata..\|/...p...0...V..............@..@.rsrc....`.......`..................@..@.reloc..R...........................@..B..IEX...r.IEc...4.IEm.....IEx...(.IE....r.IEc...6.IE....\|.IE....s.IE......IE............msvcrt.dll.NTDLL.DLL.USER32.dll.ole32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll..........................................................................................

C:\Windows\System32\spool\drivers\x64\PSCRIPT.HLP

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:49 2001, 26038 bytes
Category:	dropped
Size (bytes):	26038
Entropy (8bit):	4.55580668806265
Encrypted:	false
SSDEEP:
MD5:	02C3F8C32018F3AAF66E7421400F1781
SHA1:	A04F2E40287AF78867161FA3F1606045088DA212
SHA-256:	6FAEF4C998E810FFF139958F28722C79879EC2FD66C97C7E3E2C5040FD5550D9
SHA-512:	C30FEE64D74A536117DE46C81B6E22EC82634D1284783A317BC15E85CFD561FAD7D50A63CA863EA6520B5CBAECF9061F7B52D3D99050484CE8A004F81DAB7990
Malicious:	false
Reputation:	unknown
Preview:	?_..J........e..:...1.....(),.aadv@ancedA.@a.ndareasa ssign..ut.omaticav.ailableb.ebitmapb oxbyc<.ha.ngeclick@Commun+.t.ionscomp.uterconn.ectedCTR.Ldefault.dependin@gdialo..f.ferentdiFr.=.disl.d docum..owpnloa...0..r.iverEdge.e..n. erro.rexample.featuref.i..ine-tu@nefont..s@forFor..m...-to-tra.y..atfrom.Generall.ygraphic.s..yIfima.geinin.....telyin50..(isl..u".le.tslevelL.istsmaym.S.....memor...ta....j.gb..vr.tworko...onlyop...t$.Optimi8zeo..... so.routl....g..p..pa1.pa.. elpla..Po.stScript.P..c.cesprHint. ed.0r..@-specif\ic.@0..P.@p.rovi}.rel.. resetr...rs..s..ctsq..ser......s@houlds..s@ourceSd0e.sm0yspoo...gsuchtha@ttheTh8.h...ghtoTru.eTyph.m.g...us..>.want.Whenw. e8..rw..hwill.wt.Yesyou...r),).+-.011.3Aal.waysanan.yASCIIat*a..b..r..st.binaryB. ...B.2."sboo2k..ca...2sC.."los........`ntrol....t.cR.tecur...cusS.CutDjdw.D.Rn..H.y.fi...sfarf-..F....g..avpehig... ".o.w..tItits.job..slon.gL..m%.man.ualmaximXummp...m?.tVm....i0.No.tbO..onek...O.T"PT"..pixe2l..rt..@2sP.rotocolR@GBRoll..l.s

C:\Windows\System32\spool\drivers\x64\PSCRIPT.NTF

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1062732
Entropy (8bit):	5.327224938603629
Encrypted:	false
SSDEEP:
MD5:	C18E8DA3F5C91760E00DFAE8B6364BED
SHA1:	566D28948DAE855C8E5F560EAD7E0D8CC73DC1D5
SHA-256:	F49C950531E485BBC4B35161CF049ADF8363D0BD222CFED2EEDE2A13FE418187
SHA-512:	65C7F8C129D71DE9B887B5741760D86955035F977B32B89CF43A31EB973178AF6BAE1E5D39DCA19B56F6BB0139634F44E90C31CFAC00F75E64908D7B36A75D3A
Malicious:	false
Reputation:	unknown
Preview:	1FTNSPTN............................0...........@$......x....$...................&...........&...................,......T....,..................$/......L.......................p1..Q.......@1..................,4..1........3...................6..5...<....6...................8...........8...................@...........@...................K......d....K..................LN..q5..\|....N...................P..q........P...................V....1.....\V...................Y..r.k.....\Y...................a...........a..................Xo......d....n...................x..m...P...4x......................y........~....................._...4...\.......................l...........................4...............................D..........................................P..............................`...............................8.......................}...P...................................d...............................l...............................\|.......................m...................

C:\Windows\System32\spool\drivers\x64\PSCRIPT5.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	628736
Entropy (8bit):	6.679545194217932
Encrypted:	false
SSDEEP:
MD5:	FB270D281F4929B9E0894AFC816C9DBE
SHA1:	370EC45A41CF15097B7B2FC14A217A739ECB675B
SHA-256:	9F0DC9C094AE73AA052817E0233F5DEB5C18C7C8EF63733E95D4CDE65E0386F0
SHA-512:	E4B6E6C80043AB86A00D674ED3A636EA15249FF956C95730C203E0EECC263D19217DE720082531A1A51CC3B752E3EEAD64DF43E0C3425F9E49B807FC62A71C24
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.ye"..6"..6"..6.gj6#..6.gy6-..6"..6..6.gl63..6.gz6...6.gm6#..6.gf6l..6.gi6#..6.gk6#..6.go6#..6Rich"..6........PE..d.....IE.........." ...........................G....................................\|P....@.........................................P........................p...(.................. ................................................................................text............................... ..`.data....I... ...D..................@....pdata...(...p...*...L..............@..@.rsrc................v..............@..@.reloc..B...........................@..B..IEX...r.IEc...r.IEc...\|.IEm...(.IEz...r.IEc...s.IE....4.IE......IE......IE............msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.GDI32.dll.USER32.dll.mscms.dll.ole32.dll.........................................................................................................................

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
Category:	downloaded
Size (bytes):	34108
Entropy (8bit):	7.993096562158293
Encrypted:	true
SSDEEP:
MD5:	C15D33A9508923BE839D315A999AB9C7
SHA1:	D17F6E786A1464E13D4EC8E842F4EB121B103842
SHA-256:	65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
SHA-512:	959490E7AE26D4821170482D302E8772DD641FFBBE08CFEE47F3AA2D7B1126DCCD6DEC5F1448CA71A4A8602981966EF8790AE0077429857367A33718B5097D06
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2.......<..........................................\..4?HVAR.t.`?STAT..'...J/<.....`..(..Z.0..,.6.$.... ..B..K..[.h...c.....nC .../.V.v..6>nT.R...b.8.@.......ON.ch.......k..."..".9..\D...JBJ."T%5...Z2..Q.)wJ...sA.h..m....n..F.....t..ig.=..y.s@............t..j.....n.h(...........N..)9.....v`\|z....8.7..kTq....^.......[.K.O..1ZP.....;.HP.......>..+..j:.V.......A......[.f.l..v`x....F_..vo...e....n...H..X.2.v}...(.1J...x.....}.....5.3.....?..?..7...S..0.9..C.0.M..M9..e.b....bc..b4.0"e.G.....XT....z............E'c.(."...x`].]..e.rQ..ye.z........kFh;....Y.yPt.._Q.._-q..mi.Og.W.-qUI...m5..r.mvA~o....S.f........s..ql.aXD...H..wy.P..k...f$.V^.2...8U{...f.....]]..G..cf.......D.c&B'S.2~..N..........R;..).5...../... 6....b....]d6."C..T..........OI\+V'...E.[.g.u.E....,!F.....*U.q. :x.s..1..C....H..S%..)....h......K..........pw.f...f.......an3....9....@......%.2.c.+........cXD..F...B.....0'...O.z8.B....4...\..&c...H....;..p....@.l...:........L..`...5..xo&.

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16x16
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	4.974114265981653
Encrypted:	false
SSDEEP:
MD5:	A68EF3A5FC089796C7275B46A3D5AA68
SHA1:	024380444D5C22BA6257AB46BF382998348F8208
SHA-256:	B24E29CDC992531DB2213E85F200E2E659EB78B0C91BFF9C657269DF7992B907
SHA-512:	8A5578D4EE7DD994040A28635F43E578DD36633E26EEB6AE7398CB2D9ACC6458107005B7103F8F1299443DBB68DFA1623C85E1FEF587CAF0B173C74656C8E864
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&...........h.......(... ...@...............................1)..H........t.........................................................................................k...........................k..s.....R..{s..1..............................1..9..........B...R...c......!...1..............................................J...B...................9........Z..1{..t....c...........B...t..H...9c.......J..1Z.......B..!R..Jk...1...){..1...B..)R..9Z..Bc.......)..1R..9Z..c{.......H...9..!B..Zk..BZ..Jc..JZ.......!...)..cs......Zk.......)..Rc..k{....k...s...k..!..!1....s...{.JZ..Rc..Zc..!1..9B..BJ..Zc..JR..RZ..s{..!){.9B..Zc..ck..ck..!)..!)..)1..JR..RZ............{...s...s...{...s.!!..!!{.))..))..11..99..11..JJ..RR..ZZ..ss......))1.............................ccc.999.111...............................................................................................................................................................................

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x52, components 3
Category:	downloaded
Size (bytes):	614
Entropy (8bit):	6.3992707733074985
Encrypted:	false
SSDEEP:
MD5:	5E92E73749ECAF1F0C042272DC337971
SHA1:	09DB2F0BEDF5FB5FCE02D9684A2654C6E12CFD84
SHA-256:	9080ED8FA20AB424C05F8B02E0318C4DFBC7552593D2AF3D3B38369F9E066DC5
SHA-512:	94F08002912227625CDF4E481C358A1BCBC5606AF24338CD61F0F473ACCE3DC07531E6B6AAF1CDEE2F8F08AA57E69A984F0BFC0CBF17BFD17208070C4F369EB7
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/simgad/2267357562213314202/14763004658117789537?w=100&h=100&tw=1&q=75
Preview:	......JFIF................................................. $.' .,#.. +.,01464.'-=,01.34&...........2!.!22'000022&2.23/30,&2332-2&22,232.00)2&,3'-2/2-&)......4.d.."......................................+...........................1ATq...!Q...B.............................%.........................!1....2qr.............?....................*.?Q2.#..oQ.9..oT....C..r......+..w..g.....'.....Og9U?.j\|..).e/...]>.................~.....^......m;+.sv...i.g......Y.c:1..:L=......G^.Sw......4..?q.....=W.'......\..'.a....P..V...........h'..((...<qY.t.RX...b....JL.bg..0.................................

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1054)
Category:	downloaded
Size (bytes):	2689
Entropy (8bit):	5.40021492400263
Encrypted:	false
SSDEEP:
MD5:	9EF158292B617D358506529B02C73629
SHA1:	843852D8ADDBF1A7F96C5607179E1C9423ED8A4C
SHA-256:	3164DB7EF9EFC7121CE85192340A653C6CB87E34CAA05849C8FD47B7872F9FC5
SHA-512:	D4B0E6E8900043C9C4EE010ABFD00A51D891FE4B4F424418DC1A75075E3DF931D0558BFB3E983190079EDDD0BF11D7604E70CEAF119351690812EBC21D7EAEB8
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/window_focus_fy2021.js
Preview:	(function(){'use strict';function f(a,b,e){a.addEventListener&&a.addEventListener(b,e,!1)};/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .function g(a,b,e){if(Array.isArray(b))for(var c=0;c<b.length;c++)g(a,String(b[c]),e);else null!=b&&e.push(a+(""===b?"":"="+encodeURIComponent(String(b))))};function l(a=document){return a.createElement("img")};function m(a,b,e=null,c=!1){n(a,b,e,c)}function n(a,b,e,c){a.google_image_requests\|\|(a.google_image_requests=[]);const d=l(a.document);if(e\|\|c){const k=h=>{e&&e(h);if(c){h=a.google_image_requests;const v=Array.prototype.indexOf.call(h,d,void 0);0<=v&&Array.prototype.splice.call(h,v,1)}d.removeEventListener&&d.removeEventListener("load",k,!1);d.removeEventListener&&d.removeEventListener("error",k,!1)};f(d,"load",k);f(d,"error",k)}d.src=b;a.google_image_requests.push(d)};function p(a=null){return a&&"22"===a.getAttribute("data-jc")?a:document.querySelector('[data-jc="22"]')};var q=document,r=window;functi

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 450 x 314
Category:	downloaded
Size (bytes):	48015
Entropy (8bit):	7.931789206969988
Encrypted:	false
SSDEEP:
MD5:	4A9EE6787CBA9FC64927EF4A75C172EC
SHA1:	D9BFE7778BD16571D84058BB47D221A8BB254BC9
SHA-256:	EE172F27571E2E184509331861C167A80016B95E7E9229D3606A8D7E999D870F
SHA-512:	DF29AA36E4668EEBE338204FA7969CEBCDF5012CA5FAE97B48EEDB4E60D4849F0A841BD87DB19C9663D0B8D5D404B677D3BCE799ECD34D46FDE52325969C0F7D
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/PrintDialogBox.gif
Preview:	GIF89a..:.............111ccc.......................................{{...B99...)!!cJJ{ZZ1!!J11c99..kc............ZJ.J9.B1.{s.kc.s.J1.{s.sZ..{cB9.kckRJ..s.cR...kZR.{k{ZJ.cRZ)........{.....s.kR{R9.kZ.{cZB1..s.{............{....{........s...s.{Z.sR............{.......s......{............R..............................k.......).Jc..B.k{.......B.kZ.......Rsk.........s{{kss...Zss{.....{...R..B.........R..9........9...9R...s..k....{...Js.........s........s..!9J.....9Zs1........R..k........s..Zk{Rcs1BRc..1........k{.........{..Zs.Z{.k..9RkBc.)R{B..RZcs..B...........s....{..k..c{.Jc....c..9JcZ{....k..Zs.Rk.Zcs{.....s{.ks....cs.BR{Rk.RZs)1J!)B9J.s{.ck.BJk......ss{RRZZZkss.{{....JJcss.1)BB9J.k....RJRJBJ.{.sZs1!1.s..k..ZsRBJcRZ.Zk.k{.cs.ks...,......:.@.....0g.O9...L.p....I.hPb..3b.1...A..I...(;FL..K..Gr...&.............J........@9....a....R..`......4...AYL...%Km.jC....].t...TKm_.....[.0....+^..c..j.l..0[.9..3..Cq.....M...z..P.a.N]....

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 596 x 533, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	11582
Entropy (8bit):	7.752501554292733
Encrypted:	false
SSDEEP:
MD5:	B1CF0A0668C0D09C3EC78B161E964464
SHA1:	90310830F88F0493EAA1F9DC7B4CA00F9DC2C039
SHA-256:	E5D09079353BDB2F3D4B06CD6F8B0C8B9E14DB7190E897EA83502ECC1F78D727
SHA-512:	63FC557CE2AFD07EABE7D1086FE0344526F7F81E55E1B19BA60024A91FA2DFA46157A13B99745359AABC7BBE43319B45E17C6FE14E21C8D86675AF21750F6F06
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...T.................sRGB.........gAMA......a.....pHYs...t...t..f.x..,.IDATx^....F....6T\|....@...k'6`.up.,......7~...8<\....7...N.tb...M....9../...bw....$...+.E.....{Z..{.....;... ~....?.@u....:...P.........T.....C....!~....?.@u....:...0w......ng@.R'......o........{..~F.,~Z.%=.s{....d...:...E..M.r.h.zG....?M....<....\r....O.c...y.?)...?.8C/u..I...Y..Q}.....2G..q......z..8.4..Oe'.G.~.^...K1.v{..&.c4...;.L..W..................6x~......Q.....h...v.....%=.3......k..{.;...s.vl.;.?.#...=..$.!3K.....N.{..^z.p....J...{.=Em..._.J...]...P\|~0{\|.`.]._.].7....]......K.......U.............@m...O......+.8..kz0{\|`dO..g.._..yJ<S(..;'.J...Yt3..n......T.)......6.T...~..kt.p{,qH.W.......J.2.^{y<Sh.H<U..u....U...3.".:=.......>.^ow....,..p........b..48..K../3<-.)4rd\|+8.f.N...W9..J."......g..:.O..9x......_/..>.W..........N..Z...fs..._f.*...P\|./.jx..O...{....T.y..;1..vh0........9t...$...^N..n....?..&....{^;.L..=.A.../<...2.)...3C..3z..~.Z..

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (786)
Category:	downloaded
Size (bytes):	1672
Entropy (8bit):	5.287698118276452
Encrypted:	false
SSDEEP:
MD5:	391C73545274E78E6615C6449FF6FF1D
SHA1:	C9D581335ABDBFD51679827E8B24F9896CA1DA16
SHA-256:	41D2526E9C4595FC1FC747555BDA18A041033A863A9B2ED180E7B5836918FACD
SHA-512:	843D8CC8703AA9808F7D9807AB4CB24795279A015F1EEB2632C0A289C0427157FEDE3BB988FF857DC994BAD22EC5CA83654B6FBF0FA24390E14816F66072ECAB
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/load_preloaded_resource_fy2021.js
Preview:	(function(){'use strict';let e=[];const f=()=>{const a=e;e=[];for(const b of a)try{b()}catch{}};function g(a=document){return a.createElement("img")};function h(a=null){return a&&"26"===a.getAttribute("data-jc")?a:document.querySelector('[data-jc="26"]')};var k=document;/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var m=()=>{var a=k.querySelectorAll("link[data-reload-stylesheet][as=style][rel=preload]");for(var b=0;b<a.length;b++){var c=a[b],d="link",l=document;d=String(d);"application/xhtml+xml"===l.contentType&&(d=d.toLowerCase());d=l.createElement(d);d.setAttribute("rel","stylesheet");d.setAttribute("href",c.getAttribute("href"));k.head.appendChild(d)}if(0<a.length&&!(.01<Math.random())){a=(a=h(document.currentScript))&&"true"===a.getAttribute("data-jc-rcd")?"pagead2.googlesyndication-cn.com":"pagead2.googlesyndication.com"; .b=(b=h(document.currentScript))&&b.getAttribute("data-jc-version")\|\|"unknown";a=`https://${a}/pagead/gen_204?id=jca

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	119264
Entropy (8bit):	6.091114697140281
Encrypted:	false
SSDEEP:
MD5:	49287DAA133B0E34EA5104A2ECDDD2B5
SHA1:	42FFDD821570220D0C37D9AB27200520428740EC
SHA-256:	FDF9451D6E106350F668EFD0C7DF7B1CEB0B3F4CDEB25EC870867867B332055A
SHA-512:	A8F916F6558E09B82C0C244220655911B582824A58963CF8943625AF7AB73104CAA5F4E5E06AAC8CF02983374C7D05C3E2E47D44F43DAEF8011B7CDC2E3F6C0B
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=280&slotname=4387574616&adk=1818151991&adf=1925678805&pi=t.ma~as.4387574616&w=336&lmt=1713386480&format=336x280&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479209&bpp=1&bdt=1019&idt=1068&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90%2C160x600&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=464&ady=1814&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=1072
Preview:	<!DOCTYPE html><html lang=en><head><meta charset="UTF-8"><script>var jscVersion = 'r20240416';</script><script>var google_casm=[];</script><style>HTML,BODY{height:100%;width:100%;margin:0;padding:0;overflow:hidden;}#mys-wrapper{height: 100%;width:100%;overflow:hidden;position: absolute;top:0;left:0;align-items: center;display:flex;justify-content:center;line-height:normal;}#mys-overlay{height:100%;width:100%;overflow:hidden;position:absolute;top:0;left:0;box-sizing:border-box;pointer-events:none;z-index:1;display:none;}.mys-wrapper A,.mys-wrapper A:visited,.mys-wrapper A:hover,.mys-wrapper A:active{color:inherit;cursor:pointer;text-decoration:inherit;}[dir=rtl] .flip-on-rtl{transform:scale(-1,1);transform-origin:center;}#mys-content{flex-shrink:0;position:relative;overflow:hidden;z-index:0;}</style><style data-nl="square-lola" data-ns="ns-r5dym" x-phase="assemble">.ns-r5dym-l-square-lola{opacity:.01;position:absolute;top:0;left:0;display:block;width:336px;height:280px;}.ns-r5dym-e-0{li

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	14579
Entropy (8bit):	5.61070345998479
Encrypted:	false
SSDEEP:
MD5:	1645C7E7BC7FEFF6E6AAE044BB82AC1B
SHA1:	FFD3C8ABFEBA7955C29614600AB20C45FBB3771C
SHA-256:	A6EE58F60C407B083623FDC4586AE66D10F4586920A825A74E26762BC262EEFD
SHA-512:	36083A8368A564568D8A69778AEB25BA849374606018C6186DC785B9F9609F14A0B2C89AEF06725A9FBC1285D8F05F4DDEDEF01D6AD24CBCC1B568C4BAA4AB6E
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2950)
Category:	downloaded
Size (bytes):	15197
Entropy (8bit):	5.488665943966329
Encrypted:	false
SSDEEP:
MD5:	732405998536FE484EA49DBE7C6E6E5A
SHA1:	D6033F261F431D5E22A202CC171F72190A55A140
SHA-256:	8C04B9A14B5022B429617794E8732840D0CE3BA0E1A77CC296BAD062850ACF84
SHA-512:	E23156B5BC594E10BC81EF0E616394709046BA4C2013E417AC95285A5D0F5A3B2EFBF9FF180B437E6EBD91FBE327EF691D5153ABD22160D953E7D5F5237064F6
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/fullscreen_api_adapter_fy2021.js
Preview:	(function(){'use strict';/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var n=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=n,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1};var ba=aa(610401301),ca=aa(188588736);var r;const ia=n.navigator;r=ia?ia.userAgentData\|\|null:null;function t(a){return ba?r?r.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function u(a){var b;a:{if(b=n.navigator)if(b=b.userAgent)break a;b=""}return-1!=b.indexOf(a)};function w(){return ba?!!r&&0<r.brands.length:!1}function A(){return w()?t("Chromium"):(u("Chrome")\|\|u("CriOS"))&&!(w()?0:u("Edge"))\|\|u("Silk")};function B(a){B[" "](a);return a}B[" "]=function(){};!u("Android")\|\|A();A();u("Safari")&&(A()\|\|(w()?0:u("Coast"))\|\|(w()?0:u("Opera"))\|\|(w()?0:u("Edge"))\|\|(w()?t("Microsoft Edge"):u("Edg/"))\|\|w()&&t("Opera"));var D=Symbol();var ja={},ka={};function la(a){return!(!a\|\|"object"!==typeof a\|\|a.g!==ka)}function E

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, ASCII text, with very long lines (3386)
Category:	downloaded
Size (bytes):	9113
Entropy (8bit):	5.5214288883148
Encrypted:	false
SSDEEP:
MD5:	53F140417DA1E44C588A037ABD5527EB
SHA1:	DB0FAFE6C8F288A00BBF655EBDBB3FD0C8699DA1
SHA-256:	DF7A397B8CE58F6251A395E02608B4F620E934A958BDFE6702C6F2033593EED0
SHA-512:	8F4CA1E0FE1820786ED41B2D41C9444B65A605C7B4C5D6291682D3F2883D9E10175C347C93E159D0939D0CC9379B06D0ADCE431100AD08D061FE1654445EC5D1
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/html/r20240415/r20110914/zrt_lookup_fy2021.html
Preview:	<!DOCTYPE html><script>.(function(){'use strict';/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var k=this\|\|self;function m(a){return a};var n,v;a:{for(var ca=["CLOSURE_FLAGS"],z=k,A=0;A<ca.length;A++)if(z=z[ca[A]],null==z){v=null;break a}v=z}var da=v&&v[610401301];n=null!=da?da:!1;function ea(){var a=k.navigator;return a&&(a=a.userAgent)?a:""}var B;const fa=k.navigator;B=fa?fa.userAgentData\|\|null:null;function C(a){return n?B?B.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function E(a){return-1!=ea().indexOf(a)};function F(){return n?!!B&&0<B.brands.length:!1}function G(){return F()?C("Chromium"):(E("Chrome")\|\|E("CriOS"))&&!(F()?0:E("Edge"))\|\|E("Silk")};function ha(a,b){Array.prototype.forEach.call(a,b,void 0)};function H(a){H[" "](a);return a}H[" "]=function(){};var ia=-1!=ea().toLowerCase().indexOf("webkit")&&!E("Edge");!E("Android")\|\|G();G();E("Safari")&&(G()\|\|(F()?0:E("Coast"))\|\|(F()?0:E("Opera"))\|\|(F()?0:E("Edge"))\|\|(F()?C("Microsoft Ed

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2364)
Category:	downloaded
Size (bytes):	36805
Entropy (8bit):	5.515105666626405
Encrypted:	false
SSDEEP:
MD5:	2CED7D23180E5DE68BAF5D8FF496EB99
SHA1:	BF867ACA0020E12F36D40F5C7BCF18FA21BD9521
SHA-256:	9D0B590FFF9C4143EF05D325D176C97419E0A305E6E23E07C9B5FA86DA407BDF
SHA-512:	779C327A9C9BEB8C07538ECE9EF06CDF5CD67D030007CF982B915A01D28B775677BD2F6CDD5AE5BF4C10FD2FBD202AF92325B5E7E747EDBB96B0258EF99458A9
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/one_click_handler_one_afma_fy2021.js
Preview:	(function(){'use strict';/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var m=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=m,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1};function ba(a){a=a.o;const b=encodeURIComponent;let c="";a.platform&&(c+="&uap="+b(a.platform));a.platformVersion&&(c+="&uapv="+b(a.platformVersion));a.uaFullVersion&&(c+="&uafv="+b(a.uaFullVersion));a.architecture&&(c+="&uaa="+b(a.architecture));a.model&&(c+="&uam="+b(a.model));a.bitness&&(c+="&uab="+b(a.bitness));a.fullVersionList&&(c+="&uafvl="+b(a.fullVersionList.map(d=>b(d.brand)+";"+b(d.version)).join("\|")));"undefined"!==typeof a.wow64&&(c+="&uaw="+Number(a.wow64));return c} .function ca(a,b){return a.g?a.l.slice(0,a.g.index)+b+a.l.slice(a.g.index):a.l+b}function da(a){let b="&act=1&ri=1";a.h&&a.o&&(b+=ba(a));return ca(a,b)}function ea(a,b){return a.h&&a.i\|\|a.m?1==b?a.h?a.i:ca(a,"&dct=1"):2==b?ca(a,"&ri=2"):

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, ASCII text, with very long lines (2402)
Category:	downloaded
Size (bytes):	37056
Entropy (8bit):	5.511008051016226
Encrypted:	false
SSDEEP:
MD5:	1235EA95B1643DFC06B47A36D3F258CA
SHA1:	6784E82D0E4C3489003584751ECF30E47EE87DA6
SHA-256:	1793356142359C056D5868272A9D05F9AFF268D1BA0AFF283F47171BE15B6A12
SHA-512:	09EDEA6A50DD3F423E93685510AB5E2E787E69C30F5D94C3F94CB6E78E3B299A6483E40CF592B68BFE77E04E4CE97D00DBBA37AFE0C03DC738635835215F5F5A
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/mysidia/1235ea95b1643dfc06b47a36d3f258ca.js?tag=mysidia_one_click_handler_one_afma_2019
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=n,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1};function ba(a){a=a.o;const b=encodeURIComponent;let c="";a.platform&&(c+="&uap="+b(a.platform));a.platformVersion&&(c+="&uapv="+b(a.platformVersion));a.uaFullVersion&&(c+="&uafv="+b(a.uaFullVersion));a.architecture&&(c+="&uaa="+b(a.architecture));a.model&&(c+="&uam="+b(a.model));a.bitness&&(c+="&uab="+b(a.bitness));a.fullVersionList&&(c+="&uafvl="+b(a.fullVersionList.map(d=>b(d.brand)+";"+b(d.version)).join("\|")));"undefined"!==typeof a.wow64&&(c+="&uaw="+Number(a.wow64));return c}.function ca(a,b){return a.g?a.l.slice(0,a.g.index)+b+a.l.slice(a.g.index):a.l+b}function da(a){let b="&act=1&ri=1";a.h&&a.o&&(b+=ba(a));return ca(a,b)}function ea(a,b){return a.h&&a.i\|\|a.m?1==b?a.h?a.i:ca(a,"&dct=1"):2==b?ca(a,"&ri=2"):ca(a,"&ri=16"):a.l}

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16429
Entropy (8bit):	6.017678729348706
Encrypted:	false
SSDEEP:
MD5:	9CC328EF7FF00BB2B90926A9E8CB5845
SHA1:	633AA7E855E4D183CF4747C6A839CE68552374BA
SHA-256:	06D0ECA2DB3A8C93819F61EF12C864EFB426E40260EED7FE1606902DFFC0A2F2
SHA-512:	C753EDD9FCF880EC65164E3FBF8011F40CE2638D28417861AB08EBAD9CF5EAEAEF2A6D62EDC23DA40E22B33734322BA83F325FF7C2E86670F16BF0EC305894B2
Malicious:	false
Reputation:	unknown
Preview:	{"sodar_query_id":"_TMgZs2xPMyNur8PkMehIA","injector_basename":"sodar2","bg_hash_basename":"ZFlt5LioZKC9-flDPe9nsMJHLC1Pbiu6fR6Ada7GFdI","bg_binary":"xwv/eRkte9fBPEBQuzYf0gVXyayPKC5HA2vsT/5BxUN74d0daFVblH5wy97vw1Q0IzVbRnojvXI+nBvdhvm5OZYQQDg95vCNqK+zB14Sv52kXWnhNvJe2b104eXAD46Hs7zQV9frJksrANQVWZz9aLOH6U4VCjzagmNIh+YvVeN3qNvdQtKL3Hh+p4U/Xs+jFIxXCUTWIr1Xy0GOHHXw5xDO3L5mAOcdxUgbnVGlBZvhf14RnRGEb3/n5nsoQVh+xDC2h1ZB6Du81N30VS7ER6PK3vy7l05MSNUhVnR2EprYTTpSYEeKa73gAGsX5sn4dGN6fT0phAAsltYqxh0rEX8qeuByUbraMIxicHWq1Ki7jKGuV2B2QNddY4TLoQiihxOryQX913sSFM4VWBhlbNUJLqADRD7JPBp/TEK8eR6isFrcTJwCCP8PdK3rBaL02wvZXaFSWxSpr1EIBE1fDNxVBD5x2cXQzGW507VapiEefO0U1hYQgUPohjzAuaaNxv5AOTpPrEQTddauKqB2EmqfeOTY8qZBNwqFa1AN5ZBbBP1qFCyc9ESMDCpj2AET4LX1q2qHvCsvJqm7El/Df0Aq2QeNZpkd8+LajkRTe5w0fxDEh693smDKetbCUJnlf8c9AI5gxHFR8H7QVwCSNb96/JZYUwdzbGWebh7ERpOh5+548QhGlSHilblYjwFjyaRULlGlBbo02nnCyhx8ZcJGIqvlJGuXgODKRPaqus8aPC7YzTQYMG8q8UuLhYBrIBaQMI1dAWt3oz/898c+1e/FOJYUw5TqWwIaxXHMdvTcwPTrqAptNNH8cTg2ln0g3Pt8cpfYpHGKMaQJHO

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 900 x 5
Category:	dropped
Size (bytes):	930
Entropy (8bit):	3.644411971554179
Encrypted:	false
SSDEEP:
MD5:	D86B0E72EF2A847DD9CA8D8E9BDE9077
SHA1:	A1BB944E355817A56C37FC82DEB858EE19A50CD5
SHA-256:	C2D2D895C8246DE24CCE3BD6C4D029237A8756461A4D0895126DED1E27252887
SHA-512:	6D3DE4125A5E40D18B30E1F17153791FC70B8AA903D131854806E4A3D9A7E92E3B75C1F2E83373E6AA9BD232ED24EE0EA3E2962C841EF70417291946842DA396
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,........@....,.H......*\....#J.H....3j.... C..I...(S.4y........I...8s.....@..MY`@.....]...P.J.J.....$....`..K..N....]...p..k.....;

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 728 x 90, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5457
Entropy (8bit):	7.9308269770713
Encrypted:	false
SSDEEP:
MD5:	6538CB762E86C6D2DC5FFD79EBCD7CA5
SHA1:	CA2CDAA2B61EAB0578B949AA11096C539607CCD9
SHA-256:	CA23172A3431C3F72882E1AE7534A4B481D0D85A5B6BCE884BD9B921E6A697A7
SHA-512:	3E933D166A4F03EDB256461CE24D6575FFFD0B515E52D2927054E3A46A5A8DE7E8AA90951AD0991BDC939865C18602710981F389F1D74DBB024DC44CCBCFF522
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/simgad/5324536507048099397?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qklMslnByfzZ18OJXEUqlMwaKUF-Q
Preview:	.PNG........IHDR.......Z.............PLTE1.(/.' Z.......3.&#.....4.&..&...................RRR...1.(............'''0.'SSS666...FpCDDD......555...}}}oooppp.........aaaFqB0.'.../.&/.&.....%+.#..%...-.%,.$......0.'G.@{.v,.$...J.B(. ..+..d.]$........~.y#\|. v......a.[......!y.&'...."....&.....#..%..+...U.0..,..W.P...H.A>.53.1.&.L..........8.......&..s.p A....$0......"8.FjB....j................!M....)......../..........KuG..................`.............%%.q.k...(.....;.6.y................$W....<r.......\.W....&.......@}<J.EX.S5...q....=.7...).":.3f.a,.......-..$E.'=....\.U.............A.;........r.m......../8....A..........(3..o..........qH.Tr...?..F.........q.J:................q.li.......(r!F.........Q.p.k......$1.@<..<.a..S ."..........[.W......`..1.)...+T&l.jG_E@Z=......Sw.&i...e....IDATx...\|.U...Z.B......*..P).;CB...2..dUp..E.A9..r...%..........`t...8..k<>.s8.}...}...^Uwu' .t.I.?\|..UG...{.^.b.l.Z..'`..f.......3.63f.lf.lf....1..1.p.y...1..`..T>...Dx5-.

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	247
Entropy (8bit):	5.1715196364324045
Encrypted:	false
SSDEEP:
MD5:	AAECAF4F4C3087E19EB5CBFC0005C054
SHA1:	025E0785D9341266F75EC2F3D87E5FE81B5FFCF7
SHA-256:	6B72B6098D1D0ECD4A4AC9581B219C9D15007AC48E7A8AF12BAC84D498D51EC1
SHA-512:	302A5C07E95A5E6D34DFCABDF74C5FC7888E71B7E91CCD831FA45A3D186364ED243D46E76FA21AF31BF4AE970ADCBF2CA968FE9BD38DCDA51D20D7B1C1C964A2
Malicious:	false
Reputation:	unknown
URL:	https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv='refresh' content='0;URL=iframe.html' />.</head>..<body>.<script type=text/javascript nonce="ZlucJQw42-NtNIsL8yowyw">document.location.replace('iframe.html');</script>.</body>.</html>.

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 900x260, components 3
Category:	dropped
Size (bytes):	16909
Entropy (8bit):	7.127567533146704
Encrypted:	false
SSDEEP:
MD5:	5691522DEB7E6A2895188461693923F4
SHA1:	A0585803AF1E0D2BFD7A0581D64CB97F3EF67B73
SHA-256:	A64B147C4ECF574A27DDA4AAC8141D28BE50801668F32BF933A5170774560878
SHA-512:	9DAD2D18DC0DBDBCD079D27BA3E5E89D627522F9F4B6D9FC9DD49EDE3598B684774A7EF0CF3328824C25052C7DEF72FA2C6B4239132985E1387197733DBCA1FA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p... ...P..*...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d................................................................................................................................................. .p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 600, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5926
Entropy (8bit):	7.906258989768089
Encrypted:	false
SSDEEP:
MD5:	A1B7DA1C8F753276706AF1A8E26545BB
SHA1:	D772A9640B5E56E66FE26A10260F4FFEF3F51160
SHA-256:	297C38C7450110354919CF96F6A7089F2E7DEE8C4B94ACB8E3E1826FC2D7CD59
SHA-512:	E3BE2CC2728F614FDB7C82811229D1FCC653CFC388F72AA4BB0C112EB54B3D149878FD1D4A59494015578349D79004FA2FC384AC44DBE019EA937AC2CC4622B2
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/simgad/1992440682003450767?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmgKGJ6fgLFf2uEmTngFSfHrWMWeA
Preview:	.PNG........IHDR.......X......O.B....PLTE......BBB..............#<....H......XXX......&&&lll}}}kkk......'''I..5.....R..=.....A..t.wL......P........l....................'.OV..P..?..s..R.hA...........~........9.>...N.....O.S........................8.]b..T..O..w....N...........D.....P..6.=W..1.V..........y..G..K..c.f...g.l......I.d........t..h..............@..o....^.....b..k........]....c........ .'....=.Cq....q.............m..U.k...>....................................s...p....\|...........i...+.Q!.J...y..n.~................]..........e.v.........................}..e............u..........................................{.......>.[...............`.n......J.b,.S........f.}...........................7.\...........................\|............(..'.-,.`j....IDATx...x.e.....Sw3.I(!..$......0G...&r.M.hR.....".".!M..> *.g}.g..{..............;.....vf.i.y.2..<\|...A..A..A..A..A..$.l]Y...[thQ._X..n(.c."H......8\|.&\|.3..L7....:..\%.'.Az...

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ISO-8859 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	13255
Entropy (8bit):	5.259967563874677
Encrypted:	false
SSDEEP:
MD5:	BF59EB619762BB78D0C91F1652E0E366
SHA1:	7A16D332DD62B76B95C4D208813CC3147A45FB7A
SHA-256:	98EE7E27C0FC6D3B261248AF747FF6D1025AF0D33BC31FFF8B48E51FDD731A17
SHA-512:	01FDAC92CEDBE8E2D43B935A9FB0A3F78E98A7E9D11E797B8163D34A9085CCB51270ACF7A14E71CEDC58A09BF36C40511AA06413BE0364B04F7BAA64BB150D21
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/support/writer.asp
Preview:	..<html>..<head>.. Google tag (gtag.js) -->..<script async src="https://www.googletagmanager.com/gtag/js?id=G-XVM5E9PE4F"></script>..<script>.. window.dataLayer = window.dataLayer \|\| [];.. function gtag(){dataLayer.push(arguments);}.. gtag('js', new Date());.... gtag('config', 'G-XVM5E9PE4F');..</script>..<title>CutePDF :: Support :: CutePDF Writer Help</title>..<link title="MainStyle" href="../include/main.css" type="text/css" rel="stylesheet">..<link rel="shortcut icon" href="../images/favicon.ico" type="image/x-icon" />..</head>......<body>..<p align=center>..<table cellSpacing="0" cellPadding="0" width="961" bgColor="#1d4ca9" border="0">..<tbody>..<tr>...<td noWrap width="3">...<img height="1" alt=" " src="../Images/space.gif" width="3">...</td>...<td noWrap>...<a href="http://www.cutepdf-editor.com"><img SRC="../Images/PDF_Editor.GIF" alt="Go to the Free PDF Editor" border="0" WIDTH="400" HEIGHT="62"></a></td>...<td class="toppmenu" noWrap align="right" valign="top">.

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssH8KcKghA098e5Wst00dE4q_ZN_-EFgOPBWA27Evm_8feFGPuchXU9Iosyly9NgIre0uQ3Q_wnwJANSivdgkpDknmUpTuXVfUOtOVsC7kiMf7PF9oAG9Qx_1Xa8ldKm2y0BECmW3wdJ_QEBqWVFkgWoJujlkIHTIY&sai=AMfl-YS9ohikyBNMdUHhXbRHKKxmWez-eQ1I4UO1WndewX1QBhUywtrkTank0yimG6YJSInMRP2RmWB4_l3HtTop9JKc3jZBRg_d7uHjNAd9Kp-LAtUqVefwKk3FRy7h5skwYpi1brCI6tJR5JEUIK_B&sig=Cg0ArKJSzPBLKtgbdTmzEAE&cid=CAQSTgB7FLtqjc09jv0H1zvI8ZAdWq6jYrd5z-OGl-VHderL4EA6g6Y_8YjyPBD-iJ7xj9GSegkgvb2z_-g838THDCxTMni8doSBGWz3lef6bxgB&id=lidar2&mcvt=1015&p=0,0,90,728&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20240415&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1854165047&rs=2&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&co=931928200&rst=1713386480266&rpt=2711&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52174)
Category:	downloaded
Size (bytes):	53452
Entropy (8bit):	5.722187001987038
Encrypted:	false
SSDEEP:
MD5:	5C9CEEBA9AF4DAB222A71F0B10402144
SHA1:	727F4C0AA83C10CC7999C65863D537F62A801C0E
SHA-256:	5C0D4EB15C38BF2C7978D2C9313A3A37297B27C8795706B0F03DB6E4A524606E
SHA-512:	EB92706E472673F78F01E3C3C1E0B69CE4570F307B8DC9E36B9A8F181A5FC236D8CEFC3965772B6BB2421BD878D9C5ED6C236FF8827B5F0D6965D803FD52D66C
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/bg/XA1OsVw4vyx5eNLJMTo6Nyl7J8h5Vwaw8D225KUkYG4.js
Preview:	//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==.(function(){function n(O){return O}var Y=function(O,a,V,d,w,I,Z,K,t,B,m,k){for(B=(m=72,a);;)try{if(29==m)break;else if(m==V)G.console[I](k.message),m=O;else if(4==m)B=a,m=61;else if(41==m)m=t&&t.createPolicy?10:d;else if(61==m)m=G.console?V:O;else if(72==m)t=G.trustedTypes,K=w,m=41;else{if(m==O)return B=a,K;if(10==m)B=51,K=t.createPolicy(Z,{createHTML:M,createScript:M,createScriptURL:M}),m=O;else if(m==d)return K}}catch(P){if(B==a)throw P;51==B&&(k=P,m=4)}},G=this\|\|self,M=function(O){return n.call(this,O)};(0,eval)(function(O,a){return(a=Y(70,31,38,42,null,"error","bg"))&&1===O.eval(a.createScript("1"))?function(V){return a.createScript(V)}:function(V){return""+V}}(G)(Array(7824*Math.random()\|0).join("\n")+['//# sourceMappingURL=data:application

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3920)
Category:	downloaded
Size (bytes):	148359
Entropy (8bit):	5.601993505720369
Encrypted:	false
SSDEEP:
MD5:	EAA0F948D5CE8A47770D05A7F4AA35A9
SHA1:	D1A76BE595BC343139F7BB5A657A28700BC29AD8
SHA-256:	E3D144E2E48B47DFC7A499F1193E4E112C299F0881EC5DE2CBA2B2A9021BFF24
SHA-512:	E3D8F10F023338E82AAFBD71497AC33961080749B0EE64998F5454B06412478D8A6F8862D1FFDC60E793B8E9C080A8823D031634614BE0F1E6064F6CD49777E2
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Preview:	(function(sttc){'use strict';var aa={};/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ .var n=this\|\|self;function ba(a){var b=ca("CLOSURE_FLAGS");a=b&&b[a];return null!=a?a:!1}function ca(a){a=a.split(".");for(var b=n,c=0;c<a.length;c++)if(b=b[a[c]],null==b)return null;return b}function da(a){var b=typeof a;return"object"==b&&null!=a\|\|"function"==b}function ea(a){return Object.prototype.hasOwnProperty.call(a,fa)&&a[fa]\|\|(a[fa]=++ha)}var fa="closure_uid_"+(1E9Math.random()>>>0),ha=0;function ia(a,b,c){return a.call.apply(a.bind,arguments)} .function ja(a,b,c){if(!a)throw Error();if(2<arguments.length){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}}function ka(a,b,c){ka=Function.prototype.bind&&-1!=Function.prototype.bind.toString().indexOf("native code")?ia:ja;return ka.apply(null,argu

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1321)
Category:	downloaded
Size (bytes):	17314
Entropy (8bit):	5.342134706855769
Encrypted:	false
SSDEEP:
MD5:	2CC87E9764AEBCBBF36FF2061E6A2793
SHA1:	B4F2FFDF4C695AA79F0E63651C18A88729C2407B
SHA-256:	61C32059A5E94075A7ECFF678B33907966FC9CFA384DAA01AA057F872DA14DBB
SHA-512:	4ED31BF4F54EB0666539D6426C851503E15079601A2B7EC7410EBF0F3D1EEC6A09F9D79F5CF40106249A710037A36DE58105A72D8A909E0CFCE872C736CB5E48
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/sodar/sodar2.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var n=ba(this),p="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),r={},u={};function w(a,b){var c=u[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}.function x(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var g=d[0],h;!a&&g in r?h=r:h=n;for(g=0;g<d.length-1;g++){var e=d[g];if(!(e in h))break a;h=h[e]}d=d[d.length-1];c=p&&"es6"===c?h[d]:null;b=b(c);

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 300 x 68
Category:	downloaded
Size (bytes):	1100
Entropy (8bit):	7.672596140664992
Encrypted:	false
SSDEEP:
MD5:	AD8D58521AF2AFD68D9060E1A368CC69
SHA1:	D58BD9D3A37AC0888A4FBE6DF077223F7740E2F9
SHA-256:	8667633125D3B6DBABBF9543340A292F0553A9862617DEE161C130E86A8CBF26
SHA-512:	F921BA1B7CF90CE87AC5CB22C205CDA56AC1556FB8A3D13614A84DC7AEE856F0CBA750C53C3E8811B15738F6FD042159A356A8E865F3DBB8647C77B790B919B9
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/htabs1.gif
Preview:	GIF89a,.D....Dr.Cp.Fu.Ft.Es.Er.Eq.Dp.Dq.Hw.Gv.Gu..C.4b.4a.Gy.Hx.K}.Jz.J{.Iy.I{.Iy.L..L~.K\|.M..M..............!.......,....,.D.@.. .<Zi.h..l.p,.tm.x..B....pH,...r.l:..T..X..v..z..xL....z..l..\|N.....~..........;.........2..........................................................'.......................................................H......\....#J.H.bEH.3j....e C..I..$S..\.....Z.I.f..1k.........J...H.]...P.J.J...V5.....`..K...h.]...p5..K...x..........L....5.Z....#K.L....3k.....5..M....S.^....c.M....5..........N.....+_.....=J.N.....k..]z.....z........r.S....{..O.>.s..../.J~.....@..h....Q ...6H...F(a)&4`...d...v.. .(.$.h.(...,..".. .4.h.8..<...@.).D.i.Gj@.L6..PF)..h0..Xf..\v..`.).d.i.h...l....p.).t.i.x..\|......Z...$..6..F.Vj.f..v..X ..j........*..j.j ........+...k..&...6...B+.n.Vk...f.....E..+..k...........+...k...............l...'....7.Gw.G,...Wl...g....w... .,..$...(.

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2937)
Category:	downloaded
Size (bytes):	219670
Entropy (8bit):	5.418738958553121
Encrypted:	false
SSDEEP:
MD5:	98B6A9274DDF80FD0842599E2D17D3E5
SHA1:	D59B8ABEF04701E8C95CBC0A68F8875B8D422786
SHA-256:	821C2B34BA1425AAC89E76F1E8226A71518A54DECF4E2E061D670881B202BC82
SHA-512:	0C970A007B270AD3394F842322E4EE73CDF6718B136A75F10670CB125A6E47C37D94F87B132E07A97E8868BCC3BC22D461867B8BB4F82B8D701A76EA8BDEE12A
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Preview:	(function(){var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=.ca(this),q=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.q("Symbol",function(a){if(a)return a;var b=function(f,g){this.dh=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.dh};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	16214
Entropy (8bit):	6.018771838473284
Encrypted:	false
SSDEEP:
MD5:	9FE583FCE4BF1060706B1D99F285B16D
SHA1:	6B07CE529B0C11D0C6E9E6005CA79CF7B58D4D16
SHA-256:	F121553046E6894C6B916F3282DC8DE68045FC671BC98F747457E65B510BE906
SHA-512:	AC5F2D6C9568D4A5C982C0116793DBF3353C0D7B26F0320EDE1B22EF6FE5C217E34BE4E2A92D9ECAA0DCA11E1347F85B012205E54B3301741A7CC855652F2B52
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240415&st=env
Preview:	{"sodar_query_id":"-jMgZtmMOpHpkPIPi_-3uA0","injector_basename":"sodar2","bg_hash_basename":"ZFlt5LioZKC9-flDPe9nsMJHLC1Pbiu6fR6Ada7GFdI","bg_binary":"xwvvB6yxg7D/de0ThfFjZXptelcfL4RWOKQsgeq9es9IU5xzr3n48wQ0BaZUd8KOgBeu7G2ZxYlZry7iMGPqJjUqQKajSTO6Z/lE1CDMwYUm5dqiytFbwEeOu/mv9h+gJWheETQ7VE7+VpVCSBEsgR7hDzEGaLxEBgx7OffA/L/3LTBf/4PWP6XIeDJ64qj7wqZjrZKX6SkkxAakSABCD8/qKBIcCnt7Zvm7AFOD3VkQyRQ56KtGlVwq1ewcS0rC5saLSNsLDYFpDH3upOw2hhiZpmGSNwcGQVx1yaWOzIX3gYzJTXQWygb9gdBbZfaf5qImu8YJ9O6M+Xp4k7QvyZC/H+87Ba8/ha0DciVxLb9tOGX2nWh4dYzHrycOsIAEdzPYnqqDMv9hGaKTHl/KeQOvhgo+Jnle5L2dsvCU0QMecRthOunzNc+y2s8tVAy1A/sHaY0buwaLMrgq3VyBCg0ssJA7cD9YkXXmFCQeug+doQsCR7k8cCo4+MCDZe+bBjHyXpEv8tfzJNpacXXK9fiJqF07s1rHJ8ismHD7NoXngNoCvruORA2aazD9NoLecClkze6xU9IDt3u1XRnZF4Zz2IX3HxusEtN00/rLhXFpAqnUyx42Ng0j1uo1K3aKgahGZXvAgh0WMA/xHEDZjR0aEYSsDc/moXlSQYX5LhENA5K8rkoeO6CwUVNbWLKYSYHtXaidBSzmljTi5wVjLe/kacLhX3XoImIKJ5ad/dR9rRLiLsHKvWKWJ4ZVTPqxeV/a/k9Qp9TZ/nX8REtRdDUpzCsJkI/6Fu2Lx4Z2kSoi7IciuG+TYZlGOTVnR4eNs1L2X/IW0IzpUb1ZJ

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2817)
Category:	downloaded
Size (bytes):	31073
Entropy (8bit):	5.482792915171584
Encrypted:	false
SSDEEP:
MD5:	2502CF22E2BC09A340C7433D24F72B8C
SHA1:	2D6A1C3204DA758F7CFA1EBEAC1AA5054E3A2103
SHA-256:	991BBD9BB97396ABC0AC3EAF93D7130CB906F2388B6AE3DEE4836294DCBFBF61
SHA-512:	AA4E7BD6C57EAEAF78EF9828D2A0E04F453B3131251E7A22B5DB17AFC2A2DD37E2ABAA5DF321D86C27E683DCF5FA5F1EF7DFE5D96D5E0B82994DC10F88577874
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true
Preview:	(function(){var p,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},q="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object"); .},ca=ba(this),r=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&q(c,a,{configurable:!0,writable:!0,value:b})}}; .r("Symbol",function(a){if(a)return a;var b=function(f,h){this.P=f;q(this,"description",{configurable:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.P};a=1E9*Math.random()>>>0;var c="jscomp_symbol_"+a+"_",d=0,e=function(

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 900 x 5
Category:	downloaded
Size (bytes):	930
Entropy (8bit):	3.644411971554179
Encrypted:	false
SSDEEP:
MD5:	D86B0E72EF2A847DD9CA8D8E9BDE9077
SHA1:	A1BB944E355817A56C37FC82DEB858EE19A50CD5
SHA-256:	C2D2D895C8246DE24CCE3BD6C4D029237A8756461A4D0895126DED1E27252887
SHA-512:	6D3DE4125A5E40D18B30E1F17153791FC70B8AA903D131854806E4A3D9A7E92E3B75C1F2E83373E6AA9BD232ED24EE0EA3E2962C841EF70417291946842DA396
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/companybm.gif
Preview:	GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,........@....,.H......*\....#J.H....3j.... C..I...(S.4y........I...8s.....@..MY`@.....]...P.J.J.....$....`..K..N....]...p..k.....;

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	234187
Entropy (8bit):	5.554727886023956
Encrypted:	false
SSDEEP:
MD5:	F6BC591FE2C1E9E178B902DA4B82B4A7
SHA1:	209DEA2FA570AB2BFBCB1A06004BFB7F2FB0B9A7
SHA-256:	B921B4489DBC49776E08D732C0B2814846E89E8B7A4EFD59785ED8209DA1BF92
SHA-512:	9CCE20B96CB25908457EF9F494182A350B884D3B79F7FA6DB4AD4406D4C6A5A07FF106FCBD39E0622C331301E776AD89C51AF5F7771C9C0696EB69CD09E8B6CC
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=G-XVM5E9PE4F
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":6,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":true,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNam

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 781 x 536, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	27105
Entropy (8bit):	7.874192034375752
Encrypted:	false
SSDEEP:
MD5:	DD48B22EBFC9BB6FE9AE16008AFBE90C
SHA1:	29FB682834AF2EECCE1C2C25BF4675F388F811CF
SHA-256:	61BD73FE74B8A136AECF3A52942342FE894AFC93535774966FBD83C80159F3FA
SHA-512:	8220BC4AD3A9D13B90E5DDE91DF2CE0C3475C77C086D19216C9A89070E306A86F7E8EE5E382866EC77281526D84CBF67240AD5373EF1B6F1F77B25FE9AA87D7C
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/Save.png
Preview:	.PNG........IHDR...............+....sRGB.........gAMA......a.....pHYs...t...t..f.x..ivIDATx^...]U..}-.j......~...{.J-A.1B[vWw9...M....E..nJA(...0......&.)l.......,......!@.(.&.....a.....>g...s..>..........f.....?.!. .. ...S.>x.....b..$.....x....@.<.... ........x..^.:_.......I..v./....@........O....H.'.............I....i.$....+...n..V_(!M.....'._.@.f.......,.V.....y.%.X..i..LM....a3......`.8.J.R..$5=.y....6!.QP....=./.....^TU.......G....U...@..5.C.....$....B=.{..1GE.1u..M..mq.NY.P.....0...[Q.X.:.$.P...9.....F.FO>.<...L1j"..2y_..U.....5..W.iu.Q.W...........P...d...,. ...V..q.%.U..:S....L......`.......i..u.b....h..ZC.N...xR.M....<Z^.......L..I.A.cN.'.:...9.3...@C..wOz....$Z.....A.-&C..09..r...'Nbr..y.,k..x.(...\|E...d...`~..?.......vR"..H......x\|...zW..>:.;./.x.(...q......y.............uE..n1.T7E<>.(.1...{.......O.e..HM.....[SV..lM.O.._D.....Q...l. ..H.<.P\."..........5U.#...5.SE.M..WQ........>.)IMO.....*aq.h).p....O..#)Q.'...R50....#D...

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 684

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuUzi7GsZjSpTiLVSNGPpMG4LT5SKH5LnARsmhl07Lgl1AoeDlCz9j5l7AKv_6wYGMYCK2gnrRxCBeFnQW9Q5X69drEeMitJETwFYVvLHZw4zqiruxI30vGLnLzJ3OEQdOQ0PW4i1xYPES_Bvr52dKIwKMjZ74HiAw&sai=AMfl-YSTnZkqTra3dpdwCBZ-hGRlLQaLq2RZp6knNY3Yi2zPKiSjNbcOErS18GNpFRHBzh-XYEKQM2Q2cYRRQBPKUgKQxdmsxPSUsk4W_6B2rMRgAIb24OoLlKjY5fi3RVSFNWXgbtcxKtOKm81_Lm1R&sig=Cg0ArKJSzLS6Wv4VElSuEAE&cid=CAQSTgB7FLtq0a4HPjDsTvirOXQSoKzDaUOzvMDW6ce-ncuzKjXG8ohvYrF3D0p1IFuQqEj1DR9rMD9Ed7elLLaSwKeBvb3sAEE2-_aAX_tNfxgB&id=lidar2&mcvt=1010&p=0,0,124,1005&mtos=1010,1010,1010,1010,1010&tos=1010,0,0,0,0&v=20240415&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&co=931928700&rst=1713386483633&rpt=5498&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 685

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	652885
Entropy (8bit):	5.830859390503664
Encrypted:	false
SSDEEP:
MD5:	C578DF6A179B2B48D3570B2545BDC947
SHA1:	A4B8B7DCA38EABC463E146568F83F14E54B87CA9
SHA-256:	044D635BA648A3705113685330E0A14E60E42162AC7DD9DDB642F650B3071025
SHA-512:	5F7C85E9596C770759CF6849E7D9CEF8395A65845471ED43D1AC5C1030D6ACAD139EE85B2EAB2CFBF871FE24F8603F05E0ACCFDA9F8A6F591B3BAA9F791AB19B
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&adk=1812271804&adf=3025194257&lmt=1713386480&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=174x714_l%7C193x714_r&format=0x0&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&pra=7&wgl=1&easpi=0&asro=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479210&bpp=2&bdt=1020&idt=1080&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90%2C160x600%2C336x280&nras=1&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fsapi=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&fsb=1&dtd=1094
Preview:	<script>window.sra_later_blocks = [];</script><script>window.sra_later_blocks.push({creative:'\x3c!doctype html\x3e\x3chtml \x3e\x3chead\x3e\x3cstyle\x3e* {margin: 0;padding: 0;outline: none;}body {background: rgba(52, 58, 65, 0.600000);backdrop-filter: blur(15px); /potential issue: minimal browser support/-webkit-backdrop-filter: blur(15px); /for safari/height: 100%;}#ad_iframe {box-shadow: 0 !important;display: block;left: auto;margin: 0 auto;position: relative;top: auto;}.creative {transition: opacity 1s;-webkit-transition: opacity 1s;position: relative;}#card {background-color: #fff;border-radius: 6px;padding: 0 6px 1px;position: relative;box-shadow: 0px 8px 12px rgba(60, 64, 67, 0.15), 0px 4px 4px rgba(60, 64, 67, 0.3);}html {height: 100%;}.toprow {width: 100%;display: table;height: 24px;background-color: #fff;}.btn {display: table;transition: opacity 1s, background .75s;-webkit-transition: opacity 1s, background .75s;-moz-transition: opacity 1s, background .75s;-o-transition:

Chrome Cache Entry: 686

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 478 x 583, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	12048
Entropy (8bit):	7.784483382002988
Encrypted:	false
SSDEEP:
MD5:	F00FB8D963212BEA8D5FCAA9B618C690
SHA1:	E3D696634A37016E45EEA904E8D94AE41A958737
SHA-256:	52EA398A3D12CD4BE21F7499093EB973B316B8B9D109ABB9470E5AC665759B71
SHA-512:	6E2D00362112AAFDF9E374F3C0F5D0BAC96A31F12DAD5B09FD66A30B46F73F9B5261714A159967175F989D8AF26D1F40A5C33851B353B36D22E6096F5840BF4A
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/Security.png
Preview:	.PNG........IHDR.......G......}......sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^.......z.>.n..K.@..ag!.v..o9bw.......}.]OPW.W=....2<...X.YZZ..GFDFVzF~?...?w..V...i>.....[.n..s.g}.d..g.@7.f..........;T3.t.j...P........C5.@wv..G...z"....?R.....e..?........T3..Dj............O...._...'<..W......p.......n.x.m>...O6.}x...v.jn..K[....~H-?.{7Z.fk..MT....4..."R......Vu....l.].t{..9T.....u..!/....u.Qz.6.pP..\|..7.?.pW.....9L.....oL..&v.^.h..8&.......A{.T...p.......W.lM./..G.\|.[cO.Z..x\........d;<`wB.T...\\.m...@Ij.......r......P^.R.e]....?AT.........."...s...:.TH-?...[[..k..[.}%..8.....*+.)...5.....u>.....S.?..G......%_.~..........VS.ze.7....J.[.E..w..).....'.....7.s.H.c..;.._Nz........W[M..+V.q.x.67..ux..G.w6b...n.y.T..5.;.d...Y..Nj..7......\|B.....P.6....+......-b.Mx..."....y..n...z<...,...........f.p.....?.`.:m".{e(.}._.uy........7.D<7.Q;.'.#..h.......?............@....j.z...........LB5?...!.............;T3.t.j...P........

Chrome Cache Entry: 687

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 35 x 15
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.040549588105179
Encrypted:	false
SSDEEP:
MD5:	C123A1142CD0E858531455F7119AC623
SHA1:	8FBE613EE7A89C273B73AE2E1F1B24D461723DE8
SHA-256:	3F7923E3B28CD8F2507D56C7688E47219C82971E985FD5C340BA7BAE372902BD
SHA-512:	3C7A75F4DC9C18EB2AD89B1BB9469B035A4D4E88F9BEAFBB7692FF4AFDCC2A2704A6B90DF223A2B7835EE2E0F8A5CC8CB7DBB5A3451C09AC8898E1A6DAF82BB9
Malicious:	false
Reputation:	unknown
Preview:	GIF89a#....M.................... ................uu..........ss.>>..........^^.UU.............FF.......55..........BB.............JJ....ii.\|\|.......[[.........................QQ....::..........qq.........................MM..........33.ff...............................................................................................................................................................!..NETSCAPE2.0.....!.....M.,....#......M....M.J.....&I&...ILL......................&LI............J.J.J....L.J......HKHJKI.GG....K......GK.G..I.KK.H......L........x8.../r...w...A..qkg..5t.(.:r...S......T. sAD....Y0G.@A...E/_.$%..!..B!.d.....,...b.....$.0h...P...!.....M.,....#......M.....J........1'1...L.....LL....'.LI...........''..........IJ.J.J..I..I....7...HKHJK.KGG....K...M.*.G...I.KK.H........L......5..! .x....>..'.p...9&.:..N[.S.....dXI{..4.T.p.@..6...N..."T......D.....%.@.pP.........h....P..j.@.!.....M.,....#.......M..................L.......I.....LL......=$$=I$........

Chrome Cache Entry: 688

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Reputation:	unknown
URL:	https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-941299-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 689

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2020)
Category:	downloaded
Size (bytes):	12817
Entropy (8bit):	5.34459161517544
Encrypted:	false
SSDEEP:
MD5:	1D3D22DF067F5219073F9C0FABB74FDD
SHA1:	D5C226022639323D93946DF3571404116041E588
SHA-256:	55A119C0394F901A8A297E109C17B5E5402689708B999AB10691C16179F32A4A
SHA-512:	0B6B13B576E8CC05BD85B275631879875A5DBCB70FD78E6C93B259317ED6FD5D886F37D0CC6E099C3D3A8B66FEA2A4C2C631EB5548C1AB2CD7CB5FA4D41EA769
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Preview:	<!DOCTYPE html>.<meta charset=utf-8><script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';function m(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");}var r=aa(this),u="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),v={},w={};function x(a,b){var d=w[b];if(null==d)return a[b];d=a[d];return void 0!==d?d:a[b]}.function y(a,b,d){if(b)a:{var e=a.split(".");a=1===e.length;var g=e[0],k;!a&&g in v?k=v:k=r;for(g=0;g<e.length-1;g++){var c=e[g];if(!(c in k))break a;k=k[c]}e=e[

Chrome Cache Entry: 690

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst4PT2a0DZEwUY6PTAm_4FzTnNjwYFESjkefo-f465Od2oj1TNOk4kvj4V8Q-aC-FzSPWAm7DKEmJv3WqzKOXsCcF7ANjHbzmF02d_VsisAfU9_2Gzc5CL1YEM9_xCPlXnnQnnLjJjRzPP2V7PBDx1w_Xl_QNroiK4&sai=AMfl-YTsRGdSl4f1UF04k3uDHzmpuXO3bh29AuHD578uJnjWXJKNv6FapU829a1KXwsu6tMnSE3yy4yFBloZMLd5m1Plr1ZjQR8wQ8j17-tsH7boYDxLu8v3MlwkJFmmdA1WIRoNUXsZdpRh6Uinix6vXg&sig=Cg0ArKJSzIV86aipmN12EAE&cid=CAQSTwB7FLtqKM23G5I1wz6Pkbawvciq7zXz_J1cS84W8zSH3oX03n5AlaH3iLKFL2sQyeuRUbG3mpem6x_M7eqs-9YvcmDHeSVx3fwCjmf6xkcYAQ&id=lidar2&mcvt=1001&p=0,0,600,160&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20240415&bin=7&avms=nio&bs=0,0&mc=0.81&if=1&vu=1&app=0&itpl=4&adk=373269726&rs=2&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&co=931928200&rst=1713386480283&rpt=2663&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 691

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	105598
Entropy (8bit):	6.087132185575652
Encrypted:	false
SSDEEP:
MD5:	A51B85AB427BECC1E118D98669F81938
SHA1:	ABBCF890AA83AFA6621A408F1AF154C61A20826A
SHA-256:	3C677DA40452E85C49D8AD90D51468E6EFC507C42ED52C7528B8771606AD7E37
SHA-512:	4BB944BE989DCCCA2538EE4A25B5A981A9450DC904AB3457F579D5AE1C34CFA2E89367F8362BED5C211A86788F37C154CAB77155300DDBC7B0133F4D4BBEA821
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=90&slotname=6092711011&adk=1854165047&adf=3987798746&pi=t.ma~as.6092711011&w=728&lmt=1713386480&format=728x90&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479204&bpp=4&bdt=1014&idt=1034&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&correlator=464567931983&frm=20&pv=2&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=268&ady=144&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&td=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=1048
Preview:	<!doctype html><html><head><script>var jscVersion = 'r20240416';</script><script>var google_casm=[];</script><style>a { color: #000000 }.img_ad:hover {-webkit-filter: brightness(120%)}</style><script></script><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20240416" data-jc-flags="["x%278446'9efotm(&20067;>8&>`dopb/%<1732261!=\|vqc)!7201061?'9efotm(&20723;>:&>`dopb/%<1245;05!=nehu`~"]">(function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var q=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=q,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1};var ba=aa(610401301),ca=aa(188588736);var t;const da=q.navigator;t=da?da.userAgentData\|\|null:null;function ea(a){return ba?t?t.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function v(a){var b;a:{if(b=q.navigator)if(b=b.userAgent)break a;b=""}ret

Chrome Cache Entry: 692

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 239 x 202
Category:	downloaded
Size (bytes):	13205
Entropy (8bit):	7.9558969318318615
Encrypted:	false
SSDEEP:
MD5:	626FED0626C307193691208B3AC7287C
SHA1:	62514016CF4CB70450F71C56C1B7923577757BA5
SHA-256:	F25B8FE2669B4F5F388609D13E26852C2D99CEC66D57B786DA8C3900C6C2C8C2
SHA-512:	B47D81329361CB3B9635CEBDB17E29CDCE61CBB0658C511D523E0859D50B5CD71F649BD0C0DDE883475F0E1F3A3180A79A2906B9AC41A5C85C26FF54D6595E55
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/Print.gif
Preview:	GIF89a.......c.98.7.c.......b.j1.c...P:....ON......f..C...ab......%%&...8:....NR.uy.Za...6@.ox.08g8M.79C.........^j.p{. B...........-.....-.d.....Cj...............^.;g.Ly.Cg.k.......................~..........9.C..1Hk.....Ug.......}.......................A..M.'p.........dt............q........}...........................4m.. m..r..u..w..v..}..{........................"\.)e.-d.4k..6Q>s....]..P..Fx.K\|.O..O~.V..T..]..Z.._..b..f..j..j..n..n..t..r..x......................w............:Uc..N..Q..b..W............/y.9..V..\..e...c.u.....;....v..j..c........;...`.......c.....f.....`.............u.p.......N\O)...............x\T............t=.z...........zR...e.3..].c.`4.....8.`..:........iii.....................!.......,........@......(g.....*\....#J.H....3.t6gU.. C....$.TSR....=.B....)S}....S.@...Jth.H.(]...R7o.J..(Q2Ai...k...>..{...;.<mZ[..Z:p.j.KW...x.........d...I..9r.H."D.".....2,.p..b...4:..B.P..l.\|Ab3.S.

Chrome Cache Entry: 693

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 781 x 536, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	27105
Entropy (8bit):	7.874192034375752
Encrypted:	false
SSDEEP:
MD5:	DD48B22EBFC9BB6FE9AE16008AFBE90C
SHA1:	29FB682834AF2EECCE1C2C25BF4675F388F811CF
SHA-256:	61BD73FE74B8A136AECF3A52942342FE894AFC93535774966FBD83C80159F3FA
SHA-512:	8220BC4AD3A9D13B90E5DDE91DF2CE0C3475C77C086D19216C9A89070E306A86F7E8EE5E382866EC77281526D84CBF67240AD5373EF1B6F1F77B25FE9AA87D7C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............+....sRGB.........gAMA......a.....pHYs...t...t..f.x..ivIDATx^...]U..}-.j......~...{.J-A.1B[vWw9...M....E..nJA(...0......&.)l.......,......!@.(.&.....a.....>g...s..>..........f.....?.!. .. ...S.>x.....b..$.....x....@.<.... ........x..^.:_.......I..v./....@........O....H.'.............I....i.$....+...n..V_(!M.....'._.@.f.......,.V.....y.%.X..i..LM....a3......`.8.J.R..$5=.y....6!.QP....=./.....^TU.......G....U...@..5.C.....$....B=.{..1GE.1u..M..mq.NY.P.....0...[Q.X.:.$.P...9.....F.FO>.<...L1j"..2y_..U.....5..W.iu.Q.W...........P...d...,. ...V..q.%.U..:S....L......`.......i..u.b....h..ZC.N...xR.M....<Z^.......L..I.A.cN.'.:...9.3...@C..wOz....$Z.....A.-&C..09..r...'Nbr..y.,k..x.(...\|E...d...`~..?.......vR"..H......x\|...zW..>:.;./.x.(...q......y.............uE..n1.T7E<>.(.1...{.......O.e..HM.....[SV..lM.O.._D.....Q...l. ..H.<.P\."..........5U.#...5.SE.M..WQ........>.)IMO.....*aq.h).p....O..#)Q.'...R50....#D...

Chrome Cache Entry: 694

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 400 x 62
Category:	downloaded
Size (bytes):	2417
Entropy (8bit):	7.721766417107115
Encrypted:	false
SSDEEP:
MD5:	67FBC3737FCA56E812F1B0578FBF89AF
SHA1:	241C09E340F16BC9E9D330D689A61DFC97243D83
SHA-256:	51B3F4BAAA34B9D033743B4A09A626AF56AB475782A45C66F29C8190F7BDE8C7
SHA-512:	15122D9F241F268362BC533BE129AA723F3DA0DFC8D05162DFACD2F7CE8EA050A5D75B8F944810C497AF89881B589A2E02ACFEDFFCA97CF0B937587787BF2B91
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/Images/PDF_Editor.GIF
Preview:	GIF89a..>...........x"....v8....tH....rR....p]....nf....ko.gv...e}...b...._....\....Z.x..tW.ev.`T.Jc.HP..L..............................................................................................,......>.@..@.pH,...r.l:..tJ.Z..v..z..xL.....LIp...fM...t.`...1W.....Vz~...D....E..}.O...M.}o ~.E...x...F..J..C..p~.D.\|..}.B.{..~.D.}.F.{....Q..C.~.C..C.B..D..C..B......K....D......C....D.....\.G...#....'.`....1.....w..$....E...\|..1.......@.\."..Y........`Ky`........D..".\|,Ac.s.J..t.\|..!.y.2..@..?..2\p.`H;..:\|.(@....."p.....D.j.`@...s..s...Y....uW...."K.L....3k.....C..M....S.&".....@.ZM......(.3...!.f{0.g.O..h.....D...q......jj.S8......=..._O&.Trw........ $...#..P...~0..RC0..+4%u...,..+.qWD,~...TV@.T+.....N.>.K.D..K9"F..FB.....`t...(........D.U.c.....+.E..Dl.Q..)QA..........<.L..m\v..y).d.i.h...l...p.).t.i.x.g....A(...p....R..'w...O.......Gh...1...fS.3.R..2...\J.j.C).[..n.G.v\|0....a.Hl.....$...z.. p..M..a....F..:......(....o..l!B<.I.........._()...U)

Chrome Cache Entry: 695

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1838)
Category:	downloaded
Size (bytes):	421667
Entropy (8bit):	5.588627630305959
Encrypted:	false
SSDEEP:
MD5:	ADFCFD84D368BDAD450BBB0B2A832FCA
SHA1:	DE7C61941143F969796B0C829AAEEDA04343B822
SHA-256:	6025D29AF43901A1914EDF5B0DD6EC045C63038DAEA56741797FC0BB17C7BF9F
SHA-512:	A4102C423B1896308600CB546A1FD3AE51EB06121C4A9BEB1CAEB74C76533498A658C0BFB9065BCDD86CD94743AC66E299012366248AB1F01197D9527C013811
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404160101/show_ads_impl_fy2021.js?bust=31082835
Preview:	(function(sttc){'use strict';var aa,da="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} .var ha=fa(this),ka="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),la={},na={};function oa(a,b,c){if(!c\|\|null!=a){c=na[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}} .function pa(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in la?f=la:f=ha;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ka&&"es6"===c?f[d]:null;b=b(c);null!=b&&(a?da(la,d,{configurable:!0,writable:!0,value:b}):b!==c&&(void 0===na[d]&&(a=1E9*Math.random()>>>0,na[d]=ka?ha.Symbol(d):"$jscp$"+a+

Chrome Cache Entry: 696

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 600, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5926
Entropy (8bit):	7.906258989768089
Encrypted:	false
SSDEEP:
MD5:	A1B7DA1C8F753276706AF1A8E26545BB
SHA1:	D772A9640B5E56E66FE26A10260F4FFEF3F51160
SHA-256:	297C38C7450110354919CF96F6A7089F2E7DEE8C4B94ACB8E3E1826FC2D7CD59
SHA-512:	E3BE2CC2728F614FDB7C82811229D1FCC653CFC388F72AA4BB0C112EB54B3D149878FD1D4A59494015578349D79004FA2FC384AC44DBE019EA937AC2CC4622B2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......X......O.B....PLTE......BBB..............#<....H......XXX......&&&lll}}}kkk......'''I..5.....R..=.....A..t.wL......P........l....................'.OV..P..?..s..R.hA...........~........9.>...N.....O.S........................8.]b..T..O..w....N...........D.....P..6.=W..1.V..........y..G..K..c.f...g.l......I.d........t..h..............@..o....^.....b..k........]....c........ .'....=.Cq....q.............m..U.k...>....................................s...p....\|...........i...+.Q!.J...y..n.~................]..........e.v.........................}..e............u..........................................{.......>.[...............`.n......J.b,.S........f.}...........................7.\...........................\|............(..'.-,.`j....IDATx...x.e.....Sw3.I(!..$......0G...&r.M.hR.....".".!M..> *.g}.g..{..............;.....vf.i.y.2..<\|...A..A..A..A..A..$.l]Y...[thQ._X..n(.c."H......8\|.&\|.3..L7....:..\%.'.Az...

Chrome Cache Entry: 697

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.573620174038291
Encrypted:	false
SSDEEP:
MD5:	7BD42E5A35B5FB3FF852D6EA9191CA83
SHA1:	8A141EB392A05A2DEA3DCD83B97940EF70A81EBC
SHA-256:	5C4A713EE4250851232BE9F9F68D41586BE39B299528CFC7266E0B0E7E582E1B
SHA-512:	6FF31ACB937D6944570A837BB77AED92DAE41D71681440DC4765758FC40585F55999F2CDD78C4CE76A5AB414331BA9959BAFCFEF7E85B756AAB899C247F02890
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.......1....#IDATx...MKTQ...3...K...gP.Eo.Z$..6......"0..."..E-Z...C....+..E.T...JH/.HC.$d...y..."..W...w.3..3..9... ^..Fr4R.Q.....H<...\...V.[...v.L.D...y.wYQ....]....w&...\|F...iz8..b.s.r..[.H..5..5D..[@.ed.-...O..=..G..lpD.R.F".J....... .. y..$>.)V.`..quuP4.W9.}......y......~E}.7....IU.~.!.Ak.>....A..o..._.....7.4...{.K..6o.O..5.0n.`..z...V."^. 0.x=..^M...*t...H..9.B.(UD..>heD......."....W..T.E..0D.fYfI..3.-.G".....#.p....q.......Bv..{5.!u.F.i.......[.s.)....I....v.....Y.P.5?...n.'.......;...T......f......Q...~...8.....h.......T3<........IEND.B`.

Chrome Cache Entry: 698

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2685
Entropy (8bit):	7.9075687633928675
Encrypted:	false
SSDEEP:
MD5:	95C090F49EEBCBBECBCBBF6691283A30
SHA1:	4BC8B377040D7220105E74AAD7B42390DCEA8408
SHA-256:	BB6C43BA6E1CDBE5861B86B66CAB6E367B6D6D6492EB9797BF17E93CECBF8BD3
SHA-512:	DD9E4891E183007F9ECB79A3580229A11CB8EF589BE5E1F79FA6A9C7F2DC81E778295FB5CED25455D5D5173118A226AD076091CD1BF8C597126236F45FD47150
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/simgad/18311244436838294565?w=100&h=100&tw=1&q=75
Preview:	.PNG........IHDR...d...d.....p.T...DIDATx...kpT.....s.nn...PHB....0..J.).T......8.EQ..P...^......p...i.C...tJ.-7a.Bn$.....I ..s.}.D.(.\vC.\|fv2.9...>.=.<.9.i..i..i..i..i..i..i..i..i..T...........[....-.0z.m.j...7.........&.l.u.........6l..U{111.\|>....Y.fV...0A.DDBf..v.8x..........FDz.i.l.....D....u...7\(A..C.......S...U..E.$33S...%''G.......1{.l.....O...Y.p.DFFJII..:..KD.gdd. ^..O.....Iv..}u(k.......gz/Bzy..........s'n.......!.`.......&Mb.]...Q^^^8.w_..$@&N...].p.....<0g..eP....U(.UU.s........bYV@.?q"{v...vSU]]8.C.f vMM.@.O....m}..)/?.={...+....p...j...@.R."...t:....0.....\&//....Q___0m......0.._..8{.Ee..W./^./.........b[p.H...z..<. ......\.c{..%//....>b...>.........x.......H].....y...Q...4..;....&..Kdd...CCC.m..2...N\|\|.G.6l..O..~...3E?W........ah...FB".......)l.... n$(.....W..OD....U^N.KI.=..........v.........WV...s}..{...kPW........1".....M....."B....Ku...t)..F...t..e...sa..."#....".3/....D...\...X.z5+W.....%.\.....S..5...b 8P

Chrome Cache Entry: 699

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39869)
Category:	downloaded
Size (bytes):	40921
Entropy (8bit):	5.663905318654385
Encrypted:	false
SSDEEP:
MD5:	CF972B493BC454FA76C3987759834912
SHA1:	6BE9268780D5C74D0FFB6584F8B2CD5968EBC500
SHA-256:	64596DE4B8A864A0BDF9F9433DEF67B0C2472C2D4F6E2BBA7D1E8075AEC615D2
SHA-512:	9EEB0FCCBDC8A32F8C11DC7C3BE21629467640CFFF3C7FA5FF4C86AE8E67AAC5F187EAA32CF695E2542C5A449AB370ABB54828A4E826F3E7AB64FE00CC55E52D
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/bg/ZFlt5LioZKC9-flDPe9nsMJHLC1Pbiu6fR6Ada7GFdI.js
Preview:	//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==. (function(){function t(D){return D}var K=function(D,r,y,R,a){if((a=(R=y,Y.trustedTypes),!a)\|\|!a.createPolicy)return R;try{R=a.createPolicy(r,{createHTML:E,createScript:E,createScriptURL:E})}catch(F){if(Y.console)Y.console[D](F.message)}return R},E=function(D){return t.call(this,D)},Y=this\|\|self;(0,eval)(function(D,r){return(r=K("error","bg",null))&&1===D.eval(r.createScript("1"))?function(y){return r.createScript(y)}:function(y){return""+y}}(Y)(Array(7824Math.random()\|0).join("\n")+['//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==',.'(function(){/'

Chrome Cache Entry: 700

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2685
Entropy (8bit):	7.9075687633928675
Encrypted:	false
SSDEEP:
MD5:	95C090F49EEBCBBECBCBBF6691283A30
SHA1:	4BC8B377040D7220105E74AAD7B42390DCEA8408
SHA-256:	BB6C43BA6E1CDBE5861B86B66CAB6E367B6D6D6492EB9797BF17E93CECBF8BD3
SHA-512:	DD9E4891E183007F9ECB79A3580229A11CB8EF589BE5E1F79FA6A9C7F2DC81E778295FB5CED25455D5D5173118A226AD076091CD1BF8C597126236F45FD47150
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d...d.....p.T...DIDATx...kpT.....s.nn...PHB....0..J.).T......8.EQ..P...^......p...i.C...tJ.-7a.Bn$.....I ..s.}.D.(.\vC.\|fv2.9...>.=.<.9.i..i..i..i..i..i..i..i..i..T...........[....-.0z.m.j...7.........&.l.u.........6l..U{111.\|>....Y.fV...0A.DDBf..v.8x..........FDz.i.l.....D....u...7\(A..C.......S...U..E.$33S...%''G.......1{.l.....O...Y.p.DFFJII..:..KD.gdd. ^..O.....Iv..}u(k.......gz/Bzy..........s'n.......!.`.......&Mb.]...Q^^^8.w_..$@&N...].p.....<0g..eP....U(.UU.s........bYV@.?q"{v...vSU]]8.C.f vMM.@.O....m}..)/?.={...+....p...j...@.R."...t:....0.....\&//....Q___0m......0.._..8{.Ee..W./^./.........b[p.H...z..<. ......\.c{..%//....>b...>.........x.......H].....y...Q...4..;....&..Kdd...CCC.m..2...N\|\|.G.6l..O..~...3E?W........ah...FB".......)l.... n$(.....W..OD....U^N.KI.=..........v.........WV...s}..{...kPW........1".....M....."B....Ku...t)..F...t..e...sa..."#....".3/....D...\...X.z5+W.....%.\.....S..5...b 8P

Chrome Cache Entry: 701

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Reputation:	unknown
URL:	https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-941299-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 702

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 1572x498, components 3
Category:	dropped
Size (bytes):	35239
Entropy (8bit):	6.557108198908335
Encrypted:	false
SSDEEP:
MD5:	C39A0DF9B68E1F723B3927BF8DC25939
SHA1:	6FAAB829E8A1EA6ED48F2CD61126CDCE50885E87
SHA-256:	7832B2B1B0BE70D22A1DE6B8613BDDB9AB78C05FC00EC48EE56F824CC53B9157
SHA-512:	D58FEAB8FDF22B3F09950C2F3E5ED650B5A536BB55E1B564A66DBDA3C7EAA80ED5745734191F11ADA30BFE4CB8BCF4D4C7ADCFA7C5B78C1070C20DDA5B7BE9F1
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......%.......p...#...P..-...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................#.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

Chrome Cache Entry: 703

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (829), with no line terminators
Category:	downloaded
Size (bytes):	829
Entropy (8bit):	5.39594057604036
Encrypted:	false
SSDEEP:
MD5:	D586FAE048F997551E4386D7C2F3C596
SHA1:	CF0374B4536ACD1D2D7C8C430A2F7E7AAF61DB99
SHA-256:	3A68D7BCD8BF990FF1A992359439C86461F3D3AB60A275C2009AE0E9CE95C848
SHA-512:	EAEE710E9F1E2C56E4A1B3468BB2B7F4FA83A866147213ED7051F4ED6AF9496DCAA2E5C64D99598510942C218E151353387902DD29112CE57E8B4360573269D3
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/recaptcha/api2/aframe
Preview:	<!DOCTYPE HTML><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><script nonce="dlTINw-I6K4Y6QtfNxle9w">/** Anti-fraud and anti-abuse applications only. See google.com/recaptcha / try{var clients={'sodar':'https://pagead2.googlesyndication.com/pagead/sodar?'};window.addEventListener("message",function(a){try{if(a.source===window.parent){var b=JSON.parse(a.data);var c=clients[b['id']];if(c){var d=document.createElement('img');d.src=c+b['params']+'&rc='+(localStorage.getItem("rc::a")?sessionStorage.getItem("rc::b"):"");window.document.body.appendChild(d);sessionStorage.setItem("rc::e",parseInt(sessionStorage.getItem("rc::e")\|\|0)+1);localStorage.setItem("rc::h",'1713386494542');}}}catch(b){}});window.parent.postMessage("_grecaptcha_ready", "");}catch(b){}</script></body></html>

Chrome Cache Entry: 704

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 960 x 30
Category:	downloaded
Size (bytes):	1485
Entropy (8bit):	5.82497433698781
Encrypted:	false
SSDEEP:
MD5:	2DBF707EAE24C8BFC799A6C59B1AF0A7
SHA1:	B8EF22BE2E8A3AF94C96F4B85072570CABD0FC83
SHA-256:	2486D3EC361BDA5B6565C6860784C66E5DC6CA09C7F9C7C48B3AF970F489EFC1
SHA-512:	3CCE7533901A0026409B51081521C5F830AF10C6A234C37DD72AFB5A22284A9C0696CF8874DC89373EF6B9ADF9E7C02A1F440547D72EC56F5A50A87320875C41
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/footbg.gif
Preview:	GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,........@.../\0.......\....#J.H....3j.... C..I...(S.\...0..@`@ ..8s.....@...J...H.]...P.J.J...X.j....`..K...h.]...p..K...x..........@.....+^....#K.L....3k.....C..M....S.^..c..c.M....

Chrome Cache Entry: 705

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3526)
Category:	downloaded
Size (bytes):	5279
Entropy (8bit):	5.541656736520127
Encrypted:	false
SSDEEP:
MD5:	D7C43DFC4FE9914C77DB03EF636FF79E
SHA1:	A91B0E31D534AEB9D84C1A4EEFCF56E03907EC66
SHA-256:	8885CA839FC8DE48E670DA53DA411FFF635ABF4308C969532D3C3D423843E3D7
SHA-512:	4DC588E9A6AB13F8023B0879C3381B771A0CADF65B66B0627995C0F1AA2AC9C0242A7793EBE12518FAF283EF6A99275B25E19D7561CE7D432009F17458DF6578
Malicious:	false
Reputation:	unknown
URL:	https://p4-aw7vdoaqd4hlw-pa4eu276oujsn2dp-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.</head>.<body>.<script type=text/javascript nonce="Xr8br3z5J17pvrsS6DkkXA">.(function() {../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self;var k=function(a,b,c,d){var g=["i1","i2"];b=0==a.nonce%2?[c,b]:[b,c];c=[];for(var e=0;e<g.length;e++)c.push({g:b[e].g,url:h([[a.v,a.H,a.G,a.nonce].join("-"),g[e]],b[e].h,[d])});return c},l=function(a,b){this.Z=a;this.X=!0;this.u=b},m=function(a,b){function c(e){null!=g&&(d=Math.abs(new Date-g),e&&(d*=-1))}var d=-1,g=null;this.W=function(){var e=new Image(0,0);e.onload=function(){c()};e.onerror=e.onabort=function(){c(!0)};g=new Date;e.src=a};this.K=function(){return b};this.aa=function(){return d};.this.s=function(){return[b,d].join("=")}},h=function(a,b,c){return["//",a.join("-"),b,c.join("&")].join("")};function n(){}n.id="ad";n.O="//www.google.com/favicon.ico?";n.L="//pagead2.googlesyndication.com/favicon.ico?";n.i=function(a){var b=a.s(),c={g:"g_img

Chrome Cache Entry: 706

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............,...........D..;

Chrome Cache Entry: 707

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	143
Entropy (8bit):	5.079318363208902
Encrypted:	false
SSDEEP:
MD5:	E4E31B474D3E0B577B3C8856E91F8659
SHA1:	A81311F7FCFA9B6B23A24D4E5C976D5F75B1B9B7
SHA-256:	18088C10E79C926292732AF98A0CE470E90F3FBCBA4BB4896AB3310C2D94E421
SHA-512:	A07961EB39C4CD4E39EE19E2C675E64E5BA5367DAA18E2F76A23772ABD62F46B002E6BE8FB0F35A70616941178FACC8DF579C4A68E5811B74313C12806AAFAE3
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Preview:	<!DOCTYPE HTML PUBLIC>.<html>. <head>. <meta http-equiv="refresh" content="0;url=https://www.google.com/pagead/drt/ui" />. </head>.</html>

Chrome Cache Entry: 708

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2888)
Category:	downloaded
Size (bytes):	20370
Entropy (8bit):	5.522634512019388
Encrypted:	false
SSDEEP:
MD5:	308A5F23E118C0CF9F688A5D70F90C6F
SHA1:	3E1C92A62743FE1A8B42C7498D792CD47C235281
SHA-256:	9709CAAEB47935E01F79E18B93611C0CACD448454BE40C3A3D99D7B041A59C3C
SHA-512:	D275C6E21B6DA33312B645B4816A1B741B944B82BA48BFEE2369CC6ACEAE8C9EBCDF23E99C32B731B7376FD57260269197BA00B645D43B577CADB27B12D1401B
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/client/qs_click_protection_fy2021.js
Preview:	(function(){'use strict';/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var q=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=q,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1}function ba(a,b,c){return a.call.apply(a.bind,arguments)}function ca(a,b,c){if(!a)throw Error();if(2<arguments.length){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}} .function r(a,b,c){r=Function.prototype.bind&&-1!=Function.prototype.bind.toString().indexOf("native code")?ba:ca;return r.apply(null,arguments)}function da(a,b){function c(){}c.prototype=b.prototype;a.O=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.P=function(d,e,g){for(var f=Array(arguments.length-2),k=2;k<arguments.length;k++)f[k-2]=arguments[k];return b.prototype[e].apply(d,f

Chrome Cache Entry: 709

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 728 x 90, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5457
Entropy (8bit):	7.9308269770713
Encrypted:	false
SSDEEP:
MD5:	6538CB762E86C6D2DC5FFD79EBCD7CA5
SHA1:	CA2CDAA2B61EAB0578B949AA11096C539607CCD9
SHA-256:	CA23172A3431C3F72882E1AE7534A4B481D0D85A5B6BCE884BD9B921E6A697A7
SHA-512:	3E933D166A4F03EDB256461CE24D6575FFFD0B515E52D2927054E3A46A5A8DE7E8AA90951AD0991BDC939865C18602710981F389F1D74DBB024DC44CCBCFF522
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......Z.............PLTE1.(/.' Z.......3.&#.....4.&..&...................RRR...1.(............'''0.'SSS666...FpCDDD......555...}}}oooppp.........aaaFqB0.'.../.&/.&.....%+.#..%...-.%,.$......0.'G.@{.v,.$...J.B(. ..+..d.]$........~.y#\|. v......a.[......!y.&'...."....&.....#..%..+...U.0..,..W.P...H.A>.53.1.&.L..........8.......&..s.p A....$0......"8.FjB....j................!M....)......../..........KuG..................`.............%%.q.k...(.....;.6.y................$W....<r.......\.W....&.......@}<J.EX.S5...q....=.7...).":.3f.a,.......-..$E.'=....\.U.............A.;........r.m......../8....A..........(3..o..........qH.Tr...?..F.........q.J:................q.li.......(r!F.........Q.p.k......$1.@<..<.a..S ."..........[.W......`..1.)...+T&l.jG_E@Z=......Sw.&i...e....IDATx...\|.U...Z.B......*..P).;CB...2..dUp..E.A9..r...%..........`t...8..k<>.s8.}...}...^Uwu' .t.I.?\|..UG...{.^.b.l.Z..'`..f.......3.63f.lf.lf....1..1.p.y...1..`..T>...Dx5-.

Chrome Cache Entry: 710

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4068)
Category:	downloaded
Size (bytes):	171291
Entropy (8bit):	5.5066593489864
Encrypted:	false
SSDEEP:
MD5:	482E8377D8544EC361299C1C3F00E4F8
SHA1:	942D2D757C04AC5D039D3CE63BB4666A0569D07B
SHA-256:	C86FF29F5F0F99A96FD32F61F8AC55E6631F24EB0DE779FF0ACB0D59B78A1816
SHA-512:	2141A73B5A702EBB8449E8166D8F66B30334109162A8E9772D8B5443ABA8B81E584F3200ED928E854D8BE549898B06BB60D339818FD699FF413FBFF6F9E7913D
Malicious:	false
Reputation:	unknown
URL:	https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404160101/reactive_library_fy2021.js?bust=31082835
Preview:	(function(sttc){'use strict';var p,aa={};/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ .var u=this\|\|self;function ba(a){a:{var b=["CLOSURE_FLAGS"];for(var c=u,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1}function ca(a){var b=typeof a;return"object"!=b?b:a?Array.isArray(a)?"array":b:"null"}function da(a){var b=ca(a);return"array"==b\|\|"object"==b&&"number"==typeof a.length}function ea(a){var b=typeof a;return"object"==b&&null!=a\|\|"function"==b}function w(a){return Object.prototype.hasOwnProperty.call(a,fa)&&a[fa]\|\|(a[fa]=++ha)} .var fa="closure_uid_"+(1E9Math.random()>>>0),ha=0;function ia(a,b,c){return a.call.apply(a.bind,arguments)}function ja(a,b,c){if(!a)throw Error();if(2<arguments.length){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}

Chrome Cache Entry: 711

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 450 x 314
Category:	dropped
Size (bytes):	48015
Entropy (8bit):	7.931789206969988
Encrypted:	false
SSDEEP:
MD5:	4A9EE6787CBA9FC64927EF4A75C172EC
SHA1:	D9BFE7778BD16571D84058BB47D221A8BB254BC9
SHA-256:	EE172F27571E2E184509331861C167A80016B95E7E9229D3606A8D7E999D870F
SHA-512:	DF29AA36E4668EEBE338204FA7969CEBCDF5012CA5FAE97B48EEDB4E60D4849F0A841BD87DB19C9663D0B8D5D404B677D3BCE799ECD34D46FDE52325969C0F7D
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..:.............111ccc.......................................{{...B99...)!!cJJ{ZZ1!!J11c99..kc............ZJ.J9.B1.{s.kc.s.J1.{s.sZ..{cB9.kckRJ..s.cR...kZR.{k{ZJ.cRZ)........{.....s.kR{R9.kZ.{cZB1..s.{............{....{........s...s.{Z.sR............{.......s......{............R..............................k.......).Jc..B.k{.......B.kZ.......Rsk.........s{{kss...Zss{.....{...R..B.........R..9........9...9R...s..k....{...Js.........s........s..!9J.....9Zs1........R..k........s..Zk{Rcs1BRc..1........k{.........{..Zs.Z{.k..9RkBc.)R{B..RZcs..B...........s....{..k..c{.Jc....c..9JcZ{....k..Zs.Rk.Zcs{.....s{.ks....cs.BR{Rk.RZs)1J!)B9J.s{.ck.BJk......ss{RRZZZkss.{{....JJcss.1)BB9J.k....RJRJBJ.{.sZs1!1.s..k..ZsRBJcRZ.Zk.k{.cs.ks...,......:.@.....0g.O9...L.p....I.hPb..3b.1...A..I...(;FL..K..Gr...&.............J........@9....a....R..`......4...AYL...%Km.jC....].t...TKm_.....[.0....+^..c..j.l..0[.9..3..Cq.....M...z..P.a.N]....

Chrome Cache Entry: 712

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	205
Entropy (8bit):	6.471232950817362
Encrypted:	false
SSDEEP:
MD5:	4087858E2C9DB9AA8F6A840AEDCFB533
SHA1:	D1FFE861DA6BD0E95FD1A365B0C3D3CEB6CD58A3
SHA-256:	4D45982F2DC34F36C9045EE46A75A1943666BB7FD64E103CAC8C7429E7012840
SHA-512:	541228667C513266FFAC017AA43CCACEA410E20BF27D30599276E9984FAC2C433AC58288C19F7A5BFEB1C9B4074B8C9C472080BF1C706303F97B2CE73DBD634F
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Preview:	.PNG........IHDR...0...0.......1.....IDATx...1..1.DQ.f....@H.....%`..j.M&"....5....;...;.......\.....\..U.4..pe.<.P.....%... ...@....p.....@...X...5..{.$.x^....y=..z.......\|.......+.........IEND.B`.

Chrome Cache Entry: 713

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1595)
Category:	downloaded
Size (bytes):	22237
Entropy (8bit):	5.510919230443012
Encrypted:	false
SSDEEP:
MD5:	E82FE4654667294C3F3E977DB2D1995D
SHA1:	7E2BA8BCF7A598D125B3BACBF912CA26CAB2EFC6
SHA-256:	D67570E6EAC285B35DBB7E4E942474A71B78B82AA41BEF296D24AD9086BC58C1
SHA-512:	1DDFA8D35F8986621FB77864007C34BB37EFCA30CC4A9D93D249FF6895702D9DB430D5CCB3FC9AE593F5BEE9C0C8B673D235A07863FD4CC9438AE5F805361A7C
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/elements/html/interstitial_ad_frame_fy2021.js
Preview:	(function(){'use strict';/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var n=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=n,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1}function ba(a,b,c){return a.call.apply(a.bind,arguments)}function ca(a,b,c){if(!a)throw Error();if(2<arguments.length){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}} .function r(a,b,c){r=Function.prototype.bind&&-1!=Function.prototype.bind.toString().indexOf("native code")?ba:ca;return r.apply(null,arguments)};var da=aa(610401301),ea=aa(188588736);var t;const fa=n.navigator;t=fa?fa.userAgentData\|\|null:null;function ha(a){return da?t?t.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function u(a){var b;a:{if(b=n.navigator)if(b=b.userAgent)break a;b=""

Chrome Cache Entry: 714

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x52, components 3
Category:	dropped
Size (bytes):	614
Entropy (8bit):	6.3992707733074985
Encrypted:	false
SSDEEP:
MD5:	5E92E73749ECAF1F0C042272DC337971
SHA1:	09DB2F0BEDF5FB5FCE02D9684A2654C6E12CFD84
SHA-256:	9080ED8FA20AB424C05F8B02E0318C4DFBC7552593D2AF3D3B38369F9E066DC5
SHA-512:	94F08002912227625CDF4E481C358A1BCBC5606AF24338CD61F0F473ACCE3DC07531E6B6AAF1CDEE2F8F08AA57E69A984F0BFC0CBF17BFD17208070C4F369EB7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF................................................. $.' .,#.. +.,01464.'-=,01.34&...........2!.!22'000022&2.23/30,&2332-2&22,232.00)2&,3'-2/2-&)......4.d.."......................................+...........................1ATq...!Q...B.............................%.........................!1....2qr.............?....................*.?Q2.#..oQ.9..oT....C..r......+..w..g.....'.....Og9U?.j\|..).e/...]>.................~.....^......m;+.sv...i.g......Y.c:1..:L=......G^.Sw......4..?q.....=W.'......\..'.a....P..V...........h'..((...<qY.t.RX...b....JL.bg..0.................................

Chrome Cache Entry: 715

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 100
Category:	downloaded
Size (bytes):	919
Entropy (8bit):	4.389585376499275
Encrypted:	false
SSDEEP:
MD5:	44861EEDC752A076F749F95DC8502A85
SHA1:	4D0D175C8C7B750EF0E8B23B64FA76C35A9A3006
SHA-256:	F5EEE58DC54D8FE9DB5B64589DF985D74981233FA0282E0D9A93D8C7E4BB2A6A
SHA-512:	8381D4A7AF6CD00A15A70A72E2167581341C67F9A666F7401397CD76234FCBC0685A588C9AABDD8AE76D8E0C9E7C9E5643884D15B3B9C53DD6A40ECB0DAF885C
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/headerbg.gif
Preview:	GIF89a..d.....7z.I..8~.=..;..J..?..>..>..;..L..?..;..@..@..:..6x.K..@..D..7\|.A..I..E..F..A..C..D..K..F..H..6z.H..K..G..K..F..C..9..J..H..B..B..E..5w.G..9..<..:..7{.5x.=..8}.6y.L............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,......d.@.q....1A...1d.p..A...T,H ......p......%288...... ..C...3.HP0"...P.hA....RTh`..../.<.q.B..5d.X.!...&`< .b.....T...;.....hP! .;

Chrome Cache Entry: 716

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 960 x 30
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.82497433698781
Encrypted:	false
SSDEEP:
MD5:	2DBF707EAE24C8BFC799A6C59B1AF0A7
SHA1:	B8EF22BE2E8A3AF94C96F4B85072570CABD0FC83
SHA-256:	2486D3EC361BDA5B6565C6860784C66E5DC6CA09C7F9C7C48B3AF970F489EFC1
SHA-512:	3CCE7533901A0026409B51081521C5F830AF10C6A234C37DD72AFB5A22284A9C0696CF8874DC89373EF6B9ADF9E7C02A1F440547D72EC56F5A50A87320875C41
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,........@.../\0.......\....#J.H....3j.... C..I...(S.\...0..@`@ ..8s.....@...J...H.]...P.J.J...X.j....`..K...h.]...p..K...x..........@.....+^....#K.L....3k.....C..M....S.^..c..c.M....

Chrome Cache Entry: 717

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 718

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 478 x 583, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	12048
Entropy (8bit):	7.784483382002988
Encrypted:	false
SSDEEP:
MD5:	F00FB8D963212BEA8D5FCAA9B618C690
SHA1:	E3D696634A37016E45EEA904E8D94AE41A958737
SHA-256:	52EA398A3D12CD4BE21F7499093EB973B316B8B9D109ABB9470E5AC665759B71
SHA-512:	6E2D00362112AAFDF9E374F3C0F5D0BAC96A31F12DAD5B09FD66A30B46F73F9B5261714A159967175F989D8AF26D1F40A5C33851B353B36D22E6096F5840BF4A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......G......}......sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^.......z.>.n..K.@..ag!.v..o9bw.......}.]OPW.W=....2<...X.YZZ..GFDFVzF~?...?w..V...i>.....[.n..s.g}.d..g.@7.f..........;T3.t.j...P........C5.@wv..G...z"....?R.....e..?........T3..Dj............O...._...'<..W......p.......n.x.m>...O6.}x...v.jn..K[....~H-?.{7Z.fk..MT....4..."R......Vu....l.].t{..9T.....u..!/....u.Qz.6.pP..\|..7.?.pW.....9L.....oL..&v.^.h..8&.......A{.T...p.......W.lM./..G.\|.[cO.Z..x\........d;<`wB.T...\\.m...@Ij.......r......P^.R.e]....?AT.........."...s...:.TH-?...[[..k..[.}%..8.....*+.)...5.....u>.....S.?..G......%_.~..........VS.ze.7....J.[.E..w..).....'.....7.s.H.c..;.._Nz........W[M..+V.q.x.67..ux..G.w6b...n.y.T..5.;.d...Y..Nj..7......\|B.....P.6....+......-b.Mx..."....y..n...z<...,...........f.p.....?.`.:m".{e(.}._.uy........7.D<7.Q;.'.#..h.......?............@....j.z...........LB5?...!.............;T3.t.j...P........

Chrome Cache Entry: 719

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2553)
Category:	downloaded
Size (bytes):	23530
Entropy (8bit):	5.497656132776961
Encrypted:	false
SSDEEP:
MD5:	7FBC48EABE9BB1BEF523CF346C9E5363
SHA1:	FAB1C4A60DD82A0EA5EC61EE75A9D3D9DBA2472B
SHA-256:	51586EC2D56DC12C32B65B0612D89695B3A5B7D0C91592ACAD6EC8A04F8701AA
SHA-512:	EC7DED2166D3A59AF2A7EF2D792753007F4F7C872FE1842D9340080580BB4C56951F2C5DBC4E4BA71BAC8D1B43CF961FC10BF3336BF7F5980DD972B559B2F43E
Malicious:	false
Reputation:	unknown
URL:	https://tpc.googlesyndication.com/pagead/js/r20240416/r20110914/abg_lite_fy2021.js
Preview:	(function(){'use strict';/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var m=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=m,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1}function ba(a){return a};function ca(a){m.setTimeout(()=>{throw a;},0)};var ea=aa(610401301),fa=aa(188588736);var n;const ha=m.navigator;n=ha?ha.userAgentData\|\|null:null;function ia(a){return ea?n?n.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function q(a){var b;a:{if(b=m.navigator)if(b=b.userAgent)break a;b=""}return-1!=b.indexOf(a)};function r(){return ea?!!n&&0<n.brands.length:!1}function ja(){return r()?ia("Chromium"):(q("Chrome")\|\|q("CriOS"))&&!(r()?0:q("Edge"))\|\|q("Silk")};function ka(a,b){return Array.prototype.indexOf.call(a,b,void 0)};function la(a){la[" "](a);return a}la[" "]=function(){};!q("Android")\|\|ja();ja();q("Safari")&&(ja()\|\|(r()?0:q("Coast"))\|\|(r()?0:q("Opera"))\|\|(r()?0:q("Edge"))\|\|(r()?ia

Chrome Cache Entry: 720

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 300 x 68
Category:	dropped
Size (bytes):	399
Entropy (8bit):	7.366744684924001
Encrypted:	false
SSDEEP:
MD5:	EAB4B7C1964754BFA854D2F251E6B239
SHA1:	86331CB008BEA722981CB04AD25AF7964841BD9F
SHA-256:	3BA1F37896E4B76F1F65D6D0DE9F0875A9A13E87DC9E78D086AFDACF608BD91E
SHA-512:	6B804924B691EA9E482D7C2E678D43ED3EA9549441AF45D1CC114BBC0F25577C8C9E597DB458B051B2202B250FE96D7CA41FD59C06063C8F0C58A356EBAA1AA2
Malicious:	false
Reputation:	unknown
Preview:	GIF89a,.D.....C.`..b..............!.......,....,.D.@...1..0.I..8...`(.di.h..l.p,.tm.x..\|.....@,...r.l:..tJ.Z.....z..xL.;..z.n...\|N....~..............}w............_q..........s..................................c.......Q.................o....c....[....V.................H......*\....#J.H....3j..T....B.<c@..(..K....0...I...8......@=..J...H..M....P..J...X.\..5..`...K....;

Chrome Cache Entry: 721

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 35 x 15
Category:	downloaded
Size (bytes):	1994
Entropy (8bit):	7.040549588105179
Encrypted:	false
SSDEEP:
MD5:	C123A1142CD0E858531455F7119AC623
SHA1:	8FBE613EE7A89C273B73AE2E1F1B24D461723DE8
SHA-256:	3F7923E3B28CD8F2507D56C7688E47219C82971E985FD5C340BA7BAE372902BD
SHA-512:	3C7A75F4DC9C18EB2AD89B1BB9469B035A4D4E88F9BEAFBB7692FF4AFDCC2A2704A6B90DF223A2B7835EE2E0F8A5CC8CB7DBB5A3451C09AC8898E1A6DAF82BB9
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/NEW.GIF
Preview:	GIF89a#....M.................... ................uu..........ss.>>..........^^.UU.............FF.......55..........BB.............JJ....ii.\|\|.......[[.........................QQ....::..........qq.........................MM..........33.ff...............................................................................................................................................................!..NETSCAPE2.0.....!.....M.,....#......M....M.J.....&I&...ILL......................&LI............J.J.J....L.J......HKHJKI.GG....K......GK.G..I.KK.H......L........x8.../r...w...A..qkg..5t.(.:r...S......T. sAD....Y0G.@A...E/_.$%..!..B!.d.....,...b.....$.0h...P...!.....M.,....#......M.....J........1'1...L.....LL....'.LI...........''..........IJ.J.J..I..I....7...HKHJK.KGG....K...M.*.G...I.KK.H........L......5..! .x....>..'.p...9&.:..N[.S.....dXI{..4.T.p.@..6...N..."T......D.....%.@.pP.........h....P..j.@.!.....M.,....#.......M..................L.......I.....LL......=$$=I$........

Chrome Cache Entry: 722

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsumXCHd5Zlg4mgA59sux28hEQ9MJ1vtqL2vq-tOlwgXot2uLVh3GIMz4P0-xvjty8Me4jMi3QvyKV5SUtmgO5J4IH8Slc2NQbjv_bL4BpAFuhdwqmkvQ1zUmwCvalk1W4mzAmjU9S0tGotFC6HwBAW3C46DNiRoBok&sai=AMfl-YQk2aki0xh827J96EDOxvcIZ151rQoj61VVrPLxw03vFtGQ_7g2t72YZCGD4ib7oQ1S0rkOfpVPebWF_93OHqSkNnR0ut3Fdfg-fTfOv-CYl6wU7pppO9QM5DQAXJ92nAFDqpRmB-rBsfK-Gs8A&sig=Cg0ArKJSzHeNwB2dWGvXEAE&cid=CAQSTgB7FLtq0a4HPjDsTvirOXQSoKzDaUOzvMDW6ce-ncuzKjXG8ohvYrF3D0p1IFuQqEj1DR9rMD9Ed7elLLaSwKeBvb3sAEE2-_aAX_tNfxgB&id=lidar2&mcvt=1015&p=0,0,600,160&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20240415&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1812271804&rs=2&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&co=931928500&rst=1713386483629&rpt=1638&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 723

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2573)
Category:	downloaded
Size (bytes):	10902
Entropy (8bit):	5.508095400189464
Encrypted:	false
SSDEEP:
MD5:	AD1DDA460B76B599261F3BF327C10D91
SHA1:	A9B0BD95540ABC0F56648321B524D1BE2600298B
SHA-256:	95E0C57F4091483E93ABD651204DE103EC759518C1C84391CD92731898C0D5F6
SHA-512:	B4C001555F4F5741750ADE232F1630668595AD0BEA5B663D2EAF0645D76937DA38AE8B7C7FD1779BE14F8C1C39F8CC2D2D985C1BD2B6D4D9FB5B6557174E069F
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/mysidia/ad1dda460b76b599261f3bf327c10d91.js?tag=text/vanilla_highlight_ms_cta_adjustment
Preview:	(function(){'use strict';/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var h=this\|\|self;function l(a){a:{var b=["CLOSURE_FLAGS"];for(var c=h,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1};function aa(a){h.setTimeout(()=>{throw a;},0)};var m=l(610401301),ba=l(188588736);var n;const p=h.navigator;n=p?p.userAgentData\|\|null:null;function r(a){return m?n?n.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function t(a){var b;a:{if(b=h.navigator)if(b=b.userAgent)break a;b=""}return-1!=b.indexOf(a)};function u(){return m?!!n&&0<n.brands.length:!1}function v(){return u()?r("Chromium"):(t("Chrome")\|\|t("CriOS"))&&!(u()?0:t("Edge"))\|\|t("Silk")};!t("Android")\|\|v();v();t("Safari")&&(v()\|\|(u()?0:t("Coast"))\|\|(u()?0:t("Opera"))\|\|(u()?0:t("Edge"))\|\|(u()?r("Microsoft Edge"):t("Edg/"))\|\|u()&&r("Opera"));var x=Symbol(),y=Symbol();var z=(a,b)=>{a[x]=b;return a};function ca(a,b){z(b,(a\|0)&-14591)}function A(a,b){z(b,(a\|34)&

Chrome Cache Entry: 724

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 596 x 533, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	11582
Entropy (8bit):	7.752501554292733
Encrypted:	false
SSDEEP:
MD5:	B1CF0A0668C0D09C3EC78B161E964464
SHA1:	90310830F88F0493EAA1F9DC7B4CA00F9DC2C039
SHA-256:	E5D09079353BDB2F3D4B06CD6F8B0C8B9E14DB7190E897EA83502ECC1F78D727
SHA-512:	63FC557CE2AFD07EABE7D1086FE0344526F7F81E55E1B19BA60024A91FA2DFA46157A13B99745359AABC7BBE43319B45E17C6FE14E21C8D86675AF21750F6F06
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/DocProp.png
Preview:	.PNG........IHDR...T.................sRGB.........gAMA......a.....pHYs...t...t..f.x..,.IDATx^....F....6T\|....@...k'6`.up.,......7~...8<\....7...N.tb...M....9../...bw....$...+.E.....{Z..{.....;... ~....?.@u....:...P.........T.....C....!~....?.@u....:...0w......ng@.R'......o........{..~F.,~Z.%=.s{....d...:...E..M.r.h.zG....?M....<....\r....O.c...y.?)...?.8C/u..I...Y..Q}.....2G..q......z..8.4..Oe'.G.~.^...K1.v{..&.c4...;.L..W..................6x~......Q.....h...v.....%=.3......k..{.;...s.vl.;.?.#...=..$.!3K.....N.{..^z.p....J...{.=Em..._.J...]...P\|~0{\|.`.]._.].7....]......K.......U.............@m...O......+.8..kz0{\|`dO..g.._..yJ<S(..;'.J...Yt3..n......T.)......6.T...~..kt.p{,qH.W.......J.2.^{y<Sh.H<U..u....U...3.".:=.......>.^ow....,..p........b..48..K../3<-.)4rd\|+8.f.N...W9..J."......g..:.O..9x......_/..>.W..........N..Z...fs..._f.*...P\|./.jx..O...{....T.y..;1..vh0........9t...$...^N..n....?..&....{^;.L..=.A.../<...2.)...3C..3z..~.Z..

Chrome Cache Entry: 725

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 400 x 62
Category:	dropped
Size (bytes):	2417
Entropy (8bit):	7.721766417107115
Encrypted:	false
SSDEEP:
MD5:	67FBC3737FCA56E812F1B0578FBF89AF
SHA1:	241C09E340F16BC9E9D330D689A61DFC97243D83
SHA-256:	51B3F4BAAA34B9D033743B4A09A626AF56AB475782A45C66F29C8190F7BDE8C7
SHA-512:	15122D9F241F268362BC533BE129AA723F3DA0DFC8D05162DFACD2F7CE8EA050A5D75B8F944810C497AF89881B589A2E02ACFEDFFCA97CF0B937587787BF2B91
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..>...........x"....v8....tH....rR....p]....nf....ko.gv...e}...b...._....\....Z.x..tW.ev.`T.Jc.HP..L..............................................................................................,......>.@..@.pH,...r.l:..tJ.Z..v..z..xL.....LIp...fM...t.`...1W.....Vz~...D....E..}.O...M.}o ~.E...x...F..J..C..p~.D.\|..}.B.{..~.D.}.F.{....Q..C.~.C..C.B..D..C..B......K....D......C....D.....\.G...#....'.`....1.....w..$....E...\|..1.......@.\."..Y........`Ky`........D..".\|,Ac.s.J..t.\|..!.y.2..@..?..2\p.`H;..:\|.(@....."p.....D.j.`@...s..s...Y....uW...."K.L....3k.....C..M....S.&".....@.ZM......(.3...!.f{0.g.O..h.....D...q......jj.S8......=..._O&.Trw........ $...#..P...~0..RC0..+4%u...,..+.qWD,~...TV@.T+.....N.>.K.D..K9"F..FB.....`t...(........D.U.c.....+.E..Dl.Q..)QA..........<.L..m\v..y).d.i.h...l...p.).t.i.x.g....A(...p....R..'w...O.......Gh...1...fS.3.R..2...\J.j.C).[..n.G.v\|0....a.Hl.....$...z.. p..M..a....F..:......(....o..l!B<.I.........._()...U)

Chrome Cache Entry: 726

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	104846
Entropy (8bit):	6.088491227545121
Encrypted:	false
SSDEEP:
MD5:	4B27C8A35D74C8F57AAB89815DBA7076
SHA1:	50F1B6BB67D612B208C8BE8C43E9F7E3CFA508EA
SHA-256:	483F3AF1A0092292F8DCF61E744EBBF849FA1254A05FF3A222B2C295CD39A487
SHA-512:	C92564662107E37808761358842070ACC0D558F3A2F6DEAB1F37F96659DDD3B475FC724A93BDF217767764317D7DD0D9B2F3D78A4CC291992E2DCC1B0E3E77B2
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6555658820068848&output=html&h=600&slotname=8138180617&adk=373269726&adf=126291155&pi=t.ma~as.8138180617&w=160&lmt=1713386480&format=160x600&url=https%3A%2F%2Fwww.cutepdf-editor.com%2Fsupport%2Fwriter.asp&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&dt=1713386479208&bpp=1&bdt=1018&idt=1057&shv=r20240415&mjsv=m202404160101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=728x90&correlator=464567931983&frm=20&pv=1&ga_vid=983432702.1713386479&ga_sid=1713386480&ga_hid=274577743&ga_fc=1&u_tz=120&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=867&ady=420&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31082771%2C42532523%2C44798934%2C95328467%2C95329428%2C31082835%2C95322329%2C95329830&oid=2&pvsid=1167234827264558&tmod=1431185080&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=d%7C%7CoeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&bz=1&td=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=1063
Preview:	<!doctype html><html><head><script>var jscVersion = 'r20240416';</script><script>var google_casm=[];</script><style>a { color: #000000 }.img_ad:hover {-webkit-filter: brightness(120%)}</style><script></script><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20240416" data-jc-flags="["x%278446'9efotm(&20067;>8&>`dopb/%<1732261!=\|vqc)!7201061?'9efotm(&20723;>:&>`dopb/%<1245;05!=nehu`~"]">(function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var q=this\|\|self;function aa(a){a:{var b=["CLOSURE_FLAGS"];for(var c=q,d=0;d<b.length;d++)if(c=c[b[d]],null==c){b=null;break a}b=c}a=b&&b[a];return null!=a?a:!1};var ba=aa(610401301),ca=aa(188588736);var t;const da=q.navigator;t=da?da.userAgentData\|\|null:null;function ea(a){return ba?t?t.brands.some(({brand:b})=>b&&-1!=b.indexOf(a)):!1:!1}function v(a){var b;a:{if(b=q.navigator)if(b=b.userAgent)break a;b=""}ret

Chrome Cache Entry: 727

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 300 x 68
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.672596140664992
Encrypted:	false
SSDEEP:
MD5:	AD8D58521AF2AFD68D9060E1A368CC69
SHA1:	D58BD9D3A37AC0888A4FBE6DF077223F7740E2F9
SHA-256:	8667633125D3B6DBABBF9543340A292F0553A9862617DEE161C130E86A8CBF26
SHA-512:	F921BA1B7CF90CE87AC5CB22C205CDA56AC1556FB8A3D13614A84DC7AEE856F0CBA750C53C3E8811B15738F6FD042159A356A8E865F3DBB8647C77B790B919B9
Malicious:	false
Reputation:	unknown
Preview:	GIF89a,.D....Dr.Cp.Fu.Ft.Es.Er.Eq.Dp.Dq.Hw.Gv.Gu..C.4b.4a.Gy.Hx.K}.Jz.J{.Iy.I{.Iy.L..L~.K\|.M..M..............!.......,....,.D.@.. .<Zi.h..l.p,.tm.x..B....pH,...r.l:..T..X..v..z..xL....z..l..\|N.....~..........;.........2..........................................................'.......................................................H......\....#J.H.bEH.3j....e C..I..$S..\.....Z.I.f..1k.........J...H.]...P.J.J...V5.....`..K...h.]...p5..K...x..........L....5.Z....#K.L....3k.....5..M....S.^....c.M....5..........N.....+_.....=J.N.....k..]z.....z........r.S....{..O.>.s..../.J~.....@..h....Q ...6H...F(a)&4`...d...v.. .(.$.h.(...,..".. .4.h.8..<...@.).D.i.Gj@.L6..PF)..h0..Xf..\v..`.).d.i.h...l....p.).t.i.x..\|......Z...$..6..F.Vj.f..v..X ..j........*..j.j ........+...k..&...6...B+.n.Vk...f.....E..+..k...........+...k...............l...'....7.Gw.G,...Wl...g....w... .,..$...(.

Chrome Cache Entry: 728

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	604
Entropy (8bit):	7.573620174038291
Encrypted:	false
SSDEEP:
MD5:	7BD42E5A35B5FB3FF852D6EA9191CA83
SHA1:	8A141EB392A05A2DEA3DCD83B97940EF70A81EBC
SHA-256:	5C4A713EE4250851232BE9F9F68D41586BE39B299528CFC7266E0B0E7E582E1B
SHA-512:	6FF31ACB937D6944570A837BB77AED92DAE41D71681440DC4765758FC40585F55999F2CDD78C4CE76A5AB414331BA9959BAFCFEF7E85B756AAB899C247F02890
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Preview:	.PNG........IHDR...0...0.......1....#IDATx...MKTQ...3...K...gP.Eo.Z$..6......"0..."..E-Z...C....+..E.T...JH/.HC.$d...y..."..W...w.3..3..9... ^..Fr4R.Q.....H<...\...V.[...v.L.D...y.wYQ....]....w&...\|F...iz8..b.s.r..[.H..5..5D..[@.ed.-...O..=..G..lpD.R.F".J....... .. y..$>.)V.`..quuP4.W9.}......y......~E}.7....IU.~.!.Ak.>....A..o..._.....7.4...{.K..6o.O..5.0n.`..z...V."^. 0.x=..^M...*t...H..9.B.(UD..>heD......."....W..T.E..0D.fYfI..3.-.G".....#.p....q.......Bv..{5.!u.F.i.......[.s.)....I....v.....Y.P.5?...n.'.......;...T......f......Q...~...8.....h.......T3<........IEND.B`.

Chrome Cache Entry: 729

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 300 x 68
Category:	downloaded
Size (bytes):	399
Entropy (8bit):	7.366744684924001
Encrypted:	false
SSDEEP:
MD5:	EAB4B7C1964754BFA854D2F251E6B239
SHA1:	86331CB008BEA722981CB04AD25AF7964841BD9F
SHA-256:	3BA1F37896E4B76F1F65D6D0DE9F0875A9A13E87DC9E78D086AFDACF608BD91E
SHA-512:	6B804924B691EA9E482D7C2E678D43ED3EA9549441AF45D1CC114BBC0F25577C8C9E597DB458B051B2202B250FE96D7CA41FD59C06063C8F0C58A356EBAA1AA2
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/htabs3.gif
Preview:	GIF89a,.D.....C.`..b..............!.......,....,.D.@...1..0.I..8...`(.di.h..l.p,.tm.x..\|.....@,...r.l:..tJ.Z.....z..xL.;..z.n...\|N....~..............}w............_q..........s..................................c.......Q.................o....c....[....V.................H......*\....#J.H....3j..T....B.<c@..(..K....0...I...8......@=..J...H..M....P..J...X.\..5..`...K....;

Chrome Cache Entry: 730

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	unknown
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvEBn1Rxsd87VJ8OyXrGbUy86RmGAB9mOUDE2vVLe2SRHAspmU5raWtEjDgJuUNVF4bsk9Aa4749Q86AzWh_EW5EVsW5zLshuEkH3xZ9BGYPlneBp4AaTi10JNUFRht0wIQuehj_fllf56Amd61JDM-AwppO-I4pkU&sai=AMfl-YSeVhladc1DaaoAscbqcoBv7okQbFvXfWG5RVzLEPamxFc-1XoqvNmKheFR46dbh75sHpiMSQcYzX7WwAd4-Z5h5v3HhZH45ItnCZRgFFcndscHNcWfcHmH6OJxJJL0buoZSaCmCM4KZ6OzYaOQ&sig=Cg0ArKJSzCjzCEwStiHFEAE&cid=CAQSTgB7FLtq0a4HPjDsTvirOXQSoKzDaUOzvMDW6ce-ncuzKjXG8ohvYrF3D0p1IFuQqEj1DR9rMD9Ed7elLLaSwKeBvb3sAEE2-_aAX_tNfxgB&id=lidar2&mcvt=1009&p=0,0,194,486&mtos=1009,1009,1009,1009,1009&tos=1009,0,0,0,0&v=20240415&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271808&rs=2&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&co=931928400&rst=1713386484226&rpt=3672&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 731

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2374)
Category:	downloaded
Size (bytes):	9442
Entropy (8bit):	5.4466062211686275
Encrypted:	false
SSDEEP:
MD5:	3877408E605FF49D481AECBE47802253
SHA1:	69C809CF2B8098C1B361F2176077C8412E2C5035
SHA-256:	72C2AA8A48D89277E585C9D82756CA6766384AB817FB11B977C492AD2EF2BEA4
SHA-512:	6A15757C9523040C45CEFCDA187B257120AC64D436A68BE664A136D92B64FD7F588EA3B7C6F115850B3065D31976F607016C9C439B1B1DF3E5B4BA4BB409C30F
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/mysidia/3877408e605ff49d481aecbe47802253.js?tag=client_fast_engine_2019
Preview:	(function(){'use strict';var h="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ba=aa(this);.function ca(a,b){if(b)a:{var c=ba;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&h(c,a,{configurable:!0,writable:!0,value:b})}}.ca("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g){this.g=f;h(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.prototype.toString=function(){return this.g};var d="jscomp_symbol_"+(1E9*Math.r

Chrome Cache Entry: 732

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	9453
Entropy (8bit):	5.421730742039588
Encrypted:	false
SSDEEP:
MD5:	4BE817709F6825FFEC9D19B85A6ADA52
SHA1:	9ABCE6F4AFFD592E5E1489DD2CAE55EC6BA1D661
SHA-256:	635A2C8B892F5737CCC623A21A00D67510CAF46DFCF160C3D7FB6069937E37CE
SHA-512:	62EB5BA2EA71F86B5CE23F3B9BF8B0C8227C21C3627C48B4E0E6D61CD12E404884EC806AAA449A45DCA406E208C48B397A873E21C515F4FD187E67FB549F173C
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/include/main.css
Preview:	BODY..{.. MARGIN: 0px;.. PADDING-LEFT: 0px;.. PADDING-RIGHT: 0px;.. FONT: 12px Verdana, Helvetica, Arial, sans-serif;...BACKGROUND: url(../images/background.jpg) no-repeat 50% 0px;.. PADDING-TOP: 0px..}...adtable..{.. BACKGROUND: url(../images/background.jpg) no-repeat 50% 0px;..}..P..{.. FONT: 11px Verdana, Helvetica, Arial, sans-serif;.. COLOR: black..}..TD..{.. FONT: 11px Verdana, Helvetica, Arial, sans-serif;.. COLOR: black..}..DIV..{.. FONT: 11px Verdana, Helvetica, Arial, sans-serif;.. COLOR: black..}..P..{.. LINE-HEIGHT: 15px;.. MARGIN-TOP: 0px;.. MARGIN-BOTTOM: 0px..}...p..{.. MARGIN-TOP: 6px;.. FONT: 11px/15px Verdana, Helvetica, Arial, sans-serif;.. COLOR: black..}..A..{.. COLOR: #0066cc;.. TEXT-DECORATION: none..}..A:hover..{.. COLOR: #ff9900;.. TEXT-DECORATION: underline..}...topmenu..{.. FONT: bold 11px Verdana, Helvetica, Arial, sans-serif;.. COLOR: white..}..A.topmenu:hover..{.. TEXT-DECORATION: u

Chrome Cache Entry: 733

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/Images/space.gif
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 734

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 1572x498, components 3
Category:	downloaded
Size (bytes):	35239
Entropy (8bit):	6.557108198908335
Encrypted:	false
SSDEEP:
MD5:	C39A0DF9B68E1F723B3927BF8DC25939
SHA1:	6FAAB829E8A1EA6ED48F2CD61126CDCE50885E87
SHA-256:	7832B2B1B0BE70D22A1DE6B8613BDDB9AB78C05FC00EC48EE56F824CC53B9157
SHA-512:	D58FEAB8FDF22B3F09950C2F3E5ED650B5A536BB55E1B564A66DBDA3C7EAA80ED5745734191F11ADA30BFE4CB8BCF4D4C7ADCFA7C5B78C1070C20DDA5B7BE9F1
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/background.jpg
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......%.......p...#...P..-...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................#.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

Chrome Cache Entry: 735

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	205
Entropy (8bit):	6.471232950817362
Encrypted:	false
SSDEEP:
MD5:	4087858E2C9DB9AA8F6A840AEDCFB533
SHA1:	D1FFE861DA6BD0E95FD1A365B0C3D3CEB6CD58A3
SHA-256:	4D45982F2DC34F36C9045EE46A75A1943666BB7FD64E103CAC8C7429E7012840
SHA-512:	541228667C513266FFAC017AA43CCACEA410E20BF27D30599276E9984FAC2C433AC58288C19F7A5BFEB1C9B4074B8C9C472080BF1C706303F97B2CE73DBD634F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.......1.....IDATx...1..1.DQ.f....@H.....%`..j.M&"....5....;...;.......\.....\..U.4..pe.<.P.....%... ...@....p.....@...X...5..{.$.x^....y=..z.......\|.......+.........IEND.B`.

Chrome Cache Entry: 736

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 100
Category:	dropped
Size (bytes):	919
Entropy (8bit):	4.389585376499275
Encrypted:	false
SSDEEP:
MD5:	44861EEDC752A076F749F95DC8502A85
SHA1:	4D0D175C8C7B750EF0E8B23B64FA76C35A9A3006
SHA-256:	F5EEE58DC54D8FE9DB5B64589DF985D74981233FA0282E0D9A93D8C7E4BB2A6A
SHA-512:	8381D4A7AF6CD00A15A70A72E2167581341C67F9A666F7401397CD76234FCBC0685A588C9AABDD8AE76D8E0C9E7C9E5643884D15B3B9C53DD6A40ECB0DAF885C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..d.....7z.I..8~.=..;..J..?..>..>..;..L..?..;..@..@..:..6x.K..@..D..7\|.A..I..E..F..A..C..D..K..F..H..6z.H..K..G..K..F..C..9..J..H..B..B..E..5w.G..9..<..:..7{.5x.=..8}.6y.L............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,......d.@.q....1A...1d.p..A...T,H ......p......%288...... ..C...3.HP0"...P.hA....RTh`..../.<.q.B..5d.X.!...&`< .b.....T...;.....hP! .;

Chrome Cache Entry: 737

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 900x260, components 3
Category:	downloaded
Size (bytes):	16909
Entropy (8bit):	7.127567533146704
Encrypted:	false
SSDEEP:
MD5:	5691522DEB7E6A2895188461693923F4
SHA1:	A0585803AF1E0D2BFD7A0581D64CB97F3EF67B73
SHA-256:	A64B147C4ECF574A27DDA4AAC8141D28BE50801668F32BF933A5170774560878
SHA-512:	9DAD2D18DC0DBDBCD079D27BA3E5E89D627522F9F4B6D9FC9DD49EDE3598B684774A7EF0CF3328824C25052C7DEF72FA2C6B4239132985E1387197733DBCA1FA
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/companybg.jpg
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........H.......H......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p... ...P..*...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d................................................................................................................................................. .p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

Chrome Cache Entry: 738

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 239 x 202
Category:	dropped
Size (bytes):	13205
Entropy (8bit):	7.9558969318318615
Encrypted:	false
SSDEEP:
MD5:	626FED0626C307193691208B3AC7287C
SHA1:	62514016CF4CB70450F71C56C1B7923577757BA5
SHA-256:	F25B8FE2669B4F5F388609D13E26852C2D99CEC66D57B786DA8C3900C6C2C8C2
SHA-512:	B47D81329361CB3B9635CEBDB17E29CDCE61CBB0658C511D523E0859D50B5CD71F649BD0C0DDE883475F0E1F3A3180A79A2906B9AC41A5C85C26FF54D6595E55
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......c.98.7.c.......b.j1.c...P:....ON......f..C...ab......%%&...8:....NR.uy.Za...6@.ox.08g8M.79C.........^j.p{. B...........-.....-.d.....Cj...............^.;g.Ly.Cg.k.......................~..........9.C..1Hk.....Ug.......}.......................A..M.'p.........dt............q........}...........................4m.. m..r..u..w..v..}..{........................"\.)e.-d.4k..6Q>s....]..P..Fx.K\|.O..O~.V..T..]..Z.._..b..f..j..j..n..n..t..r..x......................w............:Uc..N..Q..b..W............/y.9..V..\..e...c.u.....;....v..j..c........;...`.......c.....f.....`.............u.p.......N\O)...............x\T............t=.z...........zR...e.3..].c.`4.....8.`..:........iii.....................!.......,........@......(g.....*\....#J.H....3.t6gU.. C....$.TSR....=.B....)S}....S.@...Jth.H.(]...R7o.J..(Q2Ai...k...>..{...;.<mZ[..Z:p.j.KW...x.........d...I..9r.H."D.".....2,.p..b...4:..B.P..l.\|Ab3.S.

Chrome Cache Entry: 739

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16x16
Category:	downloaded
Size (bytes):	3638
Entropy (8bit):	4.974114265981653
Encrypted:	false
SSDEEP:
MD5:	A68EF3A5FC089796C7275B46A3D5AA68
SHA1:	024380444D5C22BA6257AB46BF382998348F8208
SHA-256:	B24E29CDC992531DB2213E85F200E2E659EB78B0C91BFF9C657269DF7992B907
SHA-512:	8A5578D4EE7DD994040A28635F43E578DD36633E26EEB6AE7398CB2D9ACC6458107005B7103F8F1299443DBB68DFA1623C85E1FEF587CAF0B173C74656C8E864
Malicious:	false
Reputation:	unknown
URL:	https://www.cutepdf-editor.com/images/favicon.ico
Preview:	...... ..........&...........h.......(... ...@...............................1)..H........t.........................................................................................k...........................k..s.....R..{s..1..............................1..9..........B...R...c......!...1..............................................J...B...................9........Z..1{..t....c...........B...t..H...9c.......J..1Z.......B..!R..Jk...1...){..1...B..)R..9Z..Bc.......)..1R..9Z..c{.......H...9..!B..Zk..BZ..Jc..JZ.......!...)..cs......Zk.......)..Rc..k{....k...s...k..!..!1....s...{.JZ..Rc..Zc..!1..9B..BJ..Zc..JR..RZ..s{..!){.9B..Zc..ck..ck..!)..!)..)1..JR..RZ............{...s...s...{...s.!!..!!{.))..))..11..99..11..JJ..RR..ZZ..ss......))1.............................ccc.999.111...............................................................................................................................................................................

\Device\Mailslot\opera_installer\C:\Users\user\AppData\Local\Programs\Opera

Download File

Process:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
File Type:	data
Category:	dropped
Size (bytes):	5080
Entropy (8bit):	3.930105405699205
Encrypted:	false
SSDEEP:
MD5:	58216B0C7BF2DA865DE31F0E5E846961
SHA1:	2879262600F1FD74FF27F749A3DEE06321F9F757
SHA-256:	DC73A8280F068923EB3063D421925AF2A8308978EC8330D9CC99645F6182FD56
SHA-512:	4116DEAF6AB5BD638DB0A7CDD3A76CEC7A239B37B1D3D0ABDD045D63F9E1796433C35F97714725F4AF21FFAB78A297AB5754FF3EFABB14FE4BFBB7E1AD1484E1
Malicious:	false
Reputation:	unknown
Preview:	........:Installer message:..... .......:Installer message:......... .......:Installer message:.....)...8.......:Installer message:.........verify_package_contents.H.......:Installer message:.........verify_package_contents.................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer messa

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.99923822579018
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	CuteWriter.exe
File size:	6'233'072 bytes
MD5:	4ba5a70c0123a687edd954946156c04f
SHA1:	09536c4652e9af34ef91d675991cddb749dc57ec
SHA256:	72561349751266c51f2d48b6dd42f94148a90f4c678de0f5db9f5ae431e12649
SHA512:	95bbe6fbceeda2368163faa20a083f522259168f3dc3ee35f9c3d3224ca163263cc45ea7ab1c0127e70858e55fc7b10c34dfb12ad5a2980a6b9e29daa5c0d416
SSDEEP:	98304:UV5Bu+5wF/u/E7KUOv2dqhcwiP7YLc9uLEmqiTsViv4/mFH2GHpYGEcT1BDK8+2Z:m++5wF/4O9rdqSwiP7oouLEAT+iv4/m3
TLSH:	68563380A8B25AB0D422A5B0BA81A37D513DBC75117C36163BA40ACDC6347D79F98FF7
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x40a5f8
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	11/07/2022 01:00:00 11/07/2024 00:59:59
Subject Chain	CN=Acro Software Inc, O=Acro Software Inc, L=HAYMARKET, S=Virginia, C=US
Version:	3
Thumbprint MD5:	B58A5D8BF8CA535E13F479C32D234C47
Thumbprint SHA-1:	DA1E4E87ECC3846B475C2DC95830B9F2DD6335C5
Thumbprint SHA-256:	3503D4D0BDDB57ED36B9E2642252C6F3BBD5A028F65ECCD58C0F07B502AD05B6
Serial:	02666CA0DD43F1A728C9BE2D123CF804

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F90C1E95093h
call 00007F90C1E9629Ah
call 00007F90C1E96529h
call 00007F90C1E965CCh
call 00007F90C1E9856Bh
call 00007F90C1E9AED6h
call 00007F90C1E9B03Dh
xor eax, eax
push ebp
push 0040ACC9h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040AC92h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F90C1E9BAEBh
call 00007F90C1E9B6D6h
cmp byte ptr [0040B234h], 00000000h
je 00007F90C1E9C5CEh
call 00007F90C1E9BBE8h
xor eax, eax
call 00007F90C1E95D89h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F90C1E98B7Bh
mov edx, dword ptr [ebp-10h]
mov eax, 0040CE2Ch
call 00007F90C1E9512Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CE2Ch]
mov dl, 01h
mov eax, 0040738Ch
call 00007F90C1E9940Ah
mov dword ptr [0040CE30h], eax
xor edx, edx
push ebp
push 0040AC4Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F90C1E9BB46h
mov dword ptr [0040CE38h], eax
mov eax, dword ptr [0040CE38h]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5eeea0	0x2d50
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9d30	0x9e00	611a4d7a24dd9b18a256468a5d7453f5	False	0.6052956882911392	data	6.631747641055028	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x250	0x400	2f7f9f859c8b4b133abf78cebd99cc90	False	0.306640625	data	2.7547169534996403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe90	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8c4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	8d23e5ba2ab7ed51b633260d61f03139	False	0.3358487215909091	data	4.597730295668722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4f4	data	English	United States	0.29574132492113564
RT_MANIFEST	0x13570	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Target ID:	0
Start time:	22:40:33
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\CuteWriter.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CuteWriter.exe"
Imagebase:	0x400000
File size:	6'233'072 bytes
MD5 hash:	4BA5A70C0123A687EDD954946156C04F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:40:33
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-NLVSG.tmp\CuteWriter.tmp" /SL5="$20446,5944588,56832,C:\Users\user\Desktop\CuteWriter.exe"
Imagebase:	0x400000
File size:	711'168 bytes
MD5 hash:	FFCF263A020AA7794015AF0EDEE5DF0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:40:55
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Setup.exe" /inscpw4 -d"C:\Program Files (x86)\CutePDF Writer"
Imagebase:	0x400000
File size:	64'848 bytes
MD5 hash:	A8EFE2A017079497FE948191F8904A17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:41:11
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\converter.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\\converter.exe /auto
Imagebase:	0x400000
File size:	8'108'488 bytes
MD5 hash:	BF9F58A65F6954406E6DCD29BB458A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:41:12
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\unInstcpw64.exe
Wow64 process (32bit):	false
Commandline:	unInstcpw64.exe /copy
Imagebase:	0x400000
File size:	36'176 bytes
MD5 hash:	7B17AE1C9AED3C8C89FF6CDEF68F9FD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:41:13
Start date:	17/04/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7afa10000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:41:16
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.cutepdf-editor.com/support/writer.asp
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:41:16
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --silent --allusers=0
Imagebase:	0x170000
File size:	2'960'944 bytes
MD5 hash:	3C51B6EED283BBE7D10772DDE9BFFFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	22:41:16
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1640,i,13590044467732800076,8352524087445346693,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	22:41:17
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c1821c8,0x6c1821d4,0x6c1821e0
Imagebase:	0x170000
File size:	2'960'944 bytes
MD5 hash:	3C51B6EED283BBE7D10772DDE9BFFFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:41:17
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version
Imagebase:	0x6b0000
File size:	2'960'944 bytes
MD5 hash:	3C51B6EED283BBE7D10772DDE9BFFFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:41:18
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2520 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240417224118" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000
Imagebase:	0x170000
File size:	2'960'944 bytes
MD5 hash:	3C51B6EED283BBE7D10772DDE9BFFFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:41:18
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x300,0x304,0x308,0x2c8,0x30c,0x6b5d21c8,0x6b5d21d4,0x6b5d21e0
Imagebase:	0x170000
File size:	2'960'944 bytes
MD5 hash:	3C51B6EED283BBE7D10772DDE9BFFFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:41:41
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
Imagebase:	0x400000
File size:	2'569'880 bytes
MD5 hash:	15D8C8F36CEF095A67D156969ECDB896
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:41:44
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --version
Imagebase:	0x7d0000
File size:	1'998'752 bytes
MD5 hash:	976BC8E5FE65F9BB56831E20F1747150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:41:44
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x9a6038,0x9a6044,0x9a6050
Imagebase:	0x7d0000
File size:	1'998'752 bytes
MD5 hash:	976BC8E5FE65F9BB56831E20F1747150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:42:20
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe" --backend --initial-pid=2520 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181" --session-guid=b69c0d3b-1d60-4a71-a3bd-8c5c22cda97a --server-tracking-blob="YThhOWJmMmM2OGU3MjdiOGJmODcxZmRlNTU1NzlkYjYyMGVkYzBmZTg5OGNiYjI0MTA4MWRiNDExOTk2NTA1NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFjcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249Y3BkZl9zb2Z0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzA5NzUwNjU3LjEzNTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJjcGRmX3NvZnQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImFjcm8ifSwidXVpZCI6Ijc4YjU5NzQyLTQyM2EtNGRkMi1hMDNkLTg5MzU2YWNjM2ZmYSJ9 " --silent --desktopshortcut=1 --install-subfolder=109.0.5097.45
Imagebase:	0x7ff67b510000
File size:	6'568'864 bytes
MD5 hash:	053ADC8C34F1ECB38BCA1C6832DD27AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:42:20
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x278,0x27c,0x280,0x274,0x250,0x7ffdf9937c80,0x7ffdf9937c8c,0x7ffdf9937c98
Imagebase:	0x7ff67b510000
File size:	6'568'864 bytes
MD5 hash:	053ADC8C34F1ECB38BCA1C6832DD27AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:42:22
Start date:	17/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	22:42:25
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	22:42:26
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	22:42:26
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	22:42:26
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	22:42:26
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	22:42:26
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
Imagebase:	0x7ff6ec4b0000
File size:	1'998'752 bytes
MD5 hash:	976BC8E5FE65F9BB56831E20F1747150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404172241181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x9a6038,0x9a6044,0x9a6050
Imagebase:	0x7d0000
File size:	1'998'752 bytes
MD5 hash:	976BC8E5FE65F9BB56831E20F1747150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\user\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
Imagebase:	0xf50000
File size:	1'998'752 bytes
MD5 hash:	976BC8E5FE65F9BB56831E20F1747150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:42:27
Start date:	17/04/2024
Path:	C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NgafYbgtcPjnJCrIURWNAMDnEdkNRdILKvplyxVhxQAEx\WJViQqIQpkJHwwlXNjpzvf.exe"
Imagebase:	0xec0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	22:42:28
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x210,0x208,0x234,0x20c,0x238,0x1126038,0x1126044,0x1126050
Imagebase:	0xf50000
File size:	1'998'752 bytes
MD5 hash:	976BC8E5FE65F9BB56831E20F1747150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1471
Total number of Limit Nodes:	21

Executed Functions

Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B8A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669

Uniqueness

Uniqueness Score: -1.00%

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6

Strings

SetProcessDEPPolicy, xrefs: 004045B5
SetSearchPathMode, xrefs: 0040459F
SetDllDirectoryW, xrefs: 00404589
kernel32.dll, xrefs: 0040457D

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040AAC1

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,021509AC), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020446,000000FC,00409960), ref: 0040AB15
RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020446,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

/SL5="$%x,%d,%d,, xrefs: 0040AB55
InnoSetupLdrWindow, xrefs: 0040AAF2
STATIC, xrefs: 0040AAF7

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 512ba3d6f2e9f1c3867d88fe9cc8f5790ae5845b184f1ae6f41adfa2939ac233
Instruction ID: be79b44adbed8f80b53e5612ba2c07cab25871a7655baedeeb07d74425ea1546
Opcode Fuzzy Hash: 512ba3d6f2e9f1c3867d88fe9cc8f5790ae5845b184f1ae6f41adfa2939ac233
Instruction Fuzzy Hash: 83410070604204DBDB10EBA9EE89B9D37A5EB49304F10467FF114B72E2D7B89845CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

Wow64RevertWow64FsRedirection, xrefs: 004090D4
shell32.dll, xrefs: 00409110
Wow64DisableWow64FsRedirection, xrefs: 004090BA
kernel32.dll, xrefs: 004090BF, 004090D9

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020446,000000FC,00409960), ref: 0040AB15

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94

Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021509AC,00409AD8,00000000,00409ABF), ref: 00409A5C
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021509AC,00409AD8,00000000), ref: 00409A70
Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021509AC,00409AD8), ref: 00409AA4

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020446,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

/SL5="$%x,%d,%d,, xrefs: 0040AB55
InnoSetupLdrWindow, xrefs: 0040AAF2
STATIC, xrefs: 0040AAF7

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: abbbb59459200108d21b408613378a390e3e047840070f8330146cd7c6fc736f
Instruction ID: 3ba592a6bb5a586105fd12ff7794ab8e81bfb13978b6693ff680cbbbd79f3ebd
Opcode Fuzzy Hash: abbbb59459200108d21b408613378a390e3e047840070f8330146cd7c6fc736f
Instruction Fuzzy Hash: EF410B71604204DFD714EBA9EE89B5A37B5EB48314F20467BF104BB2E1D7B8A844CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021509AC,00409AD8,00000000,00409ABF), ref: 00409A5C
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021509AC,00409AD8,00000000), ref: 00409A70
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021509AC,00409AD8), ref: 00409AA4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,021509AC), ref: 0040966C

Strings

D, xrefs: 00409A36

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: eeb0a606dc3d34f7857465aac347a40f7e2d5136b20be8a991c81eea044913d1
Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
Opcode Fuzzy Hash: eeb0a606dc3d34f7857465aac347a40f7e2d5136b20be8a991c81eea044913d1
Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 95499586b8eb3924b9f10ea25598569c8e5103e004dbbc5b7afeff4deca778bd
Instruction ID: 3300c1464090713b8c4ad152b50f436a50412e7e22f4a8644673cdda6a3785a2
Opcode Fuzzy Hash: 95499586b8eb3924b9f10ea25598569c8e5103e004dbbc5b7afeff4deca778bd
Instruction Fuzzy Hash: 23419070704200DFD715EF65EE91A1A77A5E749704B61853AF804B73E1C679AC10CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 616ffec3ad4850521363db2c7ff64be852818b5d2a9dc1870494a00eaf6d903c
Instruction ID: 2c8f22a8e408aba5a5286cdcc616f8f86fe74c5c1578e58448db9cfc424de81d
Opcode Fuzzy Hash: 616ffec3ad4850521363db2c7ff64be852818b5d2a9dc1870494a00eaf6d903c
Instruction Fuzzy Hash: 72419F70700200DFC711EF65DED6A5A77A5EB49704B61463AF804B73E2CAB9AC10CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65

Uniqueness

Uniqueness Score: -1.00%

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 004099C0 Relevance: 4.5, APIs: 3, Instructions: 19
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TranslateMessage.USER32 ref: 004099C9
DispatchMessageA.USER32 ref: 004099CF
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004099DD

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 1802b87248827978fc4904d3dad91f1bd0b0d0248e3ce7d919b28dce25163666
Instruction ID: 1f5564cf95287219c4939fbd1766d219a06dd5c17758edf6696d0a01df122bc8
Opcode Fuzzy Hash: 1802b87248827978fc4904d3dad91f1bd0b0d0248e3ce7d919b28dce25163666
Instruction Fuzzy Hash: B6D012D178030033E82031721CC3F5B100C079172CF24157B7B02792D3E6BDA510506D

Uniqueness

Uniqueness Score: -1.00%

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Uniqueness

Uniqueness Score: -1.00%

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00408FBC Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FF3
GetLastError.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FFB

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction ID: 1f0403e6899a51d1d5356f81b6020870d4ad1054c4e625117792cee712869c3b
Opcode Fuzzy Hash: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction Fuzzy Hash: 16F0C871A04704ABCB01DF759D4159DB3E8DB8831475045BBF814F3682EA385E108599

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC4F Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020446,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Part of subcall function 004094D8: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: aac8c9b749819b633cd66085fc768fbc5243de0e53c226537f51dcdc75418073
Instruction ID: 744e2e41ffdda2b8a8e8fcc131ee02a4cda883d4a9c2864581d7de2b26efc558
Opcode Fuzzy Hash: aac8c9b749819b633cd66085fc768fbc5243de0e53c226537f51dcdc75418073
Instruction Fuzzy Hash: C0F0EC70215200DBD725EB69EED9B1532E5A749305F10463BA104BB2F1C7FDAC80CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Uniqueness

Uniqueness Score: -1.00%

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021403AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Uniqueness

Uniqueness Score: -1.00%

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Uniqueness

Uniqueness Score: -1.00%

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021403AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Uniqueness

Uniqueness Score: -1.00%

Function 00409960 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CallWindowProcA.USER32(FFFF0447,?,?,?,?), ref: 004099B1

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 07ebe6a48b35687840f1e071f1a0e2af1de294a726bbae59d82cb4a2c199153a
Instruction ID: 3814a9c75505c8da2782d9ff33e987ff66672ff2be4a55a7b5782d58b71a08d9
Opcode Fuzzy Hash: 07ebe6a48b35687840f1e071f1a0e2af1de294a726bbae59d82cb4a2c199153a
Instruction Fuzzy Hash: B0F090B12042089BDB10CE6ECD489AB33D8EB8C300F44853EB905A7396C37CDC518BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Uniqueness

Uniqueness Score: -1.00%

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021403AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Uniqueness

Uniqueness Score: -1.00%

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Uniqueness

Uniqueness Score: -1.00%

Function 0040995E Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CallWindowProcA.USER32(FFFF0447,?,?,?,?), ref: 004099B1

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9e529703c0f7a6cf28096d5193bbae7206c77ad9a54e5f17294cfcd52b3dda7f
Instruction ID: 6c8114c9e1729bd8a9e52267068c60464e595e663d0c51d9957e108fa06b91da
Opcode Fuzzy Hash: 9e529703c0f7a6cf28096d5193bbae7206c77ad9a54e5f17294cfcd52b3dda7f
Instruction Fuzzy Hash: EBE01AB23001086BD704DEADCD54D7B73DD9BCC300B04C52AB609D7399D534EC014768

Uniqueness

Uniqueness Score: -1.00%

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02164000,0040AA59,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021403AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Uniqueness

Uniqueness Score: -1.00%

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Uniqueness

Uniqueness Score: -1.00%

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 79f2ddcc0916314437cbcdbee070740f56c0cf647ca6dbefe329252c2a7a5ae1
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: 79f2ddcc0916314437cbcdbee070740f56c0cf647ca6dbefe329252c2a7a5ae1
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Uniqueness

Uniqueness Score: -1.00%

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Uniqueness

Uniqueness Score: -1.00%

Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E

Uniqueness

Uniqueness Score: -1.00%

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,0040A622), ref: 00405D02

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1

Strings

.DEFAULT\Control Panel\International, xrefs: 00407078
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0
GetUserDefaultUILanguage, xrefs: 00407043
kernel32.dll, xrefs: 00407048
Locale, xrefs: 00407090

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

:mm:ss, xrefs: 004055DA
m/d/yy, xrefs: 004054AD
mmmm d, yyyy, xrefs: 004054CF
:mm, xrefs: 004055C0
AMPM, xrefs: 004055A9

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103
%z, xrefs: 004030F3

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@$%z
API String ID: 2123368496-3403538084
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD

Strings

Setup, xrefs: 00409CAD
The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1

Memory Dump Source

Source File: 00000000.00000002.2107375002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2107333136.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107416404.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107467186.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CuteWriter.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CuteWriter.tmpPID: 4632, Parent PID: 6852COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	107

Executed Functions

Function 0048ED0C Relevance: 138.4, APIs: 22, Strings: 56, Instructions: 1878COMMON

Download Yara Rule

Strings

CONVERTPERCENTSTR, xrefs: 0048F62D
FILEEXISTS, xrefs: 0048ED53
GETSYSTEMDIR, xrefs: 0048F406
GETINISTRING, xrefs: 0048EDFE
SETNTFSCOMPRESSION, xrefs: 00490300
STRINGCHANGEEX, xrefs: 0048F512
SETINISTRING, xrefs: 0048F006
REGQUERYBINARYVALUE, xrefs: 0048FC23
REMOVEBACKSLASHUNLESSROOT, xrefs: 0048F2F9
GETWINDIR, xrefs: 0048F3DE
GETINIINT, xrefs: 0048EE72
GETTEMPDIR, xrefs: 0048F483
GETINIBOOL, xrefs: 0048EEF7
PARAMCOUNT, xrefs: 0048F233
REGVALUEEXISTS, xrefs: 0048F6EB
GETENV, xrefs: 0048F1D3
ADDPERIOD, xrefs: 00490287
GETUILANGUAGE, xrefs: 00490262
REGWRITEMULTISTRINGVALUE, xrefs: 0048FF28
FILEORDIREXISTS, xrefs: 0048EDC5
REGGETSUBKEYNAMES, xrefs: 0048F8E8
ISPOWERUSERLOGGEDON, xrefs: 0049020A
REGDELETEVALUE, xrefs: 0048F843
ISINISECTIONEMPTY, xrefs: 0048EFBE
SETINIBOOL, xrefs: 0048F0E0
REMOVEQUOTES, xrefs: 0048F369
PARAMSTR, xrefs: 0048F257
REGWRITEEXPANDSTRINGVALUE, xrefs: 0048FE47
REGDELETEKEYIFEMPTY, xrefs: 0048F7E8
REGDELETEKEYINCLUDINGSUBKEYS, xrefs: 0048F78D
REGWRITEBINARYVALUE, xrefs: 00490106
REGWRITESTRINGVALUE, xrefs: 0048FD30
DIREXISTS, xrefs: 0048ED8C
REGQUERYDWORDVALUE, xrefs: 0048FB46
REGQUERYMULTISTRINGVALUE, xrefs: 0048FA84
REGQUERYSTRINGVALUE, xrefs: 0048F9C2
SETINIINT, xrefs: 0048F075
REMOVEBACKSLASH, xrefs: 0048F2C1
GETSHORTNAME, xrefs: 0048F3A1
FONTEXISTS, xrefs: 0049022E
INIKEYEXISTS, xrefs: 0048EF62
REGWRITEDWORDVALUE, xrefs: 00490032
CHARLENGTH, xrefs: 004902BF
FILECOPY, xrefs: 0048F5AA
ADDQUOTES, xrefs: 0048F331
REGGETVALUENAMES, xrefs: 0048F955
ISADMINLOGGEDON, xrefs: 004901E6
USINGWINNT, xrefs: 0048F586
REGKEYEXISTS, xrefs: 0048F66E
GETCMDTAIL, xrefs: 0048F20B
ADDBACKSLASH, xrefs: 0048F289
DELETEINISECTION, xrefs: 0048F199
STRINGCHANGE, xrefs: 0048F4AB
GETSYSWOW64DIR, xrefs: 0048F42E
DELETEINIENTRY, xrefs: 0048F14B
GETSYSNATIVEDIR, xrefs: 0048F456

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTR$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSNATIVEDIR$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
API String ID: 0-4234653879
Opcode ID: 28862313e48161043861e93c5c1fe18171c45d8a794616f519bb55f902f2a30d
Instruction ID: ad9694d73a8152517899af98b2b997d10c93448511661fad700ac8609d62262e
Opcode Fuzzy Hash: 28862313e48161043861e93c5c1fe18171c45d8a794616f519bb55f902f2a30d
Instruction Fuzzy Hash: C9D23370B041559BDB14FFB9CC929AEB6A5AF44704F10883FF405AB346DB38ED0A8799

Uniqueness

Uniqueness Score: -1.00%

Function 00470C74 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 962COMMON

Download Yara Rule

Strings

@, xrefs: 00470D7C
Will register the file (a DLL/OCX) later., xrefs: 00471AEB
Existing file has a later time stamp. Skipping., xrefs: 0047139B
Existing file is protected by Windows File Protection. Skipping., xrefs: 004713B8
Uninstaller requires administrator: %s, xrefs: 0047175B
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 0047129C
Skipping due to "onlyifdoesntexist" flag., xrefs: 00470F9A
-- File entry --, xrefs: 00470CC7
User opted not to overwrite the existing file. Skipping., xrefs: 00471419
InUn, xrefs: 0047172B
Dest filename: %s, xrefs: 00470E60
Version of our file: %u.%u.%u.%u, xrefs: 004710BC
Non-default bitness: 32-bit, xrefs: 00470E87
Dest file is protected by Windows File Protection., xrefs: 00470EB9
Version of existing file: %u.%u.%u.%u, xrefs: 00471148
Stripped read-only attribute., xrefs: 00471493
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00471290
Time stamp of existing file: (failed to read), xrefs: 00471003
Version of our file: (none), xrefs: 004710C8
Same version. Skipping., xrefs: 004712B1
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00471462
Installing the file., xrefs: 004714D5
Time stamp of existing file: %s, xrefs: 00470FF7
Same time stamp. Skipping., xrefs: 00471321
Time stamp of our file: (failed to read), xrefs: 00470F73
Non-default bitness: 64-bit, xrefs: 00470E7B
Version of existing file: (none), xrefs: 004712C6
Couldn't read time stamp. Skipping., xrefs: 00471301
Incrementing shared file count (32-bit)., xrefs: 00471B71
X-G, xrefs: 00471CE0
Existing file is a newer version. Skipping., xrefs: 004711CE
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00471281
Failed to strip read-only attribute., xrefs: 0047149F
.tmp, xrefs: 00471583
Dest file exists., xrefs: 00470F87
Will register the file (a type library) later., xrefs: 00471ADF
, xrefs: 0047119B, 0047136C, 004713EA
Incrementing shared file count (64-bit)., xrefs: 00471B58
Skipping due to "onlyifdestfileexists" flag., xrefs: 004714C6
Time stamp of our file: %s, xrefs: 00470F67

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.$X-G
API String ID: 0-2752124184
Opcode ID: 883d6f514c6f2ce96f5f2425601ecddb3b0795b0fe705d8b552ffa98981770fc
Instruction ID: 6213daf496e4ed18d3ada64bf7f36975e20c89b242e76244cd23bf13d8dc6452
Opcode Fuzzy Hash: 883d6f514c6f2ce96f5f2425601ecddb3b0795b0fe705d8b552ffa98981770fc
Instruction Fuzzy Hash: F4928630A0428C9FDB11DFA9C585BDDBBB5AF05304F5480ABE848BB392C7789E45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E0AC Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0E6
GetVersion.KERNEL32(00000000,0042E290,?,0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E103
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E290,?,0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E11C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E122
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E290,?,0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E137
FreeSid.ADVAPI32(00000000,0042E297,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E28A

Strings

CheckTokenMembership, xrefs: 0042E112
advapi32.dll, xrefs: 0042E117

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: f84e0530ca3b2a260f5cee2dbb1890bcba3a2061a0c6f3f92c84f6fdd6753e5b
Instruction ID: b767a2b0357b006b48fec58faac565969e4e2695d2e87526588baf6f991b03ff
Opcode Fuzzy Hash: f84e0530ca3b2a260f5cee2dbb1890bcba3a2061a0c6f3f92c84f6fdd6753e5b
Instruction Fuzzy Hash: 99518371B44615EEEB10EAE6A842B7F7BACDB09304F9404BBB501F7282D5789904867D

Uniqueness

Uniqueness Score: -1.00%

Function 00450334 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0048151F), ref: 00450347
LoadLibraryA.KERNEL32(Rstrtmgr.dll,0048151F), ref: 0045035F
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 0045037D
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 00450392
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 004503A7
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 004503BC
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 004503D1
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 004503E6

Strings

RmRestart, xrefs: 004503C6
RmStartSession, xrefs: 00450372
RmShutdown, xrefs: 004503B1
RmEndSession, xrefs: 004503DB
RmGetList, xrefs: 0045039C
Rstrtmgr.dll, xrefs: 0045035A
RmRegisterResources, xrefs: 00450387

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: ba4799ed598e863f1006e140a948279c49c85d1dce31870895334632bea49e72
Instruction ID: 01977ea06872d8050a8028e1fd06f6bfd4923f5c9242ba3c4897223f9bd4e12c
Opcode Fuzzy Hash: ba4799ed598e863f1006e140a948279c49c85d1dce31870895334632bea49e72
Instruction Fuzzy Hash: 2711C9B4550200DBD710FB79ADC5A2A32E4E765717F58163BB940AB1A3C67C4848CF2C

Uniqueness

Uniqueness Score: -1.00%

Function 00423C1C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3824f740cdd2abfbc6a0cbf6323a599daf9dc4d4418d11f68a0ee08cce4714
Instruction ID: e16ee7298f114c8dbeebd16f5ebee6ca6ec91daf226906b03d032974817fe50e
Opcode Fuzzy Hash: 0e3824f740cdd2abfbc6a0cbf6323a599daf9dc4d4418d11f68a0ee08cce4714
Instruction Fuzzy Hash: 87E1A130700224DFD704EF59E989A6EB7F5EB94304F9480A6E545AB352C73CEE91DB08

Uniqueness

Uniqueness Score: -1.00%

Function 0042286C Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422A04
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BCE), ref: 00422A14

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 24d84c976f134b21a82d569917ba66dc5d143c920e8d2af0954ead735d6b5f7e
Instruction ID: 28b3b238c6a175230bfdc04dc608b83412cf05ad4dc18caa3e002023b447773b
Opcode Fuzzy Hash: 24d84c976f134b21a82d569917ba66dc5d143c920e8d2af0954ead735d6b5f7e
Instruction Fuzzy Hash: 5D915171B04214BFDB11EFA9DA86F9D77F4AB04314F5500B6F504AB3A2CB78AE409B58

Uniqueness

Uniqueness Score: -1.00%

Function 00467848 Relevance: 15.6, APIs: 4, Strings: 4, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00496804: GetWindowRect.USER32(00000000), ref: 0049681A

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00467BF1

Part of subcall function 0041D6C0: GetObjectA.GDI32(?,00000018,00467C0A), ref: 0041D6EB

Part of subcall function 00467624: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004676C7
Part of subcall function 00467624: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004676ED
Part of subcall function 00467624: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467744

Part of subcall function 00466FE0: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467CA5,00000000,00000000,00000000,0000000C,00000000), ref: 00466FF8

Part of subcall function 00496A88: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00496A92

Part of subcall function 0042ED48: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDB8
Part of subcall function 0042ED48: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDD5

Part of subcall function 00496754: GetDC.USER32(00000000), ref: 00496776
Part of subcall function 00496754: SelectObject.GDI32(?,00000000), ref: 0049679C
Part of subcall function 00496754: ReleaseDC.USER32(00000000,?), ref: 004967ED

Part of subcall function 00496A78: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00496A82

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00468894
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 004688A5
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004688BD

Strings

(Default), xrefs: 00468EA6
O0H, xrefs: 00467B11, 00467B25
STOPIMAGE, xrefs: 00467BE6
, xrefs: 00467CB2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadProcRectReleaseSelectSystemUserWindow
String ID: $(Default)$O0H$STOPIMAGE
API String ID: 616467991-3578898271
Opcode ID: c7162550a7efc28421010c508371d18b7556740a6e44cb09f7accbcdc8e12cd3
Instruction ID: 58f9a2d0b697d24a5dc4ac4178c069d58f76a2673b849baf82e37b4faa54a95c
Opcode Fuzzy Hash: c7162550a7efc28421010c508371d18b7556740a6e44cb09f7accbcdc8e12cd3
Instruction Fuzzy Hash: 3FF2B5386005108FCB00EB69D4D9F9973F5BF4A304F1542BAF5049B36ADB78AC46CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00455EB4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455FF3), ref: 00455EE4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455EEA
GetDiskFreeSpaceExA.KERNEL32(00000000,?,?,00000000,00000000,00455FD1,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00455FF3), ref: 00455F40

Strings

GetDiskFreeSpaceExA, xrefs: 00455EDA
kernel32.dll, xrefs: 00455EDF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: bfac5e12d34abd99162750c3dfd4c5d3cae538b90ec8d7c0d69831bba1b5384b
Instruction ID: c7998eed729051dc06c2a4bfb378ba8793a5d3ea0401748e56fe411d955f0a7d
Opcode Fuzzy Hash: bfac5e12d34abd99162750c3dfd4c5d3cae538b90ec8d7c0d69831bba1b5384b
Instruction Fuzzy Hash: 6C417471A04659AFCF01EFA5C8929EEB7B8EF48305F504567F800F7292D67C5E098B68

Uniqueness

Uniqueness Score: -1.00%

Function 00452AD4 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452B37,?,?,-00000001,00000000), ref: 00452B11
GetLastError.KERNEL32(00000000,?,00000000,00452B37,?,?,-00000001,00000000), ref: 00452B19

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 8d67f731f737788a75ab6cd4e366de025acd5644d170f5373be51446e4382fb7
Instruction ID: 47a0ca8b87b913a19c884f83f9383acd825b8acbe58efe6d1ea2a1073528362f
Opcode Fuzzy Hash: 8d67f731f737788a75ab6cd4e366de025acd5644d170f5373be51446e4382fb7
Instruction Fuzzy Hash: 69F04931A00604AB8B10DF6A9D4189EF7ACEB4632171042BBFC14E3292DAB85E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00408578 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049C4C0,00000001,?,00408643,?,00000000,00408722), ref: 00408596

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: eb14f04c5e02207c2fd5126442fac2e3d3ce4c3ff781734da4d02da34a9f601e
Instruction ID: 7c1c2e54cb9be6942265fc2fe4f8d610b96419e03c3bde54798e363261146e82
Opcode Fuzzy Hash: eb14f04c5e02207c2fd5126442fac2e3d3ce4c3ff781734da4d02da34a9f601e
Instruction Fuzzy Hash: D1E09271700614A6D311A95A9C86AEAB35C9B68314F00427FB944E73C6EDB89E4046E9

Uniqueness

Uniqueness Score: -1.00%

Function 00423B94 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424161,?,00000000,0042416C), ref: 00423BBE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 1e03a0b95ee3ac50814388fded2f2c100431d5d137ce34ba8ee35217fcdc3973
Instruction ID: 626c949ff67c0b5daba62b8ffba664747ea83a29b03f4787c3cb7294a8149fcf
Opcode Fuzzy Hash: 1e03a0b95ee3ac50814388fded2f2c100431d5d137ce34ba8ee35217fcdc3973
Instruction Fuzzy Hash: 9CF0B379205608AF8B40DF99C588D4ABBE8AB4C260B058295B988CB321C234EE808F94

Uniqueness

Uniqueness Score: -1.00%

Function 00455644 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 0045565A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b729cb2c5e6aed0314aaf1ae3f51ea3427620088d531228546b40ff94aa38a59
Instruction ID: 1d2ebe8de6f6cfe3948c3fff4a7e090af1b7aca458264ab6234f43f9cc1e19d2
Opcode Fuzzy Hash: b729cb2c5e6aed0314aaf1ae3f51ea3427620088d531228546b40ff94aa38a59
Instruction Fuzzy Hash: 94D0C2B130460063D700AA689C926AA368C8B84345F00483E3CC9DA2D3EABDDA48169A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F594 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F5B0

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 0f3603468c344ce3f2e9376b2c090f409274960c84c57a5106e539cc1743996a
Instruction ID: 438f9cd868ded5fa8976115e55c89a445960fd054612ac8023f685210e8cb482
Opcode Fuzzy Hash: 0f3603468c344ce3f2e9376b2c090f409274960c84c57a5106e539cc1743996a
Instruction Fuzzy Hash: 52D09E7221010DBB9B00DE99D840D6B33AD9B88754B908925F545C7346D634ED619BB5

Uniqueness

Uniqueness Score: -1.00%

Function 004844E8 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004844F9
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00484506
GetNativeSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484514
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0048451C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00484528
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00484549
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0048455C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00484562
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484579

Strings

IsWow64Process, xrefs: 00484516
GetNativeSystemInfo, xrefs: 00484500
RegDeleteKeyExA, xrefs: 00484552
kernel32.dll, xrefs: 004844F4
GetSystemWow64DirectoryA, xrefs: 00484543
advapi32.dll, xrefs: 00484557

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 18302833a1731b9ac9ddffeecc2318774ce77dae885452e6235f2f41d955f069
Instruction ID: b778da950d396dd295c5b374ed2d676ff49339e3fb49bb8bc78239f10660321d
Opcode Fuzzy Hash: 18302833a1731b9ac9ddffeecc2318774ce77dae885452e6235f2f41d955f069
Instruction Fuzzy Hash: 6D11D391904353F3DA11B7B55D06B6F19888BC1718F080C3B7A80692C3EB7CCA84836F

Uniqueness

Uniqueness Score: -1.00%

Function 00469220 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(?,0046943A,?,?,00000001,00000000,00000000,00469455,?,00000000,00000000,?), ref: 00469423

Strings

Inno Setup: User Info: Name, xrefs: 004693DF
Inno Setup: User Info: Organization, xrefs: 004693F2
Inno Setup: Setup Type, xrefs: 00469332
Inno Setup: Deselected Tasks, xrefs: 004693B1
Inno Setup: Icon Group, xrefs: 004692FE
Inno Setup: No Icons, xrefs: 0046930B
Inno Setup: Selected Components, xrefs: 00469342
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0046927F
%s\%s_is1, xrefs: 0046929D
Inno Setup: Selected Tasks, xrefs: 0046938F
Inno Setup: User Info: Serial, xrefs: 00469405
Inno Setup: App Path, xrefs: 004692E2
Inno Setup: Deselected Components, xrefs: 00469364

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: d9ec706037aba7e1ab9c334b67f42299fb84ced35d27b15ecf430e7ee08f71c8
Instruction ID: 704889a9543a40b2df4af7c5b1201f8134703a3c2c9624a7de549ebb5f6a7af0
Opcode Fuzzy Hash: d9ec706037aba7e1ab9c334b67f42299fb84ced35d27b15ecf430e7ee08f71c8
Instruction Fuzzy Hash: 0E51B330A046449BCB11DB65D941BDEB7F9EF48304F50846BE841A73A1EBB8AF05CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0047CFF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D8A8: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453E28,00000000,004540DA,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004992DD), ref: 0042D8BB

Part of subcall function 0042D8D4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8E7

Part of subcall function 0042D900: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453BCE,00000000,00453C71,?,?,00000000,00000000,00000000,00000000,00000000,?,00454061,00000000), ref: 0042D91A
Part of subcall function 0042D900: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D920

SHGetKnownFolderPath.SHELL32(0049AD44,00008000,00000000,?,00000000,0047D2C4), ref: 0047D1CA
757283B0.OLE32(?,0047D20D), ref: 0047D200

Part of subcall function 0042D218: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA4E,00000000,0042DAE0,?,?,?,0049C628,00000000,00000000), ref: 0042D243

Strings

Failed to get path of 64-bit Common Files directory, xrefs: 0047D190
COMMAND.COM, xrefs: 0047D29F
ProgramFilesDir, xrefs: 0047D0B8, 0047D13F
Failed to get path of 64-bit Program Files directory, xrefs: 0047D161
SystemDrive, xrefs: 0047D057
cmd.exe, xrefs: 0047D27E
\Program Files, xrefs: 0047D0DF
CommonFilesDir, xrefs: 0047D0F2, 0047D16E
Common Files, xrefs: 0047D129

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Directory$757283AddressEnvironmentFolderHandleKnownModulePathProcSystemVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 795111782-544719455
Opcode ID: bcf8aba5200b6cba5790447ddef61471935d750ecebce347b01a31a6206ec5af
Instruction ID: 54b9845d89558b0be005a3a66f45098324a2780f87887d0f9defd906ebec8ef3
Opcode Fuzzy Hash: bcf8aba5200b6cba5790447ddef61471935d750ecebce347b01a31a6206ec5af
Instruction Fuzzy Hash: 74619235E10204AFDB10FBA5D842A9E7B79EF45318F50C4BBE408A739AC73C9A458B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0047D7FC Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047D8FE

Strings

shfolder.dll, xrefs: 0047D861, 0047D89A
Failed to load DLL "%s", xrefs: 0047D8E1
Failed to get version numbers of _shfoldr.dll, xrefs: 0047D854
_isetup\_shfoldr.dll, xrefs: 0047D82E
SHFOLDERDLL, xrefs: 0047D83B
SHGetFolderPathA, xrefs: 0047D8F3
Failed to get address of SHGetFolderPath function, xrefs: 0047D90F
shell32.dll, xrefs: 0047D8A9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-1343262939
Opcode ID: 0499eedef529298a31657e8be57f4582aefc2e148037a144e7071c760b4bd9e2
Instruction ID: 96daa211b53160f0d122520d60afcb37b3a089261ef97cd35d481228ffd1c23e
Opcode Fuzzy Hash: 0499eedef529298a31657e8be57f4582aefc2e148037a144e7071c760b4bd9e2
Instruction Fuzzy Hash: 27312CB0E201499BCB00EF95C981AEEB7B5EF44318F51847BE558E7351D7389E048B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040632C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00499AF8), ref: 00406332
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040633F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406355
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040636B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00499AF8), ref: 00406376

Strings

kernel32.dll, xrefs: 0040632D
SetSearchPathMode, xrefs: 0040634F
SetProcessDEPPolicy, xrefs: 00406365
SetDllDirectoryW, xrefs: 00406339

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 7d7bbe465618e4585c438ef3b206e32c98bc9d4bad24831f1f4b353394e5164f
Instruction ID: 9a8e57213fbd449cbda58cf554ac4ead7a6b18060d135b7a086c7f718c4e9984
Opcode Fuzzy Hash: 7d7bbe465618e4585c438ef3b206e32c98bc9d4bad24831f1f4b353394e5164f
Instruction Fuzzy Hash: C6E02DA1380701A8EA1032B20D82F3B104C8B40B69B2A24377D96B45C7DABEDD6455BD

Uniqueness

Uniqueness Score: -1.00%

Function 00423884 Relevance: 15.1, APIs: 10, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3D4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDB4,?,0042389F,00423C1C,0041EDB4), ref: 0041F3F2

GetClassInfoA.USER32(00400000,0042368C), ref: 004238AF
RegisterClassA.USER32(0049A630), ref: 004238C7
GetSystemMetrics.USER32(00000000), ref: 004238E9
GetSystemMetrics.USER32(00000001), ref: 004238F8
SetWindowLongA.USER32(00410470,000000FC,0042369C), ref: 00423954
SendMessageA.USER32(00410470,00000080,00000001,00000000), ref: 00423975
GetSystemMenu.USER32(00410470,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C1C,0041EDB4), ref: 00423980
DeleteMenu.USER32(00000000,0000F030,00000000,00410470,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C1C,0041EDB4), ref: 0042398F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410470,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042399C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410470,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239B2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID:
API String ID: 183575631-0
Opcode ID: dcf1e4bb608db0b13c9ea2834524852589dee19fdd42878d22a9146a5775872e
Instruction ID: 82f3192e6ade9fc2431bdc17690f87bdde911e200ecbc62aa143bb8a1c16cd18
Opcode Fuzzy Hash: dcf1e4bb608db0b13c9ea2834524852589dee19fdd42878d22a9146a5775872e
Instruction Fuzzy Hash: A93177B17402106AE710BFA5DC82F6636989714709F54017BFA44EF2D7C6BDED40876D

Uniqueness

Uniqueness Score: -1.00%

Function 004822C0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000), ref: 0048247D
FreeLibrary.KERNEL32(00000000), ref: 00482491
SendNotifyMessageA.USER32(00020446,00000496,00002710,00000000), ref: 00482503

Strings

Not restarting Windows because Setup is being run from the debugger., xrefs: 004824B2
DeinitializeSetup, xrefs: 00482379
Restarting Windows., xrefs: 004824DE
GetCustomSetupExitCode, xrefs: 0048231D
Deinitializing Setup., xrefs: 004822DE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 481447825480252af741bb6a38a2f0eab40af69306737b481e0fc27cf46959ed
Instruction ID: 307fa9e56f8f2d2fd77782f1dfe4532255248c4fbe285fd68f26cdd181f8f5b9
Opcode Fuzzy Hash: 481447825480252af741bb6a38a2f0eab40af69306737b481e0fc27cf46959ed
Instruction Fuzzy Hash: E651BF30A04200AFD711EF69E995B5E7BE4EB19318F50887BE805D73A1DBB8A844CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00467624 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004676C7
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004676ED

Part of subcall function 00467560: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 004675FB
Part of subcall function 00467560: DestroyCursor.USER32(00000000), ref: 00467611

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467744
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 004677A5
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004677CB

Strings

O0H, xrefs: 0046762F
c:\directory, xrefs: 004676C2
shell32.dll, xrefs: 00467728

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: O0H$c:\directory$shell32.dll
API String ID: 3376378930-779031417
Opcode ID: a6d2578dfbc8054583a02c48ec49e01f2b744fba3a94f89cfce54e912972a24f
Instruction ID: ad26718f38b9356d7c68866c075af392c9c9fa722b90b114849fcd4d400a059e
Opcode Fuzzy Hash: a6d2578dfbc8054583a02c48ec49e01f2b744fba3a94f89cfce54e912972a24f
Instruction Fuzzy Hash: 50517070604204AFDB11EFA5CD8AFDEB7E8AB48349F1081B7F40897351D678AE80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042F5D4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F603
GetFocus.USER32 ref: 0042F60B
RegisterClassA.USER32(0049A7AC), ref: 0042F62C
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F700,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F66A
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F6B0
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F6C1
SetFocus.USER32(00000000,00000000,0042F6E3,?,?,?,00000001,00000000,?,004583FA,00000000,0049C628), ref: 0042F6C8

Strings

TWindowDisabler-Window, xrefs: 0042F663, 0042F6A9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: 9a0a74cd25020ca4aa5636554c6d770700e26907622c9990f917d1a1fbfcd765
Instruction ID: d29da226113d58e61871af9e0701154b32a21c5c31e3c64538275018e3c6a7a6
Opcode Fuzzy Hash: 9a0a74cd25020ca4aa5636554c6d770700e26907622c9990f917d1a1fbfcd765
Instruction Fuzzy Hash: 35219771740710BAE210EFA59C43F1A76B4EF04B54F91413BF504AB2E1D7B95C1587AD

Uniqueness

Uniqueness Score: -1.00%

Function 00453264 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004532FD,?,?,?,?,00000000,?,00499B3E), ref: 00453284
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045328A
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004532FD,?,?,?,?,00000000,?,00499B3E), ref: 0045329E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004532A4

Strings

kernel32.dll, xrefs: 0045327F, 00453299
shell32.dll, xrefs: 004532D0
Wow64RevertWow64FsRedirection, xrefs: 00453294
Wow64DisableWow64FsRedirection, xrefs: 0045327A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: dae002ab7e0eeea6d0bc963b1908d741f09a2b19e5f39dc9844c90521e078892
Instruction ID: 110c83de3d6355277510abd5b52a320a2c8dd2afbae334eef16c728cb9d202ef
Opcode Fuzzy Hash: dae002ab7e0eeea6d0bc963b1908d741f09a2b19e5f39dc9844c90521e078892
Instruction Fuzzy Hash: 5E01DF70644645AFD300BF769C02F2A3A58E705B9BF60447BFC00A62D3CA7C8A0CCA2D

Uniqueness

Uniqueness Score: -1.00%

Function 004309B4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 004309BC
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 004309CB
GetCurrentThreadId.KERNEL32 ref: 004309E5
GlobalAddAtomA.KERNEL32(00000000), ref: 00430A06

Strings

commdlg_FindReplace, xrefs: 004309C6
WndProcPtr%.8X%.8X, xrefs: 004309F7
commdlg_help, xrefs: 004309B7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: c544fb85ff372cb1e77a17e690d9a21f18419a27c2c54a515182e1a09c276035
Instruction ID: 7bf223393b5a8c163278de6a14ca069cc176d79392cc0efa73562a49209d61c7
Opcode Fuzzy Hash: c544fb85ff372cb1e77a17e690d9a21f18419a27c2c54a515182e1a09c276035
Instruction Fuzzy Hash: 2FF082709583409BC300FB6598427197BE0AB58308F00567FB458A2291E77C9900CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00455084 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,004552A0,004552A0,00000031,004552A0,00000000), ref: 0045522E
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,004552A0,004552A0,00000031,004552A0), ref: 0045523B

Part of subcall function 00454FF0: WaitForInputIdle.USER32(00000001,00000032), ref: 0045501C
Part of subcall function 00454FF0: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 0045503E
Part of subcall function 00454FF0: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 0045504D
Part of subcall function 00454FF0: CloseHandle.KERNEL32(00000001,0045507A,00455073,?,00000031,00000080,00000000,?,?,004553D3,00000080,0000003C,00000000,004553E9), ref: 0045506D

Strings

.bat, xrefs: 00455114
cmd.exe" /C ", xrefs: 00455161
.cmd, xrefs: 0045512F
COMMAND.COM" /C , xrefs: 00455198
D, xrefs: 004551CC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 3e60c29a29deb14a7bc2be1a42644af1afa7cf9cd2e6f47000ea339696dcce9d
Instruction ID: fd2d6d40b6f8736679a78553b36ca572aba09dccd5489fff61a9141705bf80db
Opcode Fuzzy Hash: 3e60c29a29deb14a7bc2be1a42644af1afa7cf9cd2e6f47000ea339696dcce9d
Instruction Fuzzy Hash: 26516D30A0071DABDF01EF95C852BEEBBB9AF44345F50407BF804B7282D7785A098B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042369C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042372C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FF6,00000000,?,?,?,00000001), ref: 00423759
OemToCharA.USER32(?,?), ref: 0042376C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FF6,00000000,?,?,?,00000001), ref: 004237AC

Strings

MAINICON, xrefs: 00423721
2, xrefs: 004236FA

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 72b5214bae903583b5150e9e2b4ebf56f0403f519bf97ede8b6dad9a93120e9e
Instruction ID: 6f4b3398584102735ad00b8493fe389bc1dbaef6f787fac7706901cc0cbf584f
Opcode Fuzzy Hash: 72b5214bae903583b5150e9e2b4ebf56f0403f519bf97ede8b6dad9a93120e9e
Instruction Fuzzy Hash: 23319370A042549ADF10EF69C8C57C67BE8AF14308F4441BAE844DB393D7BED988CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00418F48 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F4D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F6E
GetCurrentThreadId.KERNEL32 ref: 00418F89
GlobalAddAtomA.KERNEL32(00000000), ref: 00418FAA

Part of subcall function 004230D8: GetDC.USER32(00000000), ref: 0042312E
Part of subcall function 004230D8: EnumFontsA.GDI32(00000000,00000000,00423078,00410470,00000000,?,?,00000000,?,00418FE3,00000000,?,?,?,00000001), ref: 00423141
Part of subcall function 004230D8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423149
Part of subcall function 004230D8: ReleaseDC.USER32(00000000,00000000), ref: 00423154

Part of subcall function 0042369C: LoadIconA.USER32(00400000,MAINICON), ref: 0042372C
Part of subcall function 0042369C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FF6,00000000,?,?,?,00000001), ref: 00423759
Part of subcall function 0042369C: OemToCharA.USER32(?,?), ref: 0042376C
Part of subcall function 0042369C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FF6,00000000,?,?,?,00000001), ref: 004237AC

Part of subcall function 0041F128: GetVersion.KERNEL32(?,00419000,00000000,?,?,?,00000001), ref: 0041F136
Part of subcall function 0041F128: SetErrorMode.KERNEL32(00008000,?,00419000,00000000,?,?,?,00000001), ref: 0041F152
Part of subcall function 0041F128: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419000,00000000,?,?,?,00000001), ref: 0041F15E
Part of subcall function 0041F128: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419000,00000000,?,?,?,00000001), ref: 0041F16C
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F19C
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1C5
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1DA
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1EF
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F204
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F219
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F22E
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F243
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F258
Part of subcall function 0041F128: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F26D

Strings

ControlOfs%.8X%.8X, xrefs: 00418F9B
Delphi%.8X, xrefs: 00418F5F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: 13d9bdced9750e67f73d93ec74d54abaa35f495c5bba4d3cc3e2f323313cf858
Instruction ID: b4be2cf3334f9eeef2f7e30357217019d1f7f37f78cfa945b19fc5b38c57745f
Opcode Fuzzy Hash: 13d9bdced9750e67f73d93ec74d54abaa35f495c5bba4d3cc3e2f323313cf858
Instruction Fuzzy Hash: CE112CB06142409BC740FF66998278A7BE1AB68308F40943FF848E7291DB3DAD458B1E

Uniqueness

Uniqueness Score: -1.00%

Function 0041364C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413674
GetWindowLongA.USER32(?,000000F0), ref: 0041367F
GetWindowLongA.USER32(?,000000F4), ref: 00413691
SetWindowLongA.USER32(?,000000F4,?), ref: 004136A4
SetPropA.USER32(?,00000000,00000000), ref: 004136BB
SetPropA.USER32(?,00000000,00000000), ref: 004136D2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 34b367db4fa110d3f73a4511ae8beb0e64a5e5a51f2810bc4cb64f6c76f31942
Instruction ID: 3f72449cbd34e5f3a25e72b7cfa2937fee5ee0203059de802df544128507dfad
Opcode Fuzzy Hash: 34b367db4fa110d3f73a4511ae8beb0e64a5e5a51f2810bc4cb64f6c76f31942
Instruction Fuzzy Hash: DA11CC76100244BFDF00DF99DC84E9A37E8AB19364F104266B918DB3E2D739E9909B99

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049C420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049C420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049C420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 881435858a3df7288aae927e3c0e93e2fd7e3e12d101c835c3d014fcf42cc859
Instruction ID: ece8596464e12e4b83b5bd96c0fd07c419ca8ccd111934747786d766a0fa6b25
Opcode Fuzzy Hash: 881435858a3df7288aae927e3c0e93e2fd7e3e12d101c835c3d014fcf42cc859
Instruction Fuzzy Hash: AC119D30B403405BEB15ABA59CE2B363BE4A765708F94007BF40067AF1D67C984087AE

Uniqueness

Uniqueness Score: -1.00%

Function 0047D518 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047D66E,?,?,00000000,0049C628,00000000,00000000,?,00499471,00000000,0049961A,?,00000000), ref: 0047D5AB
GetLastError.KERNEL32(00000000,00000000,00000000,0047D66E,?,?,00000000,0049C628,00000000,00000000,?,00499471,00000000,0049961A,?,00000000), ref: 0047D5B4

Strings

\_setup64.tmp, xrefs: 0047D626
Created temporary directory: , xrefs: 0047D54D
_isetup, xrefs: 0047D596

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: c6223abd13e23050a53c5a7736ecc788dfa4d128e43fddb3299272cc5bbe74b1
Instruction ID: 87cddb4fc9d2a54cb81592cc9af8d89e6a80eb8054e7bf9a826e27b7e5928d95
Opcode Fuzzy Hash: c6223abd13e23050a53c5a7736ecc788dfa4d128e43fddb3299272cc5bbe74b1
Instruction Fuzzy Hash: 0C413774E101099BDB00EF95D882ADEB7B9EF44309F50853BE81477392DB38AE058F68

Uniqueness

Uniqueness Score: -1.00%

Function 00423A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A2C), ref: 00423AB8
GetWindow.USER32(?,00000003), ref: 00423ACD
GetWindowLongA.USER32(?,000000EC), ref: 00423ADC
SetWindowPos.USER32(00000000,lAB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241BB,?,?,00423D83), ref: 00423B12

Strings

lAB, xrefs: 00423B02, 00423B06

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: lAB
API String ID: 4191631535-3476862382
Opcode ID: c51b3d6ef16da069e4c7c0fc56258c2fa194cca567d2ecc2df2f6dfbb3f43fb8
Instruction ID: 1d232068e43b915345d7588b37cc7287aafbcd058231e570564fb52883b43028
Opcode Fuzzy Hash: c51b3d6ef16da069e4c7c0fc56258c2fa194cca567d2ecc2df2f6dfbb3f43fb8
Instruction Fuzzy Hash: E3115E70704610ABDB10AF28DC85F5A77E8EB08725F50026AF9A49B2E7C378DD40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0046BFE4 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

Need to restart Windows? %s, xrefs: 0046C369
PrepareToInstall failed: %s, xrefs: 0046C342
NextButtonClick, xrefs: 0046C120

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: 429840b557db657c788135951a128e7f100820da3ebd9eab24ff3d11877bb4df
Instruction ID: 63981f1492a91ede03cd3a29c5bafdd7df29cf7960cb61d2fc14a5e8ca312438
Opcode Fuzzy Hash: 429840b557db657c788135951a128e7f100820da3ebd9eab24ff3d11877bb4df
Instruction Fuzzy Hash: E7D13C34A00108DFCB00EFA9C595AFD77F5AF49304F6440BAE844AB352DB78AE41CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00483AF0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00483E41), ref: 00483C14
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00483CB2

Strings

, xrefs: 00483D6F
Need to restart Windows? %s, xrefs: 00483CEF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 81d48e1a2a0e32b52983dedafe626768bbb9f660a921eeec06f67ba14f5dbfca
Instruction ID: 20bede686fc02b1394435d2066db3068468aa6295679d36d6b5825dc0664d933
Opcode Fuzzy Hash: 81d48e1a2a0e32b52983dedafe626768bbb9f660a921eeec06f67ba14f5dbfca
Instruction Fuzzy Hash: AD91A034A002449FCB11FF69D885B9E7BE4AF59709F1044BBE8009B362D778AE45CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004700A8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C814: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C838

GetLastError.KERNEL32(00000000,004702A5,?,?,0049D1E0,00000000), ref: 00470182
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 004701FC
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00470221

Strings

Creating directory: %s, xrefs: 0047016A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 92a28d22f82fc1f6bbe4495af49e4783959e560509d3ed1d9bc3110c89c6f3a2
Instruction ID: 314bc94bd3f341ea3275c881f4ca69fe476454004bd36fe8d76e024784d08174
Opcode Fuzzy Hash: 92a28d22f82fc1f6bbe4495af49e4783959e560509d3ed1d9bc3110c89c6f3a2
Instruction Fuzzy Hash: 61514075E00248EBDB01DFA5C986BDEB7F5AF48304F5085AAE804B7382DB785E04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00454E48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454EF6
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454FBC), ref: 00454F60

Strings

SfcIsFileProtected, xrefs: 00454EF0
sfc.dll, xrefs: 00454EB8

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: e6a5b91d35a59d0ae7a242261c6d819cd79aba53d9e9f162eaa1b6d5ff285a2b
Instruction ID: fbb3ec6cd5b50b63fd35f8a1b68fa202e0926d3941eb24adcf984c27ed24a225
Opcode Fuzzy Hash: e6a5b91d35a59d0ae7a242261c6d819cd79aba53d9e9f162eaa1b6d5ff285a2b
Instruction Fuzzy Hash: E041A931A04218AFE710DB59DC85B9DB7B8AB4430DF5041BBA908A7293D7789F89CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00452584 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,00498838), ref: 004525A4
74D41500.VERSION(00000000,?,00000000,?,00000000,0045261F,?,00000000,?,?,?,00498838), ref: 004525D1
74D41540.VERSION(?,00452648,?,?,00000000,?,00000000,?,00000000,0045261F,?,00000000,?,?,?,00498838), ref: 004525EB

Strings

Y&E, xrefs: 0045262F, 004525F7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: D41500D41520D41540
String ID: Y&E
API String ID: 2153611984-1497692694
Opcode ID: fc37f08206c8e69686d66defdddf94d54b59a29bfc554a83f5df64d87965b3cc
Instruction ID: fe46317749af1235fc1090c5145677311abee9a989b9ebf20271da6a38a4ce9d
Opcode Fuzzy Hash: fc37f08206c8e69686d66defdddf94d54b59a29bfc554a83f5df64d87965b3cc
Instruction Fuzzy Hash: 89218471A00608AFDB01DAA98D41DAFB7FCEB4A701F55407BFD00E3382D6B99E058769

Uniqueness

Uniqueness Score: -1.00%

Function 0044B400 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B475
SelectObject.GDI32(?,00000000), ref: 0044B498
ReleaseDC.USER32(00000000,?), ref: 0044B4CB

Strings

O0H, xrefs: 0044B408

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID: O0H
API String ID: 1831053106-600239294
Opcode ID: 7f63ea270c2e05d0df7bcb544deccb828c04ef6cb2065eb6a75829ebd937b542
Instruction ID: 7b4e641b5f80a70363e1f29cb6207b12473e64a09d761e596b30cfa5093ee172
Opcode Fuzzy Hash: 7f63ea270c2e05d0df7bcb544deccb828c04ef6cb2065eb6a75829ebd937b542
Instruction Fuzzy Hash: FE217970E04344BFEB11DFA5C841B9EBBB8DB49304F51807AF900A6292D77CD940CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: d2d2115462cf46c609d5747887fa32ed032da6f71deecf4a39b0bc855ac853b0
Instruction ID: fb75bd3449ddbba25be9859e6e9cdae11be236df4b8f13ef698ff7f8a35764cd
Opcode Fuzzy Hash: d2d2115462cf46c609d5747887fa32ed032da6f71deecf4a39b0bc855ac853b0
Instruction Fuzzy Hash: 5E215360B44241CBEB11ABB5ACC17263B9197E5348F048177E740B73E2C67C9D5587AE

Uniqueness

Uniqueness Score: -1.00%

Function 0044B134 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B1C0,?,O0H,?,?), ref: 0044B192
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B1A5
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B1D9

Strings

O0H, xrefs: 0044B13C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID: O0H
API String ID: 65125430-600239294
Opcode ID: c6eafd714d6a6a1b8e4f9c863536d4ed9c07b36cab53c34f283c90c0e5983a99
Instruction ID: 63060d4c4a21d3a06b37f0b793f587d40fe85ad593019d515c43c5dd919fcfdf
Opcode Fuzzy Hash: c6eafd714d6a6a1b8e4f9c863536d4ed9c07b36cab53c34f283c90c0e5983a99
Instruction Fuzzy Hash: 3111CBB27046047FEB11DB6A9C82D6F77ECDB49750F10417BF504D72D0D6389E018669

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDD5

Part of subcall function 0042D8D4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8E7

Part of subcall function 0042E3A4: SetErrorMode.KERNEL32(00008000), ref: 0042E3AE
Part of subcall function 0042E3A4: LoadLibraryA.KERNEL32(00000000,00000000,0042E3F8,?,00000000,0042E416,?,00008000), ref: 0042E3DD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDB8

Strings

shlwapi.dll, xrefs: 0042ED83
SHAutoComplete, xrefs: 0042EDB2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 6f8b1ef3a7a48b3fa389ade9f4ceeaf6ae790d043dfbfe283ef76ed53e46bbde
Instruction ID: c6c149a21ca36cce9dc82633ca781001b445ce448e924a27762e383bc0e4c558
Opcode Fuzzy Hash: 6f8b1ef3a7a48b3fa389ade9f4ceeaf6ae790d043dfbfe283ef76ed53e46bbde
Instruction Fuzzy Hash: 9611A331B40214BBD711EB62EC81B9E7BA8DB55704F90447BF400A6691DBB89E058A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00455AB8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(?,00455B23,?,00000001,00000000), ref: 00455B16

Strings

PendingFileRenameOperations, xrefs: 00455AE8
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455AC4
PendingFileRenameOperations2, xrefs: 00455AF7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 106ea0baa7081653429fdb5ce35b65a71d933ab142ba82bc8719f2ef5fc7aa31
Instruction ID: 8ecee5c25e066e5253f0bac752b33d84760847f1c596038c9bfe8eab8c09834c
Opcode Fuzzy Hash: 106ea0baa7081653429fdb5ce35b65a71d933ab142ba82bc8719f2ef5fc7aa31
Instruction Fuzzy Hash: 62F06D71604A08ABE704D666EC2BA3F73ACD745711FA0446AF80096682EA7DBD04966C

Uniqueness

Uniqueness Score: -1.00%

Function 00421284 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421371
SetMenu.USER32(00000000,00000000), ref: 0042138E
SetMenu.USER32(00000000,00000000), ref: 004213C3
SetMenu.USER32(00000000,00000000), ref: 004213DF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: e1bfbeb149fb62e2ad3ad2db837168bd52a0f21d6f4abec7b0304e20cb9d907d
Instruction ID: e7a4369f7fbd106bab2429e1e1dd333134a7e32046ee40fa4552f8195e128e42
Opcode Fuzzy Hash: e1bfbeb149fb62e2ad3ad2db837168bd52a0f21d6f4abec7b0304e20cb9d907d
Instruction Fuzzy Hash: 3F41BE3070026457EB20EA7AA88579B26965F69318F4815BFBC40DF3A3CA7DCC49839D

Uniqueness

Uniqueness Score: -1.00%

Function 00417228 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417270
SetCursor.USER32(00000000), ref: 004172B3
GetLastActivePopup.USER32(?), ref: 004172DD
GetForegroundWindow.USER32(?), ref: 004172E4

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 66da04237f1473dd80d25f56dd54c554236009d00b4e44688381772630543262
Instruction ID: a3ca0b5fbe6c86dc8433d056dfe209cecf977414c0e936569190c1b416abce34
Opcode Fuzzy Hash: 66da04237f1473dd80d25f56dd54c554236009d00b4e44688381772630543262
Instruction Fuzzy Hash: 7F2180713086018BC720AF69D885ADB73B1AB48764B4545ABF855CB352D73DDC82CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00416B52 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B94
SetTextColor.GDI32(?,00000000), ref: 00416BAE
SetBkColor.GDI32(?,00000000), ref: 00416BC8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BF0

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 87133af12c35957a9f748eb5c35761c869d5d8ea54ed11f3f8892641f8a911b8
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: A71151B5600A04AFC710EE6ECC84E8773ECDF48314715843EB59ADB612D63CF8418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00454FF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000001,00000032), ref: 0045501C
MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 0045503E
GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 0045504D
CloseHandle.KERNEL32(00000001,0045507A,00455073,?,00000031,00000080,00000000,?,?,004553D3,00000080,0000003C,00000000,004553E9), ref: 0045506D

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 39f7529b9e24ef62f0317050639ef396781e58c2c3035764b485bd24a139d6c6
Instruction ID: d12116b756cd226a9453b7b7c95f557e71215baafd626de0b651f5c3ff172158
Opcode Fuzzy Hash: 39f7529b9e24ef62f0317050639ef396781e58c2c3035764b485bd24a139d6c6
Instruction Fuzzy Hash: F801F570A00A08BEEB209BA9CC12F7F7BACDF45B60F600167B904D32C2C5789D0486B8

Uniqueness

Uniqueness Score: -1.00%

Function 004230D8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042312E
EnumFontsA.GDI32(00000000,00000000,00423078,00410470,00000000,?,?,00000000,?,00418FE3,00000000,?,?,?,00000001), ref: 00423141
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423149
ReleaseDC.USER32(00000000,00000000), ref: 00423154

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: 94eb306c5e826a01f1e4729cfd5040e8a639f913efc3b2db58b8d9c882bc8d8f
Instruction ID: 95c686a17d04cc75fabac772af01a2849e5ccccd572a20f260adec4fb0f0daed
Opcode Fuzzy Hash: 94eb306c5e826a01f1e4729cfd5040e8a639f913efc3b2db58b8d9c882bc8d8f
Instruction Fuzzy Hash: 7D01DE617043002AE310BF7A5C82BAB3BA49F05319F40027FF908AA3C2D67E9C0447AE

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049C420,0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049C420,00401A89,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 258d9deb6f7a10e014db2841a00646f08a98b62604f56307b5f20277c9267f14
Instruction ID: 68a963c4b4ce3cb9fa4489d147f84cdc209e61955976dc0c42ca8291dd14a8a4
Opcode Fuzzy Hash: 258d9deb6f7a10e014db2841a00646f08a98b62604f56307b5f20277c9267f14
Instruction Fuzzy Hash: 1501C0707842405EFB19AB6998A27353ED4D796748F91803BF440A6AF1C67C4840CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0047D6CC Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047D6ED
GetLastError.KERNEL32 ref: 0047D6F7
GetTickCount.KERNEL32 ref: 0047D701
Sleep.KERNEL32(00000032), ref: 0047D711

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 01c0e23f6bb23d95911d288b3737e36dd7a149e526fc988bcaae3e4fe7875174
Instruction ID: 1517db3c931d9a13914b1954bc169abfdf7aa49f1cf16a008dbbbc9576b720a5
Opcode Fuzzy Hash: 01c0e23f6bb23d95911d288b3737e36dd7a149e526fc988bcaae3e4fe7875174
Instruction Fuzzy Hash: C2E0E562B19140658A2831BE28825BF45E8CECA364B18463FE0C9D6242C85D4C0585BF

Uniqueness

Uniqueness Score: -1.00%

Function 00483FF8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00484182,?,00000000,004841C3,?,?,?,?,00000000,00000000,00000000,?,0046C26D), ref: 00484031
SetActiveWindow.USER32(?,00000000,00484182,?,00000000,004841C3,?,?,?,?,00000000,00000000,00000000,?,0046C26D), ref: 00484043

Strings

Will not restart Windows automatically., xrefs: 00484162

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: faa5eb09fdd172fcf47b19b86a2075265ebc579e8275946c08a3fe143c0970fe
Instruction ID: 72ec54b98c6a39b1196c6de152fadfcd1d74db81ecc99f0222fd3dd4456bcf0d
Opcode Fuzzy Hash: faa5eb09fdd172fcf47b19b86a2075265ebc579e8275946c08a3fe143c0970fe
Instruction Fuzzy Hash: 3C414830A04241AFD711FFA5DC0DBAE7BE5D7A6308F15087BE940573A2D27D2885A71E

Uniqueness

Uniqueness Score: -1.00%

Function 00499AE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00499AEE), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00499AEE), ref: 00403356

Part of subcall function 0040632C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00499AF8), ref: 00406332
Part of subcall function 0040632C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040633F
Part of subcall function 0040632C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406355
Part of subcall function 0040632C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040636B
Part of subcall function 0040632C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00499AF8), ref: 00406376

Part of subcall function 004063D4: 6F571CD0.COMCTL32(00499AFD), ref: 004063D4

Part of subcall function 00410774: GetCurrentThreadId.KERNEL32 ref: 004107C2

Part of subcall function 00419050: GetVersion.KERNEL32(00499B16), ref: 00419050

Part of subcall function 0044F7B8: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00499B2A), ref: 0044F7F3
Part of subcall function 0044F7B8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F7F9

Part of subcall function 0044FC84: GetVersionExA.KERNEL32(0049C790,00499B2F), ref: 0044FC93

Part of subcall function 00453264: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004532FD,?,?,?,?,00000000,?,00499B3E), ref: 00453284
Part of subcall function 00453264: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045328A
Part of subcall function 00453264: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004532FD,?,?,?,?,00000000,?,00499B3E), ref: 0045329E
Part of subcall function 00453264: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004532A4

Part of subcall function 0045715C: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00457180

Part of subcall function 00464A94: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00499B52), ref: 00464AA3
Part of subcall function 00464A94: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464AA9

Part of subcall function 0046D2C4: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046D2D9

Part of subcall function 004794E0: GetModuleHandleA.KERNEL32(kernel32.dll,?,00499B5C), ref: 004794E6
Part of subcall function 004794E0: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 004794F3
Part of subcall function 004794E0: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00479503

Part of subcall function 004849F4: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484AE3

Part of subcall function 00496AEC: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00496B05

SetErrorMode.KERNEL32(00000001,00000000,00499BA4), ref: 00499B76

Part of subcall function 004998A0: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00499B80,00000001,00000000,00499BA4), ref: 004998AA
Part of subcall function 004998A0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004998B0

Part of subcall function 004244E4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424503

Part of subcall function 004242D4: SetWindowTextA.USER32(?,00000000), ref: 004242EC

ShowWindow.USER32(?,00000005,00000000,00499BA4), ref: 00499BD7

Part of subcall function 00483034: SetActiveWindow.USER32(?), ref: 004830E2

Strings

Setup, xrefs: 00499BBD

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 3527831634-3839654196
Opcode ID: 038c07ecf4404c5e92a9558d104966e975c7f49e1df63dd4e878ebaf91288736
Instruction ID: 39ba2cde9238db6d2c3387802396999777af1c2fc59829e342d73d5a054ac62e
Opcode Fuzzy Hash: 038c07ecf4404c5e92a9558d104966e975c7f49e1df63dd4e878ebaf91288736
Instruction Fuzzy Hash: B231B1312146409FD611BBBBEC5361E3BE8EB89718752447FF80492693DE3D5C108A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00476C6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00476D9F,?,00000000,00476DB0,?,00000000,00476DF9), ref: 00476D70
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00476D9F,?,00000000,00476DB0,?,00000000,00476DF9), ref: 00476D84

Strings

Extracting temporary file: , xrefs: 00476CAC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: 24b63a660e4db2be33247add2ab64bef64b9567de6cab67066a23bda05d2f3c1
Instruction ID: 47dd28e4777dd95c3afa8f8c78869a50dd60f77a756e11c72a01522067007eb1
Opcode Fuzzy Hash: 24b63a660e4db2be33247add2ab64bef64b9567de6cab67066a23bda05d2f3c1
Instruction Fuzzy Hash: C741C630F00649AFCB11EFA5C891AEEB7B9EF09704F51807AF814A7392D6789901CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00453A98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B87,?,?,00000000,0049C628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453ADE
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B87,?,?,00000000,0049C628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453AE7

Strings

.tmp, xrefs: 00453AC7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: b11d29291a8f40587da5cc8b38b297449652b06f15530131cc8cece305fba5ab
Instruction ID: ff9a18ef253650dbf03605879231b3438c9749bdb0146341c5730265e1144e14
Opcode Fuzzy Hash: b11d29291a8f40587da5cc8b38b297449652b06f15530131cc8cece305fba5ab
Instruction Fuzzy Hash: A4213674A00208ABDB01EFA5C8529EEB7B8EB44315F50457BF801B7342DA389F058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00455304 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 004553A0
GetLastError.KERNEL32(0000003C,00000000,004553E9,?,?,00000001,00000001), ref: 004553B1

Part of subcall function 0042D8D4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8E7

Strings

<, xrefs: 0045535A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 8f6559f2c8bddf29728a62681608da2bf327ecce2333d6ef43cddab7a08da66b
Instruction ID: 1baeac92009e3f48d7e72975e94fd539b808c95e86e95f0c8891d74cc8928d66
Opcode Fuzzy Hash: 8f6559f2c8bddf29728a62681608da2bf327ecce2333d6ef43cddab7a08da66b
Instruction Fuzzy Hash: 51213570A04649AFDB10DF65D8926AE7BF8AF08355F90403BFC44E7381D7789E498B98

Uniqueness

Uniqueness Score: -1.00%

Function 004849F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004844E8: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004844F9
Part of subcall function 004844E8: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00484506
Part of subcall function 004844E8: GetNativeSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484514
Part of subcall function 004844E8: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0048451C
Part of subcall function 004844E8: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00484528
Part of subcall function 004844E8: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00484549
Part of subcall function 004844E8: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0048455C
Part of subcall function 004844E8: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00484562

Part of subcall function 00484814: GetVersionExA.KERNEL32(?,00484A26,00000000,00484AFB,?,?,?,?,?,00499B61), ref: 00484822
Part of subcall function 00484814: GetVersionExA.KERNEL32(0000009C,?,00484A26,00000000,00484AFB,?,?,?,?,?,00499B61), ref: 00484874

Part of subcall function 0042E3A4: SetErrorMode.KERNEL32(00008000), ref: 0042E3AE
Part of subcall function 0042E3A4: LoadLibraryA.KERNEL32(00000000,00000000,0042E3F8,?,00000000,0042E416,?,00008000), ref: 0042E3DD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484AE3

Strings

shell32.dll, xrefs: 00484AD8
SHGetKnownFolderPath, xrefs: 00484ACE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: 2f55406a20708b5d30b90ae73146da0a1a8d1898e79aaba3b4f0ce718a5d4183
Instruction ID: d01c79618b02928828655fb508d18cf7a0cf5aa7b5e104e3c59cdd11b6b0c5b4
Opcode Fuzzy Hash: 2f55406a20708b5d30b90ae73146da0a1a8d1898e79aaba3b4f0ce718a5d4183
Instruction Fuzzy Hash: 732103B09243415EC710BF7E5D6624A3BA5EBA470D380493BF800EB3D1D67EA414AB6F

Uniqueness

Uniqueness Score: -1.00%

Function 0047CF5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047D2AE,00000000,0047D2C4), ref: 0047CFBE

Strings

RegisteredOrganization, xrefs: 0047CFAD
RegisteredOwner, xrefs: 0047CF9B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: c42b341831e7c6acc61a6854d87a9ae9435059b93a2c1b9a6bc64c747de635bb
Instruction ID: fb14359856c209919a583aef81b4ff0d5d6d3fb0b0883e054e80e751d65a1c49
Opcode Fuzzy Hash: c42b341831e7c6acc61a6854d87a9ae9435059b93a2c1b9a6bc64c747de635bb
Instruction Fuzzy Hash: 48F09021B04104ABD710D664EC92B9B33AA8741308F60847FF1049B3D1CA7DAD049B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

Strings

OFH, xrefs: 0042DE42, 0042DE45
System\CurrentControlSet\Control\Windows, xrefs: 0042DE46

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Open
String ID: OFH$System\CurrentControlSet\Control\Windows
API String ID: 71445658-2488766200
Opcode ID: 0f77c8ce853619a5698b89c9811bea03ab3af1fee96e2778c5ec7c5c80741e7e
Instruction ID: abe9ee1dba80eab6c976627f4fe301d03bda2a195c3818943ffea28d54d696bb
Opcode Fuzzy Hash: 0f77c8ce853619a5698b89c9811bea03ab3af1fee96e2778c5ec7c5c80741e7e
Instruction Fuzzy Hash: E7D0C7729501287BD7009A89DC41DFB775DDB15760F41441BFD1897101C1B4EC5197F8

Uniqueness

Uniqueness Score: -1.00%

Function 0045715C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004570EC: CoInitialize.OLE32(00000000), ref: 004570F2

Part of subcall function 0042E3A4: SetErrorMode.KERNEL32(00008000), ref: 0042E3AE
Part of subcall function 0042E3A4: LoadLibraryA.KERNEL32(00000000,00000000,0042E3F8,?,00000000,0042E416,?,00008000), ref: 0042E3DD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00457180

Strings

shell32.dll, xrefs: 00457175
SHCreateItemFromParsingName, xrefs: 0045716B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 8c61739773fc86776d466c3811a23e39e8fb4f9a1a8010b026ed741be9b704cf
Instruction ID: 9c527047bf7e84dae422e031a0d6d6e9bbae4a3d03e504f065b317ec79f67602
Opcode Fuzzy Hash: 8c61739773fc86776d466c3811a23e39e8fb4f9a1a8010b026ed741be9b704cf
Instruction Fuzzy Hash: 6AC04CA0B4591066C70077B6AC0361F24459B4072FB14C07BBD44A7787CE3D884D6A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0046D2C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E3A4: SetErrorMode.KERNEL32(00008000), ref: 0042E3AE
Part of subcall function 0042E3A4: LoadLibraryA.KERNEL32(00000000,00000000,0042E3F8,?,00000000,0042E416,?,00008000), ref: 0042E3DD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046D2D9

Strings

shell32.dll, xrefs: 0046D2CE
SHPathPrepareForWriteA, xrefs: 0046D2C4

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: e6dcb2927b4539a94b5e270028b9e9cbb4f4c0141e8d65d03270a331c36f5f4c
Instruction ID: a21c9a2118f8c82de9dfd06689cde96a72e5d7a1c02a8420b04d9336bd43fcec
Opcode Fuzzy Hash: e6dcb2927b4539a94b5e270028b9e9cbb4f4c0141e8d65d03270a331c36f5f4c
Instruction Fuzzy Hash: BEB092A0F046008ACB40A7B2981260A2105AB54B19F20807B7880AB395EA3CC88AAB1F

Uniqueness

Uniqueness Score: -1.00%

Function 004826E8 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00482820), ref: 004827B8
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 004827C9
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004827E1

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: df18f8231e69e1052ccd616ca59a597295ba2c9d377cb5703a6bb83d32f478c0
Instruction ID: 979656ed6fcbfc7552abdcbc7880109219e169862d16a705434231489abe3159
Opcode Fuzzy Hash: df18f8231e69e1052ccd616ca59a597295ba2c9d377cb5703a6bb83d32f478c0
Instruction Fuzzy Hash: 7131AF707043455BDB21FB368D82B9E3A949B59318F44193FF9009B2E3CABC9C09839D

Uniqueness

Uniqueness Score: -1.00%

Function 0042440C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424422
TranslateMessage.USER32(?), ref: 0042449F
DispatchMessageA.USER32(?), ref: 004244A9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 24a07c1e81c585bad35552c3917a3e7b04f02dd2aaee7f9545dc892aa94dfb52
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: AE119E307043205AEE20FA64AD41B9B73D4DFE1708F80881EF8D997382D77D9E49879A

Uniqueness

Uniqueness Score: -1.00%

Function 00416654 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041667A
SetPropA.USER32(00000000,00000000), ref: 0041668F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166B6

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 4d701caf422561ffb72b9e51a3cf7df29a1bab0b8b852592a73948bb2065ae18
Instruction ID: 86f537f0b59e140ef7690159b30d1f2105a0adb91ae91f828a802e84d443a7b9
Opcode Fuzzy Hash: 4d701caf422561ffb72b9e51a3cf7df29a1bab0b8b852592a73948bb2065ae18
Instruction Fuzzy Hash: 4AF0BD72741220ABE710AB598C85FA632ECAB0D715F16017ABA05EF286C679DC4087A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE64 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE74
IsWindowEnabled.USER32(?), ref: 0041EE7E
EnableWindow.USER32(?,00000000), ref: 0041EEA4

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 908e1640c45beef437f125b63470cd7f97cb81b788dbbb5d15c196427eefded0
Instruction ID: 2c5c4f0331a1d41ebe9848165d0c8b98450d8d3461f9c723900bbadb0b89b381
Opcode Fuzzy Hash: 908e1640c45beef437f125b63470cd7f97cb81b788dbbb5d15c196427eefded0
Instruction Fuzzy Hash: 2DE0E5B81003006EE310AB2BEC81A57779CAB55354F55843BAC0997292D63ED8509ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00406298 Relevance: 4.5, APIs: 3, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406299
GlobalUnWire.KERNEL32(00000000), ref: 004062A0
GlobalFree.KERNEL32(00000000), ref: 004062A5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Global$FreeHandleWire
String ID:
API String ID: 318822183-0
Opcode ID: 6fb441d58b367f32f482df158d6c8a90520777f868e58a6b13673b60c2f5b21c
Instruction ID: b5eea0f3dae274aca0a4c6402288de28279b65512b324850ca2931ecacfbb438
Opcode Fuzzy Hash: 6fb441d58b367f32f482df158d6c8a90520777f868e58a6b13673b60c2f5b21c
Instruction Fuzzy Hash: A7A001C5910A42A8DC0432B2084B83B000CE84432C3801A6B7518BA1828C3C84001E3D

Uniqueness

Uniqueness Score: -1.00%

Function 0046A3B4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046A4C5

Strings

PrepareToInstall, xrefs: 0046A46F, 0046A516

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: 38e40cb4a9134a692d4e909ff1d905ebb9a12545093016939082570f98fa93e3
Instruction ID: 7ae9f9e7b4e6c56af77c8d5ddfb8124a976248f084d48fa57ba6fdfb03ec4b85
Opcode Fuzzy Hash: 38e40cb4a9134a692d4e909ff1d905ebb9a12545093016939082570f98fa93e3
Instruction Fuzzy Hash: 6CA10B34A00109DFCB00EF59D986E9EB7F5AF48344F5580B6E404AB362D738EE45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0046C990 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046CB2C, 0046CB43

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: a64866024878d3de7cb351e5b706593c2e9c7dc8cb8948187116e62a6ffa6bc3
Instruction ID: 0a2b40b2def357150b36c30d2fbb60bf5c5c9c46dc96f8b8de8bb9eb1c85c4c9
Opcode Fuzzy Hash: a64866024878d3de7cb351e5b706593c2e9c7dc8cb8948187116e62a6ffa6bc3
Instruction Fuzzy Hash: 0671A570B44209AADB10EB69DCC3FFE77A15B40744F10C067F580BB292E6B96D49874E

Uniqueness

Uniqueness Score: -1.00%

Function 00483034 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 004830E2

Strings

InitializeWizard, xrefs: 0048307B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: c799aa938c458e90a8adb84f7cccd4733c83fd271f45a165541f5fe725126d67
Instruction ID: 0f26e4effdeaf642077c0258feaba36d10aa937c4f4697a8b413e3fe8eeed7e0
Opcode Fuzzy Hash: c799aa938c458e90a8adb84f7cccd4733c83fd271f45a165541f5fe725126d67
Instruction Fuzzy Hash: 5F119130A08204AFD711FF29EC86B197BE4E75672CF50447BF404872A1DA79AC46CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0047D720 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047D76A

Strings

Failed to remove temporary directory: , xrefs: 0047D783

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 983e4e82349c171695a938ebf049a256f03ccb6f2dd842f8e9bf3da858662a42
Instruction ID: 598cf065bb9c920d917efbc78bfb6c6d2b95ee1f6b27444d30e6335276625338
Opcode Fuzzy Hash: 983e4e82349c171695a938ebf049a256f03ccb6f2dd842f8e9bf3da858662a42
Instruction Fuzzy Hash: 4A017930A10604BADB15EB72DC47F9A77E8DF45708F60C47BB808A6592D67CAD08996C

Uniqueness

Uniqueness Score: -1.00%

Function 0047CE78 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047D0C4,00000000,0047D2C4), ref: 0047CEBD

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047CE8D

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: a1bcd442d12e5c7ff05efd98275cf460395294493b777e2253e9abb7729ccb0c
Instruction ID: 56dc908954fd9d53b6ceef9c867c863650b883540115b6040c6b4b81e309debc
Opcode Fuzzy Hash: a1bcd442d12e5c7ff05efd98275cf460395294493b777e2253e9abb7729ccb0c
Instruction Fuzzy Hash: AEF0892170451467DA10A55A5C82BAE579D8B44758F20407FF508DB342D9B99D02435C

Uniqueness

Uniqueness Score: -1.00%

Function 00454174 Relevance: 3.2, APIs: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,004543BA,?,00000000,0045442E,?,?,-00000001,00000000,?,0047D77F,00000000,0047D6CC,00000000), ref: 00454396
FindClose.KERNEL32(000000FF,004543C1,004543BA,?,00000000,0045442E,?,?,-00000001,00000000,?,0047D77F,00000000,0047D6CC,00000000,00000000), ref: 004543B4

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: f1b5942daafb9fc1c7fe6c633a79ba80ce6f5c190054568a26298d765fb35116
Instruction ID: 47b905165b337c418e9cbeae38c6e4ba4915847252c56348aaf420d2765ccfe6
Opcode Fuzzy Hash: f1b5942daafb9fc1c7fe6c633a79ba80ce6f5c190054568a26298d765fb35116
Instruction Fuzzy Hash: 13815130A0424D9BCF11DF65C8457EFBBB5AF89309F1440A6EC546B393D3399A8ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0047EDF8 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047F0D7,?,-0000001A,00480FD6,-00000010,?,00000004,0000001C,00000000,00481323,?,0045DC10), ref: 0047EE6E

Part of subcall function 0042E32C: GetDC.USER32(00000000), ref: 0042E33B
Part of subcall function 0042E32C: EnumFontsA.GDI32(?,00000000,0042E318,00000000,00000000,0042E384,?,00000000,00000000,?,?,00000001,00000000,00000002,00000000,00481CF1), ref: 0042E366
Part of subcall function 0042E32C: ReleaseDC.USER32(00000000,?), ref: 0042E37E

SendNotifyMessageA.USER32(00020446,00000496,00002711,-00000001), ref: 0047F03E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: 063282abc91b4102868f6392a4e5cb7ed771953d3fa166f3be9283b7df925252
Instruction ID: 310e89489152470cc3f3d7cafd59dc7fb226323db3ebf93d2809b05574b6ef4b
Opcode Fuzzy Hash: 063282abc91b4102868f6392a4e5cb7ed771953d3fa166f3be9283b7df925252
Instruction Fuzzy Hash: D151A8346001409BCB10FF26D981A9B77A9EB55309B90C57BE8089B767C77CED0ACB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049C420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049C420,0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049C420,00401A89,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: 4fc8355347e9e1d4ccec0041d5b636f63783e5cfbebeb868820e8a41b8702e1d
Instruction ID: 6f01476fa854e093772c88cc0e1a6b3f7d7d3886978438045dd483ce2d71c460
Opcode Fuzzy Hash: 4fc8355347e9e1d4ccec0041d5b636f63783e5cfbebeb868820e8a41b8702e1d
Instruction Fuzzy Hash: FA41D3B2F403019FDB10CF68DD9522A77A4F7A9324F15417BD854A77E1D3789841CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC10 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD48), ref: 0042DC4C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD48), ref: 0042DCBC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 80665b2cde9ee57e522dd8711412eaf931e33ec8b5fc09fadae09ede8aa250e9
Instruction ID: 688ca5bec861f28c2d3c56c4d9756a3eee1da68b680b0c58c854c6ce0276e007
Opcode Fuzzy Hash: 80665b2cde9ee57e522dd8711412eaf931e33ec8b5fc09fadae09ede8aa250e9
Instruction Fuzzy Hash: BA414171E00529AFDB11DF95D881BAFB7B8BF40714F90846AE800F7241D778AE40CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0045285C Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458320,00000000,00458308,?,?,?,00000000,004528D6,?,?,?,00000001), ref: 004528B0
GetLastError.KERNEL32(00000000,00000000,?,?,00458320,00000000,00458308,?,?,?,00000000,004528D6,?,?,?,00000001), ref: 004528B8

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: e09fa97de630fa27e16c07e21c87c38b66edd776f4077685748d28fa2cfc73ea
Instruction ID: f1ff12a52b9ae97e51c0fc8bedc9ee5f8128ff8695a74900dad41ba9f3169ab0
Opcode Fuzzy Hash: e09fa97de630fa27e16c07e21c87c38b66edd776f4077685748d28fa2cfc73ea
Instruction Fuzzy Hash: D1113C72604208BF8B40DEA9DD41D9F77ECEB4D310B114567FD08D3241D674AD148B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADE8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AE02
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF5F,00000000,0040AF77,?,?,?,00000000), ref: 0040AE13

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 3895f624856b1ea0a9eecfd353ee51072dda80a498f5cf38b9e49c8e0493dd95
Instruction ID: 0dcf9cb85912d996b0f29ff8386446a7da443b122bfb24013de7d2ae06ed8127
Opcode Fuzzy Hash: 3895f624856b1ea0a9eecfd353ee51072dda80a498f5cf38b9e49c8e0493dd95
Instruction Fuzzy Hash: FB01F271300300AFDB00EFA9DC92E1A77EDEB49758B108077F500AB3D1DA39AC1096AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEB4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EF03
EnumThreadWindows.USER32(00000000,0041EE64,00000000), ref: 0041EF09

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 4f64f9abf12c4e0f4ed6bfdbad4522da757f8f173b64a0d5440e5a48dfcb49d5
Instruction ID: 5ea5535e16dbd3a66c9b103d663da150a627407ba9bd10677b5e32ddf65fd45d
Opcode Fuzzy Hash: 4f64f9abf12c4e0f4ed6bfdbad4522da757f8f173b64a0d5440e5a48dfcb49d5
Instruction Fuzzy Hash: E9016D75A04704BFD305CF6AEC1195ABBF9E749720B22C877EC04D3690E7385820DE9A

Uniqueness

Uniqueness Score: -1.00%

Function 00452CF4 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452D36
GetLastError.KERNEL32(00000000,00000000,00000000,00452D5C), ref: 00452D3E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 7c4aab8b36ae14d8a635ced06c67cef24aba2db346aa3191af40eaa3e26f8b5b
Instruction ID: 4fca69a62489ebc4a01fefb46b4f56da8e9c918d1d9d85a0206be36eb6df5136
Opcode Fuzzy Hash: 7c4aab8b36ae14d8a635ced06c67cef24aba2db346aa3191af40eaa3e26f8b5b
Instruction Fuzzy Hash: 8501D671B04208BB8710EB7A9D4149EB7FCDB8A725760457BFC04E3642EAB85E088558

Uniqueness

Uniqueness Score: -1.00%

Function 004527E4 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00452843), ref: 0045281D
GetLastError.KERNEL32(00000000,00000000,00000000,00452843), ref: 00452825

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 28cb3e53723eacf447c2c6638963c3331e8813cf735047b4dcc8aecda219944d
Instruction ID: 740ef451bc259a1e9a82c9a6d4ec6f858251f5182fd79d8d66273d0612a28aea
Opcode Fuzzy Hash: 28cb3e53723eacf447c2c6638963c3331e8813cf735047b4dcc8aecda219944d
Instruction Fuzzy Hash: E2F02871A04704BBCB00EFF5AD0159EB3E8DB4A315B1046BBFC04E3242E6B94E048698

Uniqueness

Uniqueness Score: -1.00%

Function 0045297C Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,004529D9,?,-00000001,?), ref: 004529B3
GetLastError.KERNEL32(00000000,00000000,004529D9,?,-00000001,?), ref: 004529BB

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 619cacde37b99ba0ce09e85b855e76aec4ad461f516148d47c65204a16eeb230
Instruction ID: 616889b774c7d0a889357a9a25b6211c9f917d25ccf9d7241b8d0611c73475d1
Opcode Fuzzy Hash: 619cacde37b99ba0ce09e85b855e76aec4ad461f516148d47c65204a16eeb230
Instruction Fuzzy Hash: 6CF0C8B1B04708ABDB00EF759D4249EB7ECDB4A315B5045B7FC04E3742E6785E148598

Uniqueness

Uniqueness Score: -1.00%

Function 00452E84 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00452EE1,?,-00000001,00000000), ref: 00452EBB
GetLastError.KERNEL32(00000000,00000000,00452EE1,?,-00000001,00000000), ref: 00452EC3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: d5173dc2079d56f8de669b0613904658e6a35cf9c74bf6db093c152465f8f42d
Instruction ID: c7bdba2715fb66454707c14724f72c320a39a9c6e4158119f2851cf94b52ae50
Opcode Fuzzy Hash: d5173dc2079d56f8de669b0613904658e6a35cf9c74bf6db093c152465f8f42d
Instruction Fuzzy Hash: F2F0C871A04708ABCB00DFB59D4249EB7E8EB4E31575049B7FC04E7642E7785E049558

Uniqueness

Uniqueness Score: -1.00%

Function 0042324C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423259
LoadCursorA.USER32(00000000,00000000), ref: 00423283

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: f50906273b4dd4b76e2408c8e955edc8cf5c14898db3d3c1ed1d0f377b452c19
Instruction ID: 8f8c17a0fbd4bdfe9a7359f041206873b2ad7c2d9544917d76f3b93295b1a640
Opcode Fuzzy Hash: f50906273b4dd4b76e2408c8e955edc8cf5c14898db3d3c1ed1d0f377b452c19
Instruction Fuzzy Hash: ABF0EC11704214EBDA109E7E6CC0E2A72A8DB91B36B7103BBFE3AD72D1C62E1D41427D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3A4 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E3AE
LoadLibraryA.KERNEL32(00000000,00000000,0042E3F8,?,00000000,0042E416,?,00008000), ref: 0042E3DD

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 5776663e4489aa5ac087f663c1a997a3c9318ec70fb50d0ef56642908a6b2f90
Instruction ID: a9e68ab2b12e17ae16f3f6d0a0ea7eea8a26f05c835edb8546f20125b23269b3
Opcode Fuzzy Hash: 5776663e4489aa5ac087f663c1a997a3c9318ec70fb50d0ef56642908a6b2f90
Instruction Fuzzy Hash: 47F08270B14744BFDB119F779C6282BBBECE749B1179248B6F810E3691E67D48108928

Uniqueness

Uniqueness Score: -1.00%

Function 0046E5B8 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046E64E), ref: 0046E5C2
756FE550.OLE32(0049AB9C,00000000,00000001,0049ABAC,?,?,0046E64E), ref: 0046E5DE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: E550Version
String ID:
API String ID: 1323609852-0
Opcode ID: 958372935539f90fc3b5b19cfc1dc0c0aab49902d0c661c69a84ba24e20d29d7
Instruction ID: 7a4486e870d8e7c9fe42256e75789bc8ae85cb7a199e6a0b9860d1a2d8b516c5
Opcode Fuzzy Hash: 958372935539f90fc3b5b19cfc1dc0c0aab49902d0c661c69a84ba24e20d29d7
Instruction Fuzzy Hash: E8F0E534641250AEEB10E77ACD4AB4A3BC56B2131CF00007BF1449B2A2E3ADD4958F0F

Uniqueness

Uniqueness Score: -1.00%

Function 0047D20D Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(0049AD54,00008000,00000000,?), ref: 0047D21D
757283B0.OLE32(?,0047D260), ref: 0047D253

Strings

Failed to get path of 64-bit Common Files directory, xrefs: 0047D190
COMMAND.COM, xrefs: 0047D29F
ProgramFilesDir, xrefs: 0047D0B8, 0047D13F
Failed to get path of 64-bit Program Files directory, xrefs: 0047D161
SystemDrive, xrefs: 0047D057
cmd.exe, xrefs: 0047D27E
\Program Files, xrefs: 0047D0DF
CommonFilesDir, xrefs: 0047D0F2, 0047D16E
Common Files, xrefs: 0047D129

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: 757283FolderKnownPath
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 733073498-544719455
Opcode ID: 98e505c70b0323f41a1c53ddfd0042953bfa83db301f6d76e4f182dd4611913c
Instruction ID: 77e431c868d71d8b8b0e6ffb46e491c5f09152fba8ecd6d4ef9291a7db81466f
Opcode Fuzzy Hash: 98e505c70b0323f41a1c53ddfd0042953bfa83db301f6d76e4f182dd4611913c
Instruction Fuzzy Hash: 68E06535714704AEDB11DA51DD52F5977B8EF44B04B7144B2B504A2981D67C9900961C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F004 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F01E
EnumThreadWindows.USER32(00000000,0041EFA0,00000000), ref: 0041F024

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 01e798839a1bbba61ee10ed22516d6bf6626d5705bd025bbe246a41fc8eaf3c3
Instruction ID: e8be60cb7065e129d974119693833095f36a9569c76e934e621c10e340b5c5cd
Opcode Fuzzy Hash: 01e798839a1bbba61ee10ed22516d6bf6626d5705bd025bbe246a41fc8eaf3c3
Instruction Fuzzy Hash: DFE04C71B00200AFDB10EF3DED4575A37E4E354354F52487BA804D71A1D2785865EA8F

Uniqueness

Uniqueness Score: -1.00%

Function 0040626C Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 0040626E
GlobalFix.KERNEL32(00000000), ref: 00406274

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Global$Alloc
String ID:
API String ID: 2558781224-0
Opcode ID: 38fdb687bb69d238822be17628ba02d3430ff360103c12c92fad93c094244837
Instruction ID: 56019af84ea84d57b40f02c4528a45173e4f1cdf38a2be340d0d32551c2e1a06
Opcode Fuzzy Hash: 38fdb687bb69d238822be17628ba02d3430ff360103c12c92fad93c094244837
Instruction Fuzzy Hash: 699002C4C01A00A4DC0072B20C0BD3F101CD8C072C3D1486F7044B6483887C88000979

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7d9236a51a6e62d759a8b4f250f4c89c76a4556442c2f53cae6702f33709ebd9
Instruction ID: 72296c24d993e0564b30de85c6f195fe79285825457dd4606d191d555c4bfbf2
Opcode Fuzzy Hash: 7d9236a51a6e62d759a8b4f250f4c89c76a4556442c2f53cae6702f33709ebd9
Instruction Fuzzy Hash: D1F08272B0063067EB605A6A4C81B6359849BC5794F254076FD09FF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 004085EC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408722), ref: 0040860B

Part of subcall function 00406DFC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E19

Part of subcall function 00408578: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049C4C0,00000001,?,00408643,?,00000000,00408722), ref: 00408596

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 5823267eaa6e0e7ee692efbee1c67039304ac956db3a02cff78b9572607a147c
Instruction ID: 87d691d9fb5281b9ea88bf14f35752b700db14023ee960ec0a49684e6ef053d8
Opcode Fuzzy Hash: 5823267eaa6e0e7ee692efbee1c67039304ac956db3a02cff78b9572607a147c
Instruction Fuzzy Hash: AF316135E00109ABCB00DF55C8C19EEB779FF84314F51857BE815BB296EB38AE018B98

Uniqueness

Uniqueness Score: -1.00%

Function 00428AA8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 00428B5A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: eca0f2736c2c38e16e5f81efd4fe86861c470ea1e809d0dbdb26b25f8da1d9c6
Instruction ID: 0b36389efe9489aea029c2341defaf7b6903aa050c4acf78a9e28f33b2e99d54
Opcode Fuzzy Hash: eca0f2736c2c38e16e5f81efd4fe86861c470ea1e809d0dbdb26b25f8da1d9c6
Instruction Fuzzy Hash: 1921C8B0B05244AFEB11DF15D885B9E7FE9DF05314F5440BEF8089B252CB78AE44C659

Uniqueness

Uniqueness Score: -1.00%

Function 0041FBAC Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC49

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: de9d69d4b93587d9dbc4e1ffcd6d3196287cd482c57983938f35f532835c4bfd
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: 59213EB1608745AFD350DF39D4407AABBE4BB48314F04893EA498C3741E778E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0046C924 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEB4: GetCurrentThreadId.KERNEL32 ref: 0041EF03
Part of subcall function 0041EEB4: EnumThreadWindows.USER32(00000000,0041EE64,00000000), ref: 0041EF09

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C982,?,00000000,?,?,0046CB94,?,00000000,0046CC08), ref: 0046C966

Part of subcall function 0041EF68: IsWindow.USER32(?), ref: 0041EF76
Part of subcall function 0041EF68: EnableWindow.USER32(?,00000001), ref: 0041EF85

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: c8a3603eaf4d3baf6c419c7f1454462adbdcfd95f4f4642b21a4703596937767
Instruction ID: 7264ab070347bd50d0de158ad0d2548bbb9960899af2fa92a03718df9f295238
Opcode Fuzzy Hash: c8a3603eaf4d3baf6c419c7f1454462adbdcfd95f4f4642b21a4703596937767
Instruction Fuzzy Hash: 19F0BEB1209300BFEB059B72AC9AB25B7A8E708718F62083BF40887190E57D5848C91E

Uniqueness

Uniqueness Score: -1.00%

Function 0042C814 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C838

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FullNamePath
String ID:
API String ID: 608056474-0
Opcode ID: a9d656742b39b7551c8959b1c9beb2a2f8950f4b15ea36b38aef87c185680fd1
Instruction ID: fc93c92b5ceb678466afe1770917b1082805c2950c1ac798fe98a8d013cea58a
Opcode Fuzzy Hash: a9d656742b39b7551c8959b1c9beb2a2f8950f4b15ea36b38aef87c185680fd1
Instruction Fuzzy Hash: FAE0206170061022D621606B6CC2AEF918C8B903BAF04413BBA58CA3C1EAFC8E49019A

Uniqueness

Uniqueness Score: -1.00%

Function 00416560 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416595

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5ff731208ea2669c00132db587fc5b09c37a3f2098bcfa82a293bed1c7b74572
Instruction ID: bf23e32d75ed6c1bba1609a99bdb6fc4fe5539f7daeb337dc53a21feff163cdc
Opcode Fuzzy Hash: 5ff731208ea2669c00132db587fc5b09c37a3f2098bcfa82a293bed1c7b74572
Instruction Fuzzy Hash: 22F019B2200510AFDB84CEDCD8C0F9373ECEB0C250B0481A6BA08CB21AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 004149C4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149FF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00450838 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450878

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c47705c650c03eeb3fa213ca8ef127fbab7ce4e86e84a6a981bf3da871867329
Instruction ID: ad17be180c76723165afa97522f1f8cb50e5cc3c1ac5aed9be9dbb48c14aba74
Opcode Fuzzy Hash: c47705c650c03eeb3fa213ca8ef127fbab7ce4e86e84a6a981bf3da871867329
Instruction Fuzzy Hash: D9E0EDB53441583ED6809AAC6C42F9677DC971A724F018433B998D7241D4619D258BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCDC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD24,?,00000001,?,?,00000000,?,0042CD76,00000000,00452A99,00000000,00452ABA,?,00000000), ref: 0042CD07

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9c61d9913643e7fc8a87719d436576f713db19c75eb1cc22161a8dfdf450bb3f
Instruction ID: e42bb19430493de12fff977eb98fa38a093f16e856f4d8eabd15c7f5a46843e5
Opcode Fuzzy Hash: 9c61d9913643e7fc8a87719d436576f713db19c75eb1cc22161a8dfdf450bb3f
Instruction Fuzzy Hash: 7DE06571314308BBD701EB62EC92A5EBAECD749714B914476B400D7592D5B86E008468

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8D8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004532E7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8F7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7e342571288affc5bafe57b4e7aa38107ccfa77ae99db5e17a7a6f0d9f50f535
Instruction ID: 7522df6bb5b7b377145cdc83deeae8a000ac75e555bea28060da8a54cd92ba64
Opcode Fuzzy Hash: 7e342571288affc5bafe57b4e7aa38107ccfa77ae99db5e17a7a6f0d9f50f535
Instruction Fuzzy Hash: F6E0D86178432126F23524166C43B7B110E43C0704FD440267A809F3D2D6EE9946425E

Uniqueness

Uniqueness Score: -1.00%

Function 004062F8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042368C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C1C), ref: 00406321

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 1e3b386673cc32b76f3712ab4659b14af7d7742474b1f2ca80afcc4f691b27f6
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: 26E002B221430DBFDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972528675AC608B71

Uniqueness

Uniqueness Score: -1.00%

Function 0041468C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0049691E,?,00496940,?,?,00000000,0049691E,?,?), ref: 004146AB

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406EF4 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00406F08

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ea1ff9221a9a518fcf1b6dddbd8a046c83415d8827a500d55103958348dafe87
Instruction ID: b503c4a0953891474f9aa9b9b2444f13c6ed3bbd87afdb10aaa1daa8cc518ddd
Opcode Fuzzy Hash: ea1ff9221a9a518fcf1b6dddbd8a046c83415d8827a500d55103958348dafe87
Instruction Fuzzy Hash: CED05B723081117AD220955B6D84DBB5BDCCBC97B4F11073EB668D71C1D6308C018775

Uniqueness

Uniqueness Score: -1.00%

Function 00406E90 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000080,00000000,?,0040A6E4,0040CCC8,?,00000000,?), ref: 00406EC6

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 406dc971a3209ef00520ede78774a6992e2dcdca22669514f99095d7fa03da22
Instruction ID: c2943fc94682194bd89cb34e5985757651a2a2d61f7f4d66b30733711781c687
Opcode Fuzzy Hash: 406dc971a3209ef00520ede78774a6992e2dcdca22669514f99095d7fa03da22
Instruction Fuzzy Hash: 40E012A23D061436E5109D9CACC3F56118CC714759F048032F600EF2D1D5AD9E2097E9

Uniqueness

Uniqueness Score: -1.00%

Function 00406F20 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F34

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3762a51e43609c3b4bae8470f6c1dc5ae0f0561e9ae868b0f3c10d30521955a8
Instruction ID: f35b24215c0fdc632c147a12649f74ed31c2b31f11cb39250bbd2ff5eed7ffe6
Opcode Fuzzy Hash: 3762a51e43609c3b4bae8470f6c1dc5ae0f0561e9ae868b0f3c10d30521955a8
Instruction Fuzzy Hash: 5CD012723081506AD220A65A6C44EAB6ADCCBC5770F11063AB558D2181D6209C018675

Uniqueness

Uniqueness Score: -1.00%

Function 0042365C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423608: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042361D

ShowWindow.USER32(00410470,00000009,?,00000000,0041EDB4,0042394A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C1C), ref: 00423677

Part of subcall function 00423638: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423654

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
Instruction ID: 62f98a927e5d18dfd067733e82cc858d6425e225367395d1bb64f11078388387
Opcode Fuzzy Hash: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
Instruction Fuzzy Hash: 03D05E123831B03146307BB728059CB86AC8DD66AB389047BB5409B303E91D8A0A51AC

Uniqueness

Uniqueness Score: -1.00%

Function 004242D4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242EC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 7b629e4230a16754486ed56ae920d883ae8ae6fbac6fb4db25cd6a5c7ea909d6
Instruction ID: 45ecccad5147b2ee88577654b541c8e67cd655c44182ff5547076257999a9e8e
Opcode Fuzzy Hash: 7b629e4230a16754486ed56ae920d883ae8ae6fbac6fb4db25cd6a5c7ea909d6
Instruction Fuzzy Hash: 82D05BE270116017CB01BAED54C4AC657CC5B4925A71540B7F904EF257C678CD448398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD7C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00452CC9,00000000,00452CE2,?,-00000001,00000000), ref: 0042CD87

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 65fd72f92739c061d076c0ad3e63fa8edafe9fada60768c6fb79a9df0be74ff3
Instruction ID: 3de89bc190df74d7222d64632d50a0b772855f1e91c9c9a43672feef6bbb9981
Opcode Fuzzy Hash: 65fd72f92739c061d076c0ad3e63fa8edafe9fada60768c6fb79a9df0be74ff3
Instruction Fuzzy Hash: A8D012D537121015DF1465BD29C535F06884BA5335FA41A37B56DE62E2D23D8956202C

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0045163F,00000000), ref: 0042CD3F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bfa7c436ea4076489e3194c110aeffa5b63c2464b47e17bafb8d8bd18f179746
Instruction ID: fe1bff9429d4e90dee18816d853216f65d631ba0a2a06ffe7669bbedc21dff1a
Opcode Fuzzy Hash: bfa7c436ea4076489e3194c110aeffa5b63c2464b47e17bafb8d8bd18f179746
Instruction Fuzzy Hash: 6FC08CE0322210169E20A6BD6CC951F06CC895837A3A40A77B03CEA2E2D23DD8162028

Uniqueness

Uniqueness Score: -1.00%

Function 00466FE0 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467CA5,00000000,00000000,00000000,0000000C,00000000), ref: 00466FF8

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00406ED0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6E4,0040CC90,?,00000000,?), ref: 00406EED

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5ea83bba119d08381cf5149d3e870d091e521e5b09d6abf0e71c1523e48d3119
Instruction ID: a78e408fffc15bc8d0ee8a54c686fbaa4e2694f5c3f88f37cecd524e454749ad
Opcode Fuzzy Hash: 5ea83bba119d08381cf5149d3e870d091e521e5b09d6abf0e71c1523e48d3119
Instruction Fuzzy Hash: ADC048B13C130032F93025A61C87F1604889714B1AE60943AB740BE1C2D8E9A818016C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3AC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F3C0

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Uniqueness

Uniqueness Score: -1.00%

Function 004509A0 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C3EA,00000000,0045C575,?,00000000,00000002,00000002), ref: 004509A7

Part of subcall function 00450728: GetLastError.KERNEL32(00450544,004507EA,?,00000000,?,00498D64,00000001,00000000,00000002,00000000,00498EC5,?,?,00000005,00000000,00498EF9), ref: 0045072B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: ab92c804e13779e6a8a378971558b34dc584b681704b9a97c4630cfb3c940cd1
Instruction ID: 0486764e065467a501855473afd0cd0cb10eaee8d6f94b4102cded937092f4df
Opcode Fuzzy Hash: ab92c804e13779e6a8a378971558b34dc584b681704b9a97c4630cfb3c940cd1
Instruction Fuzzy Hash: 0DC04CA9301201879F40A6AE85C190663DC9E1C3597504566B904CF20BD769DC044A14

Uniqueness

Uniqueness Score: -1.00%

Function 004072B8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00498CF2,00000000,00498EC5,?,?,00000005,00000000,00498EF9,?,?,00000000), ref: 004072C3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Uniqueness

Uniqueness Score: -1.00%

Function 0044FE78 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00450084,00000000,?,00468877,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0044FE96

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 7bd21bce352ef9eb2048bf2040eeae4f2e43a9874c1861b6f2688b47b140eb63
Instruction ID: a629a0db9dd52c2c813bd735235f2ff71626ebf0a04549050cf536d9e7228f23
Opcode Fuzzy Hash: 7bd21bce352ef9eb2048bf2040eeae4f2e43a9874c1861b6f2688b47b140eb63
Instruction Fuzzy Hash: 6DD0C9B0A122408ED710EB36E98830233E0F364306F554837A000D5166C3398894AFAD

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3FF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E41D), ref: 0042E410

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 874db3389c4172aa30432ca027f259e533f636a378579170be3356e0d0ef28c9
Instruction ID: 55140b1eedf56d48a55774d01a07de49d55d18186a895614534630d02c3c9fff
Opcode Fuzzy Hash: 874db3389c4172aa30432ca027f259e533f636a378579170be3356e0d0ef28c9
Instruction Fuzzy Hash: D4B09B7671C6105DFB05D695745152D63D4D7C57203E14577F010D7580D53D58004D18

Uniqueness

Uniqueness Score: -1.00%

Function 0047DA50 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,0048249B), ref: 0047DA66

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9278654ccfe5ce98f6af39e92e454f9962143c9e941d8c75a1cf799a56c30336
Instruction ID: af04181d26bd471887a0513c212e52e865fd3275a39c0cfa5a188e4ffc0c1602
Opcode Fuzzy Hash: 9278654ccfe5ce98f6af39e92e454f9962143c9e941d8c75a1cf799a56c30336
Instruction Fuzzy Hash: B8C0EAB1E21200AFC750AF78EA0865636E4B728329B06893BA008C3260F73888408B08

Uniqueness

Uniqueness Score: -1.00%

Function 004826D8 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 004826E0

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fec4a018c951c35ca8aa5caa15492ba15b97684fd1156867828fef632b2d3e87
Instruction ID: a049f017766f74ee94b83235d94ec2d7737a3ea42143ca09c2755b46fea829eb
Opcode Fuzzy Hash: fec4a018c951c35ca8aa5caa15492ba15b97684fd1156867828fef632b2d3e87
Instruction Fuzzy Hash: 7FA002343D530430F47463510D13F4400402744F15EE1409573053D0C304D82424201D

Uniqueness

Uniqueness Score: -1.00%

Function 00406F4C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,00000000), ref: 00406F51

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: eca098781b07d3275b2485d3e62f85d6bbca04e26e27c84fa60daf1c0e1c5509
Instruction ID: 8ab35750f3efd4d99fa83ee5673b62d8a6256d966d57501d01fbbdede9c777f2
Opcode Fuzzy Hash: eca098781b07d3275b2485d3e62f85d6bbca04e26e27c84fa60daf1c0e1c5509
Instruction Fuzzy Hash: 459002D465160138F81462614C5BF3B001CD7C0B14FD0465D3100A50C254AC6C000879

Uniqueness

Uniqueness Score: -1.00%

Function 004165FC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00416603

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 951f12253bcdbe2be33f1d7372765b1b3ebb510443260a24e1bbd496af9ec3c9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: AFA002755015409ADB10E7A5C84DF7A2298BF44204FD905FA714CA7052C53CD9008A55

Uniqueness

Uniqueness Score: -1.00%

Function 0047E71C Relevance: 1.4, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047E907,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047E8C1

Part of subcall function 0042CA10: GetSystemMetrics.USER32(0000002A), ref: 0042CA22

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID:
API String ID: 224039744-0
Opcode ID: 41d13cf18d17dab1d139b19edd216d14337454fdf8c5f3109c9601773f3b2040
Instruction ID: 8298d0d720be54f172dc9c1120d454cd0d7f5f7f4daa3f11546073fe16fb1e14
Opcode Fuzzy Hash: 41d13cf18d17dab1d139b19edd216d14337454fdf8c5f3109c9601773f3b2040
Instruction Fuzzy Hash: 5B51A970A00209AFD724DF5AD884B9A7BF8EB1C308F1181B7E404E73A1D7789D45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3D4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDB4,?,0042389F,00423C1C,0041EDB4), ref: 0041F3F2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2501c7b5f1b7e2a32cc088a261609a538437b101066d50b70fa7879060b37a7f
Instruction ID: df12e3cc7205ed3866b0622d7fc8c89f1b444ce5416b62958542d3ca819b8d78
Opcode Fuzzy Hash: 2501c7b5f1b7e2a32cc088a261609a538437b101066d50b70fa7879060b37a7f
Instruction Fuzzy Hash: 5A1148742007069BCB10DF19C880B82FBE4EB98390B10D53BE9588B385D378E8558BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00453038 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004530A1), ref: 00453083

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: fae3966de32ce325d684a802f386e23a9a289e160075e32661223733d432a6d9
Instruction ID: 94e22d98a6c00f19aef873439ff0cfb4dcf68a684d4d060e49f788bb75b395da
Opcode Fuzzy Hash: fae3966de32ce325d684a802f386e23a9a289e160075e32661223733d432a6d9
Instruction Fuzzy Hash: 0701FC35604304AF8711DF69AC118EEBBE8DB8A76175042B7FC64D3382D6744E059764

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c2ec33a786a38e7bd0169ef8bddb7cde116ed653613200da8896670bb901eae8
Instruction ID: be7f0be69d4b25e877c81db3c68dd302dbc4ff1700a0c49f545652be0e594e9c
Opcode Fuzzy Hash: c2ec33a786a38e7bd0169ef8bddb7cde116ed653613200da8896670bb901eae8
Instruction Fuzzy Hash: 1401FC766442148FC3109F29DCC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406F58 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406F59

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6d5f4615d296fbbc3d990cf813c80aa0ea5a8011e2983691863e8f068271b578
Instruction ID: 6160d783662a008e1f799edb03f3d460fe671c60c73369e1be62f9e55b6485aa
Opcode Fuzzy Hash: 6d5f4615d296fbbc3d990cf813c80aa0ea5a8011e2983691863e8f068271b578
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041F128 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00419000,00000000,?,?,?,00000001), ref: 0041F136
SetErrorMode.KERNEL32(00008000,?,00419000,00000000,?,?,?,00000001), ref: 0041F152
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419000,00000000,?,?,?,00000001), ref: 0041F15E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419000,00000000,?,?,?,00000001), ref: 0041F16C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F19C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1C5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1DA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1EF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F204
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F219
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F22E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F243
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F258
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F26D
FreeLibrary.KERNEL32(00000001,?,00419000,00000000,?,?,?,00000001), ref: 0041F27F

Strings

Ctl3dAutoSubclass, xrefs: 0041F223
CTL3D32.DLL, xrefs: 0041F159
Ctl3dUnAutoSubclass, xrefs: 0041F238
Ctl3DColorChange, xrefs: 0041F24D
Ctl3dDlgFramePaint, xrefs: 0041F1F9
Ctl3dUnregister, xrefs: 0041F1BA
Ctl3dCtlColorEx, xrefs: 0041F20E
Ctl3dSubclassDlgEx, xrefs: 0041F1E4
Ctl3dRegister, xrefs: 0041F191
BtnWndProc3d, xrefs: 0041F262
Ctl3dSubclassCtl, xrefs: 0041F1CF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 4e919b27f168e0c91f38b531c940666d554f387893affa65810b45fe8b6c0306
Instruction ID: cc035a32af1c864732f55fa5d96a8ee37849f8948b3bb020ccbabec4f333c5ef
Opcode Fuzzy Hash: 4e919b27f168e0c91f38b531c940666d554f387893affa65810b45fe8b6c0306
Instruction Fuzzy Hash: 953142B1740600BBD701EBB5EC86A7A3394F768724B45093BB444EB192D77C4CA98F5D

Uniqueness

Uniqueness Score: -1.00%

Function 00458670 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004586D7
QueryPerformanceCounter.KERNEL32(00000000,00000000,0045896A,?,?,00000000,00000000,?,00459066,?,00000000,00000000), ref: 004586E0
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 004586EA
GetCurrentProcessId.KERNEL32(?,00000000,00000000,0045896A,?,?,00000000,00000000,?,00459066,?,00000000,00000000), ref: 004586F3
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458769
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00458777
CreateFileA.KERNEL32(00000000,C0000000,00000000,0049AB24,00000003,00000000,00000000,00000000,00458926), ref: 004587BF
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00458915,?,00000000,C0000000,00000000,0049AB24,00000003,00000000,00000000,00000000,00458926), ref: 004587F8

Part of subcall function 0042D8D4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8E7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004588A1
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 004588D7
CloseHandle.KERNEL32(000000FF,0045891C,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045890F

Part of subcall function 00453510: GetLastError.KERNEL32(00000000,004540A5,00000005,00000000,004540DA,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004992DD,00000000), ref: 00453513

Strings

CreateProcess, xrefs: 004588AA
64-bit helper EXE wasn't extracted, xrefs: 004586CB
CreateNamedPipe, xrefs: 00458787
helper %d 0x%x, xrefs: 00458880
SetNamedPipeHandleState, xrefs: 00458801
i, xrefs: 00458854
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0045873F
D, xrefs: 0045881A
Cannot utilize 64-bit features on this version of Windows, xrefs: 004586B8
CreateFile, xrefs: 004587CD
Helper process PID: %u, xrefs: 004588F4
Starting 64-bit helper process., xrefs: 004586A5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 73798e1977d39f31a762c034ee070c9f373db58399cff3cb08fb945a6a959893
Instruction ID: dce1d9d3a47b8e631bda5ef5291cfb12a825263051becb9b2fd33ba3793b7428
Opcode Fuzzy Hash: 73798e1977d39f31a762c034ee070c9f373db58399cff3cb08fb945a6a959893
Instruction Fuzzy Hash: 2F710470A00248AEDB10DF65CC45B9E77F4EB05709F1044AAF944FB282DB785944CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00478DC4 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00478C30: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02112BD8,?,?,?,02112BD8,00478DF4,00000000,00478F12,?,?,?,?), ref: 00478C49
Part of subcall function 00478C30: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00478C4F
Part of subcall function 00478C30: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02112BD8,?,?,?,02112BD8,00478DF4,00000000,00478F12,?,?,?,?), ref: 00478C62
Part of subcall function 00478C30: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02112BD8,?,?,?,02112BD8), ref: 00478C8C
Part of subcall function 00478C30: CloseHandle.KERNEL32(00000000,?,?,?,02112BD8,00478DF4,00000000,00478F12,?,?,?,?), ref: 00478CAA

Part of subcall function 00478D08: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00478D9A,?,?,?,02112BD8,?,00478DFC,00000000,00478F12,?,?,?,?), ref: 00478D38

ShellExecuteEx.SHELL32(0000003C), ref: 00478E4C
GetLastError.KERNEL32(00000000,00478F12,?,?,?,?), ref: 00478E55
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478EA2
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478EC6
CloseHandle.KERNEL32(00000000,00478EF7,00000000,00000000,000000FF,000000FF,00000000,00478EF0,?,00000000,00478F12,?,?,?,?), ref: 00478EEA

Strings

<, xrefs: 00478E0B
runas, xrefs: 00478E19
GetExitCodeProcess, xrefs: 00478ECF
ShellExecuteEx returned hProcess=0, xrefs: 00478E76
ShellExecuteEx, xrefs: 00478E66
MsgWaitForMultipleObjects, xrefs: 00478EAF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 90ad8a5164c8175752af67eee1119d2bc264400f1410fc24e8cb481202b9a7a8
Instruction ID: c580665e87332a7f48f44d2874b36e3a6ed908098254172f97a7b97a83afe8b5
Opcode Fuzzy Hash: 90ad8a5164c8175752af67eee1119d2bc264400f1410fc24e8cb481202b9a7a8
Instruction Fuzzy Hash: 9E3142B0A40208AFDB10EFA69845ADEB6B9EB44318F50843FF518E7282DF7C59058B59

Uniqueness

Uniqueness Score: -1.00%

Function 00418394 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004183A3
GetWindowPlacement.USER32(?,0000002C), ref: 004183C0
GetWindowRect.USER32(?), ref: 004183DC
GetWindowLongA.USER32(?,000000F0), ref: 004183EA
GetWindowLongA.USER32(?,000000F8), ref: 004183FF
ScreenToClient.USER32(00000000), ref: 00418408
ScreenToClient.USER32(00000000,?), ref: 00418413

Strings

,, xrefs: 004183AC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: e1e10888711d407f8fe90eb8876dbc7d811cb5afcf9edaa6a068330facd90bcc
Instruction ID: 83451382f6561a1cdaf4068601f89ac1c3a417dc2c2f98083d52f4ec56b04d21
Opcode Fuzzy Hash: e1e10888711d407f8fe90eb8876dbc7d811cb5afcf9edaa6a068330facd90bcc
Instruction Fuzzy Hash: 10112871505201ABDB00EF69C885F9B77E8AF48314F180A7EBD58DB286D738D900CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F2F0 Relevance: 13.6, APIs: 9, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042F318
GetWindowLongA.USER32(?,000000F0), ref: 0042F32C
GetWindowLongA.USER32(?,000000EC), ref: 0042F343
GetActiveWindow.USER32 ref: 0042F34C
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F379
SetActiveWindow.USER32(?,0042F4A9,00000000,?), ref: 0042F39A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: c1bda91dcd7651435d7764655e3a3bd2c523acf5272e6fd952f1138f6d7ccc73
Instruction ID: 64d3bd35cbe97a20ddf06b1c5bb431ac215ab6611dc304e3324dca4d9728f060
Opcode Fuzzy Hash: c1bda91dcd7651435d7764655e3a3bd2c523acf5272e6fd952f1138f6d7ccc73
Instruction Fuzzy Hash: 0E319C71A00254AFDB01EFB6DC52D6FBBB8EB0D714B9144BAB800E7291D6389D10CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0045568C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0045569B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004556A1
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004556BA
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004556E1
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004556E6
ExitWindowsEx.USER32(00000002,00000000), ref: 004556F7

Strings

SeShutdownPrivilege, xrefs: 004556B3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 0e49f0261b899019e83d2be26c5419bb19f7188fc4a02d107c020d0bec01b0dd
Instruction ID: c3cc1ea1cd3915d7a33d422d8d95032da4a52c1e989dd5dcf2427ab637b102ec
Opcode Fuzzy Hash: 0e49f0261b899019e83d2be26c5419bb19f7188fc4a02d107c020d0bec01b0dd
Instruction Fuzzy Hash: F8F06870694B42B9E610A6B1CC17F3B21C89B44749F50482AFD05EA1D3D7FCD9084A7E

Uniqueness

Uniqueness Score: -1.00%

Function 00498FDC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0049911A,?,?,00000000,0049C628,?,004992A4,00000000,004992F8,?,?,00000000,0049C628), ref: 00499033
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 004990B6
FindNextFileA.KERNEL32(000000FF,?,00000000,004990F2,?,00000000,?,00000000,0049911A,?,?,00000000,0049C628,?,004992A4,00000000), ref: 004990CE
FindClose.KERNEL32(000000FF,004990F9,004990F2,?,00000000,?,00000000,0049911A,?,?,00000000,0049C628,?,004992A4,00000000,004992F8), ref: 004990EC

Strings

isRS-???.tmp, xrefs: 0049901D
isRS-, xrefs: 00499053

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 6a06c2fb4234dbaf5a66b710dc9c8e0172acfb42efa137fdff5479744cfcf1a6
Instruction ID: 9eb8249df8ecb063d9d7c94bf9744a757b4b5422d991e038f688c4fbab1fe823
Opcode Fuzzy Hash: 6a06c2fb4234dbaf5a66b710dc9c8e0172acfb42efa137fdff5479744cfcf1a6
Instruction Fuzzy Hash: AB316A719015186FDF14EF6ACC41ADEBBBCDB49314F5084BBA818A32A1DA389F458E54

Uniqueness

Uniqueness Score: -1.00%

Function 0045763C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004576B9
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004576E0
SetForegroundWindow.USER32(?), ref: 004576F1
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,004579C9,?,00000000,00457A05), ref: 004579B4

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00457834

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 20a7541d439693339051b4c2e63818871d4c539d5db3cdd2e1552dab95ba981c
Instruction ID: a98a3a5062caf59cab348f31412a3acfafd0e72bf253e6ad705c4f7b545a869d
Opcode Fuzzy Hash: 20a7541d439693339051b4c2e63818871d4c539d5db3cdd2e1552dab95ba981c
Instruction Fuzzy Hash: 4391F174608204EFEB15CF55E951F5ABBF5FB4D304F2180BAE80497392C638AE05CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00475798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00475902,?,?,0049D1E0,00000000), ref: 004757F1
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00475902,?,?,0049D1E0,00000000), ref: 004758CE
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00475902,?,?,0049D1E0,00000000), ref: 004758DC

Strings

unins, xrefs: 00475844
unins???.*, xrefs: 004757DB

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: f474ac359d334417446361080fcffe71f6e21d35ba466b0300671a4a6a8f9871
Instruction ID: 10cb2e31453116ff3c62558b11408b33a980d2de8286487fb619b9588ab7bdb8
Opcode Fuzzy Hash: f474ac359d334417446361080fcffe71f6e21d35ba466b0300671a4a6a8f9871
Instruction Fuzzy Hash: 8C319370A006489BDB10EB26CD81ADE77B9DF44314F5180F6A40CAB3A2DB78DF458F59

Uniqueness

Uniqueness Score: -1.00%

Function 00417CE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D1F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D3D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D73
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D9A

Strings

,, xrefs: 00417D61

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 9c5f89a71cfe2c104da25ff87a88adb6c32844dc64bd8037304172568e0c6e12
Instruction ID: 8a2405f126271a8a3f3b67151c5e9cb2aa668bd176c3c9f3f75a3d087e0924cd
Opcode Fuzzy Hash: 9c5f89a71cfe2c104da25ff87a88adb6c32844dc64bd8037304172568e0c6e12
Instruction Fuzzy Hash: 90213171604208ABCF00EF69E8C0EEA77B8AF48314F05456AFD18DF346C678DD848B68

Uniqueness

Uniqueness Score: -1.00%

Function 0046417C Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464339), ref: 004641AD
FindFirstFileA.KERNEL32(00000000,?,00000000,0046430C,?,00000001,00000000,00464339), ref: 0046423C
FindNextFileA.KERNEL32(000000FF,?,00000000,004642EE,?,00000000,?,00000000,0046430C,?,00000001,00000000,00464339), ref: 004642CE
FindClose.KERNEL32(000000FF,004642F5,004642EE,?,00000000,?,00000000,0046430C,?,00000001,00000000,00464339), ref: 004642E8

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 94c2f389c5211654e463dde6f240fc3bd7e5c7e7b34af59151bf6efeb5b05e66
Instruction ID: ba3fec83fa2d575cfbe080b8aa7904990f0774d38cde044d1f6235f87517d366
Opcode Fuzzy Hash: 94c2f389c5211654e463dde6f240fc3bd7e5c7e7b34af59151bf6efeb5b05e66
Instruction Fuzzy Hash: 32418334A006189FCF15EF65CC55ADEB7B8EB89305F5044BAF804A7381E67C9E888E59

Uniqueness

Uniqueness Score: -1.00%

Function 004645F8 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,004647DF), ref: 0046466D
FindFirstFileA.KERNEL32(00000000,?,00000000,004647AA,?,00000001,00000000,004647DF), ref: 004646B3
FindNextFileA.KERNEL32(000000FF,?,00000000,0046478C,?,00000000,?,00000000,004647AA,?,00000001,00000000,004647DF), ref: 00464768
FindClose.KERNEL32(000000FF,00464793,0046478C,?,00000000,?,00000000,004647AA,?,00000001,00000000,004647DF), ref: 00464786

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 891163f8fba1cdfa90f734f52782f5c5457260fc7f4efd15a839fb0a3296908d
Instruction ID: a143cb504d8d1cb5d7a20e9c26d916f2956342668e79a5847c6773ecbdac1d56
Opcode Fuzzy Hash: 891163f8fba1cdfa90f734f52782f5c5457260fc7f4efd15a839fb0a3296908d
Instruction Fuzzy Hash: DB416235A00A18DFCB10EFA5CD859DEB7B9EB89305F4045AAF804EB341E77C9E448E59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E944 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452FB3,00000000,00452FD4), ref: 0042E966
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E991
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452FB3,00000000,00452FD4), ref: 0042E99E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452FB3,00000000,00452FD4), ref: 0042E9A6
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452FB3,00000000,00452FD4), ref: 0042E9AC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 369aefee55e738008e7ec70158ae425bf74f5ca40751ba9921b1892957c12d5d
Instruction ID: 200206f6ebf05c62f8aab9c26c76e03d6a480d3026058df5ea69506491fbc91e
Opcode Fuzzy Hash: 369aefee55e738008e7ec70158ae425bf74f5ca40751ba9921b1892957c12d5d
Instruction Fuzzy Hash: 34F06DB23916203AF620A17A6C86F6F018C8785B68F10423BBA14FF1D1D9A89D0655AD

Uniqueness

Uniqueness Score: -1.00%

Function 004843A8 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004843E6
GetWindowLongA.USER32(00000000,000000F0), ref: 00484404
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049D0A8,004838C2,004838F6,00000000,00483916,?,?,?,0049D0A8), ref: 00484426
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049D0A8,004838C2,004838F6,00000000,00483916,?,?,?,0049D0A8), ref: 0048443A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 05ec80b1a5ea059f1e46bd00b1b84a4df4a79214edb0560d5e0b7a3c355dc52e
Instruction ID: 853664f93d5507641636488f616153839610ac3e498d99c29563de1157162056
Opcode Fuzzy Hash: 05ec80b1a5ea059f1e46bd00b1b84a4df4a79214edb0560d5e0b7a3c355dc52e
Instruction Fuzzy Hash: 50012170A452426ED710B729DC8AF5B23D59B55708F88087BB9049B2A3CA6D9C86971C

Uniqueness

Uniqueness Score: -1.00%

Function 00462BF0 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00462CC4), ref: 00462C48
FindNextFileA.KERNEL32(000000FF,?,00000000,00462CA4,?,00000000,?,00000000,00462CC4), ref: 00462C84
FindClose.KERNEL32(000000FF,00462CAB,00462CA4,?,00000000,?,00000000,00462CC4), ref: 00462C9E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8161c1fc58c62d0873d32aa0dce515bd5f720f3e60e025daf083679a56a30563
Instruction ID: 4c04160e836bd1a319331ad5d92b24fe2fc7de08e129c65e07521ed3e2969e69
Opcode Fuzzy Hash: 8161c1fc58c62d0873d32aa0dce515bd5f720f3e60e025daf083679a56a30563
Instruction Fuzzy Hash: F0210B31504A087ECB11DF66CC41ADEB7BCDB49304F5084B7E408E32A1E67C9E44CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 004241EC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241F4
SetActiveWindow.USER32(?,?,?,?,0046D227), ref: 00424201

Part of subcall function 0042365C: ShowWindow.USER32(00410470,00000009,?,00000000,0041EDB4,0042394A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C1C), ref: 00423677

Part of subcall function 00423B24: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021125AC,0042421A,?,?,?,?,0046D227), ref: 00423B5F

SetFocus.USER32(00000000,?,?,?,?,0046D227), ref: 0042422E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 2caf509772b4e47572ac949d7f8b8f9ae0a5a4117a3619920a2f1982222ed166
Instruction ID: c379361f86f494b348edbf52cdf1d5c809bfbf5168ad2d96a2c3ff14c6914fef
Opcode Fuzzy Hash: 2caf509772b4e47572ac949d7f8b8f9ae0a5a4117a3619920a2f1982222ed166
Instruction Fuzzy Hash: B3F0DA717002209BDB10AFAAD8C5B9676A8EF48344B5541BBBD09DF35BCA7CDC018768

Uniqueness

Uniqueness Score: -1.00%

Function 0042EE28 Relevance: 4.5, APIs: 3, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 0042EE35
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000001), ref: 0042EE45
CreateMutexA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042EE6D

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: c9529d670e38805e5d7fc56090d1e1a2c5dc93b5d38e302cb9dd0bb1378837f7
Instruction ID: b330794617a7040f76ad0da05c7b1ee5a1856395dd3e8d048ce20caf316d4231
Opcode Fuzzy Hash: c9529d670e38805e5d7fc56090d1e1a2c5dc93b5d38e302cb9dd0bb1378837f7
Instruction Fuzzy Hash: 18E0C0B16443007EE200EE758C82F5F76DCDB48714F00483AB654DB1C1E679D9489B96

Uniqueness

Uniqueness Score: -1.00%

Function 00417CDE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D1F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D3D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D73
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D9A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 80df81721c851fc54909025fbba7508eb957103616bde1a785eb7379f52a8f09
Instruction ID: ae07cbcaee7307856f0de191e02e21b90635fd34b211f34cef32728ab7ec892e
Opcode Fuzzy Hash: 80df81721c851fc54909025fbba7508eb957103616bde1a785eb7379f52a8f09
Instruction Fuzzy Hash: 2A017C31204108ABCB10EE59E8C1EEA73A8AF44324F054567FD08CF242D638ECC087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004175A8 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175D3
GetCapture.USER32 ref: 004175DC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 929b6e0a0f42b04595d7d93d82c562164481413a078afa0dbd33014af3ac0fc6
Instruction ID: 8b244cfd74e2e9025fb133a269c9ff628bd031c9e89e3e616ef14db29f4eec50
Opcode Fuzzy Hash: 929b6e0a0f42b04595d7d93d82c562164481413a078afa0dbd33014af3ac0fc6
Instruction Fuzzy Hash: CBF06232304A024BDB31A72EC885AEB62F59F88368B24443FE419C7765EB7CDCD58758

Uniqueness

Uniqueness Score: -1.00%

Function 004241A4 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241AB

Part of subcall function 00423A94: EnumWindows.USER32(00423A2C), ref: 00423AB8
Part of subcall function 00423A94: GetWindow.USER32(?,00000003), ref: 00423ACD
Part of subcall function 00423A94: GetWindowLongA.USER32(?,000000EC), ref: 00423ADC
Part of subcall function 00423A94: SetWindowPos.USER32(00000000,lAB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241BB,?,?,00423D83), ref: 00423B12

SetActiveWindow.USER32(?,?,?,00423D83,00000000,0042416C), ref: 004241BF

Part of subcall function 0042365C: ShowWindow.USER32(00410470,00000009,?,00000000,0041EDB4,0042394A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C1C), ref: 00423677

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 6a9b997a6a6cf91003675646eaf443a00e7e2891d5b78c90ff096ed1e4918312
Instruction ID: b7d9458b5e0a659a50abb462337f5bae1697c0dc3d856a04b5cc34dfb433b66f
Opcode Fuzzy Hash: 6a9b997a6a6cf91003675646eaf443a00e7e2891d5b78c90ff096ed1e4918312
Instruction Fuzzy Hash: 6CE01AA470010187DF00EFAADCC9B9632A8BF48304F55057ABC08CF24BDA3CC950C728

Uniqueness

Uniqueness Score: -1.00%

Function 004125E8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127E5), ref: 004127D3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 8e873b8b5c82bc258c14262f025a038593852d0d4569c028c12fccb2f86baf91
Instruction ID: e2daaee124a258af88011e7d59d1a34290a71591709d5bbd6185ea02eebcb9ba
Opcode Fuzzy Hash: 8e873b8b5c82bc258c14262f025a038593852d0d4569c028c12fccb2f86baf91
Instruction Fuzzy Hash: D851F6356082058FC710DB6AD681A9BF3E5FF98314B2482BBD824C7391D7B8EDA1C759

Uniqueness

Uniqueness Score: -1.00%

Function 00479380 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 004794CE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 6b1d02493392a298fc61abaa1c6c2c31ec0f2e0198a3572e03c7b6984c99f31a
Instruction ID: 236dd2b19c7d089b8d16a2e337f3398dbe63f8722b2531a2196e9aa6f1cdb730
Opcode Fuzzy Hash: 6b1d02493392a298fc61abaa1c6c2c31ec0f2e0198a3572e03c7b6984c99f31a
Instruction Fuzzy Hash: 78413E75608108EFDB10CF99D6808AAB7F5FB48310B74C596E849DB741D338EE42EB94

Uniqueness

Uniqueness Score: -1.00%

Function 0044B6CC Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B678: GetVersionExA.KERNEL32(00000094), ref: 0044B695

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F7E9,00499B2A), ref: 0044B6F3
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B70B
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B71D
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B72F
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B741
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B753
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B765
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B777
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B789
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B79B
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B7AD
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B7BF
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B7D1
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B7E3
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B7F5
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B807
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B819
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B82B
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B83D
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B84F
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B861
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B873
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B885
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B897
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B8A9
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B8BB
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B8CD
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B8DF
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B8F1
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B903
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B915
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B927
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B939
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B94B
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B95D
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B96F
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B981
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B993
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B9A5
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B9B7
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B9C9
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B9DB
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B9ED
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B9FF
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044BA11
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044BA23
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044BA35
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044BA47

Strings

GetThemeSysSize, xrefs: 0044B943
GetThemeDocumentationProperty, xrefs: 0044BA1B
DrawThemeIcon, xrefs: 0044B7DB
DrawThemeText, xrefs: 0044B739
DrawThemeBackground, xrefs: 0044B727
GetThemeIntList, xrefs: 0044B8C5
GetWindowTheme, xrefs: 0044B9AF
GetThemeTextExtent, xrefs: 0044B781
GetThemeTextMetrics, xrefs: 0044B793
HitTestThemeBackground, xrefs: 0044B7B7
IsThemePartDefined, xrefs: 0044B7ED
GetThemeFilename, xrefs: 0044B8FB
OpenThemeData, xrefs: 0044B703
GetThemeString, xrefs: 0044B835
GetThemeEnumValue, xrefs: 0044B86B
EnableThemeDialogTexture, xrefs: 0044B9C1
GetThemeSysColor, xrefs: 0044B90D
GetThemePartSize, xrefs: 0044B76F
GetThemePosition, xrefs: 0044B87D
GetThemeMargins, xrefs: 0044B8B3
GetThemeBackgroundRegion, xrefs: 0044B7A5
GetThemeAppProperties, xrefs: 0044B9E5
SetThemeAppProperties, xrefs: 0044B9F7
GetThemeMetric, xrefs: 0044B823
IsAppThemed, xrefs: 0044B99D
GetThemeBackgroundContentRect, xrefs: 0044B74B, 0044B75D
GetCurrentThemeName, xrefs: 0044BA09
IsThemeDialogTextureEnabled, xrefs: 0044B9D3
IsThemeActive, xrefs: 0044B98B
GetThemeInt, xrefs: 0044B859
SetWindowTheme, xrefs: 0044B8E9
GetThemeSysBool, xrefs: 0044B931
uxtheme.dll, xrefs: 0044B6EE
GetThemeSysFont, xrefs: 0044B955
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B7FF
GetThemeRect, xrefs: 0044B8A1
GetThemeSysInt, xrefs: 0044B979
GetThemeColor, xrefs: 0044B811
GetThemePropertyOrigin, xrefs: 0044B8D7
GetThemeBool, xrefs: 0044B847
CloseThemeData, xrefs: 0044B715
GetThemeFont, xrefs: 0044B88F
DrawThemeParentBackground, xrefs: 0044BA2D
DrawThemeEdge, xrefs: 0044B7C9
GetThemeSysString, xrefs: 0044B967
EnableTheming, xrefs: 0044BA3F
GetThemeSysColorBrush, xrefs: 0044B91F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: a839ccb9c9a861a6ca06feeaf4f5b9cf9d009b24b8deb6d9a0dd113e88dab802
Instruction ID: 8a2f9fdf968ae37fa3cb46079294691732ee00746fcb1dbbaee87679a149b2ae
Opcode Fuzzy Hash: a839ccb9c9a861a6ca06feeaf4f5b9cf9d009b24b8deb6d9a0dd113e88dab802
Instruction Fuzzy Hash: D59153F0A40B51EBEB00EBB59CC6A2A37A8EB15B1471415BBB480EF295D778DC048F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0049363C Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,00493B31,?,?,?,?,00000000,00000000,00000000), ref: 0049367C
FindWindowA.USER32(00000000,00000000), ref: 004936AD

Strings

SENDBROADCASTNOTIFYMESSAGE, xrefs: 004938EB
CHARTOOEMBUFF, xrefs: 00493AD2
FREEDLL, xrefs: 00493A28
LOADDLL, xrefs: 0049393F
SENDMESSAGE, xrefs: 00493701
SLEEP, xrefs: 00493666
FINDWINDOWBYCLASSNAME, xrefs: 00493689
OEMTOCHARBUFF, xrefs: 00493A8F
POSTMESSAGE, xrefs: 00493757
REGISTERWINDOWMESSAGE, xrefs: 0049380F
POSTBROADCASTMESSAGE, xrefs: 00493897
SENDNOTIFYMESSAGE, xrefs: 004937B3
CALLDLLPROC, xrefs: 004939A1
CREATEMUTEX, xrefs: 00493A5D
SENDBROADCASTMESSAGE, xrefs: 00493849
FINDWINDOWBYWINDOWNAME, xrefs: 004936C5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 63938f9eb699edafa4b38cc75a0a75fd63e603512baf0d1292bdd24c92c50593
Instruction ID: a4152d590a00fcb2103b125a3ccebffb387ef8028d9842ff59002d9d4bbfcf41
Opcode Fuzzy Hash: 63938f9eb699edafa4b38cc75a0a75fd63e603512baf0d1292bdd24c92c50593
Instruction Fuzzy Hash: 15C17360B0861067DB14BF7E8C42A1E5A999B89706710CD3FB446EB38BCE3DEE06435D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA1C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA50
CreateCompatibleDC.GDI32(?), ref: 0041CA5C
CreateBitmap.GDI32(0041A954,?,00000001,00000001,00000000), ref: 0041CA80
CreateCompatibleBitmap.GDI32(?,0041A954,?), ref: 0041CA90
SelectObject.GDI32(0041CE4C,00000000), ref: 0041CAAB
FillRect.USER32(0041CE4C,?,?), ref: 0041CAE6
SetTextColor.GDI32(0041CE4C,00000000), ref: 0041CAFB
SetBkColor.GDI32(0041CE4C,00000000), ref: 0041CB12
PatBlt.GDI32(0041CE4C,00000000,00000000,0041A954,?,00FF0062), ref: 0041CB28
CreateCompatibleDC.GDI32(?), ref: 0041CB3B
SelectObject.GDI32(00000000,00000000), ref: 0041CB6C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB84
RealizePalette.GDI32(00000000), ref: 0041CB8D
SelectPalette.GDI32(0041CE4C,00000000,00000001), ref: 0041CB9C
RealizePalette.GDI32(0041CE4C), ref: 0041CBA5
SetTextColor.GDI32(00000000,00000000), ref: 0041CBBE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBD5
BitBlt.GDI32(0041CE4C,00000000,00000000,0041A954,?,00000000,00000000,00000000,00CC0020), ref: 0041CBF1
SelectObject.GDI32(00000000,?), ref: 0041CBFE
DeleteDC.GDI32(00000000), ref: 0041CC14

Part of subcall function 0041A068: GetSysColor.USER32(?), ref: 0041A072

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 4ca59b6a0274778b805c4fb938ae70b5b7038b59239f44c78db000f093aa3429
Instruction ID: 4a976381369a00188f54b32674623e6c4b83415f3a667354aa154cca89d68730
Opcode Fuzzy Hash: 4ca59b6a0274778b805c4fb938ae70b5b7038b59239f44c78db000f093aa3429
Instruction Fuzzy Hash: 2C61EE71A44608AFDB10EBE9DC86FDFB7B8EF49704F14446AB504E7281D67CA940CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004566E0 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310COMMON

Download Yara Rule

APIs

756FE550.OLE32(0049AA74,00000000,00000001,0049A774,?,00000000,00456A8B), ref: 00456726
756FE550.OLE32(0049A764,00000000,00000001,0049A774,?,00000000,00456A8B), ref: 0045674C
SysFreeString.OLEAUT32(00000000), ref: 00456903

Strings

IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 004568E8
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 00456899
%ProgramFiles(x86)%\, xrefs: 004567D6
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 0045693A
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 00456972
IPersistFile::Save, xrefs: 00456A0A
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004569AC
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 00456865
IPropertyStore::Commit, xrefs: 0045698B
{pf32}\, xrefs: 004567C6
CoCreateInstance, xrefs: 00456757

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: E550$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 491012016-2363233914
Opcode ID: 3b6fee094d66d697fa9171554068c65671c4bd89450f12da3872c27bb1941299
Instruction ID: 4ce3ebcf67b96dd71fc540010760e00fb03863a8625da7c0963ed030644eaaaa
Opcode Fuzzy Hash: 3b6fee094d66d697fa9171554068c65671c4bd89450f12da3872c27bb1941299
Instruction Fuzzy Hash: 2BB13170A00108AFDB50DFA9C985B9E7BF8AF49306F554066F804E7362DB78DD48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00473118 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 341COMMON

Download Yara Rule

APIs

Part of subcall function 0042C814: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C838

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004732D0
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 004733EB
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00473401
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00473426

Strings

Dest filename: %s, xrefs: 00473272
.lnk, xrefs: 004731A4
.url, xrefs: 004731EA
Successfully created the icon., xrefs: 004733C5
target.lnk, xrefs: 00473470
Creating the icon., xrefs: 004732E5
.pif, xrefs: 004731C7, 00473365
{group}\, xrefs: 00473172
Desktop.ini, xrefs: 004734A7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Creating the icon.$Desktop.ini$Dest filename: %s$Successfully created the icon.$target.lnk${group}\
API String ID: 971782779-2902529204
Opcode ID: 4ffdb90c6a93518aec7266fd18ed477bfafa4a48e08a1740df424f60af333576
Instruction ID: 025292380d972ff196c72f4701d48b56c0df9465c1c5861d8ac6dd847ec23b0e
Opcode Fuzzy Hash: 4ffdb90c6a93518aec7266fd18ed477bfafa4a48e08a1740df424f60af333576
Instruction Fuzzy Hash: 32D13374A00149AFDB01EFA9D582BDDBBF4AF08305F50806AF804B7392D7789E45DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00499308 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,004996A0,?,?,00000000,?,00000000,00000000,?,00499A57,00000000,00499A61,?,00000000), ref: 0049938B
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004996A0,?,?,00000000,?,00000000,00000000,?,00499A57,00000000), ref: 0049939E
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004996A0,?,?,00000000,?,00000000,00000000), ref: 004993AE
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004993CF
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004996A0,?,?,00000000,?,00000000), ref: 004993DF

Part of subcall function 0042D45C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4EA,?,?,?,00000001,?,00456126,00000000,0045618E), ref: 0042D491

Strings

/REGU, xrefs: 00499361
/REG, xrefs: 0049933D
.msg, xrefs: 00499402
Setup, xrefs: 00499377
Inno-Setup-RegSvr-Mutex, xrefs: 00499395
.lst, xrefs: 0049941C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 30c8744cd328d845e86e71b9d61709ca6930bc49a1ec42000178f3322fc114d1
Instruction ID: 8dd71c2e5523453c76c4f4e7d7db365ec9d03891112883a61e0dbeab18b9d6d4
Opcode Fuzzy Hash: 30c8744cd328d845e86e71b9d61709ca6930bc49a1ec42000178f3322fc114d1
Instruction Fuzzy Hash: 8891A531A04244AFDF11EFA9C852BAF7BA4EB49704F51447EF800A7692DA7CAC05CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0045A780 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045AA3C,?,?,?,?,?,00000006,?,00000000,00498795,?,00000000,00498838), ref: 0045A8EE

Strings

Failed to strip read-only attribute., xrefs: 0045A8D3
Stripped read-only attribute., xrefs: 0045A8C7
.chm, xrefs: 0045A81C
Failed to delete the file; it may be in use (%d)., xrefs: 0045A9DD
.lnk, xrefs: 0045A85B
.hlp, xrefs: 0045A7B7
Deleting file: %s, xrefs: 0045A88D
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A937
.fts, xrefs: 0045A7F4
.gid, xrefs: 0045A7D0
.chw, xrefs: 0045A835

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: baca180e72198f758c6bb3293060e9f6b00c8dd649093d0517c2bf5542be1418
Instruction ID: 47b20d326fd82fe6504d69cf898c82eeddf784bf4f3b73b35613650615bf039f
Opcode Fuzzy Hash: baca180e72198f758c6bb3293060e9f6b00c8dd649093d0517c2bf5542be1418
Instruction Fuzzy Hash: D171A030B042546BDB00EB6988827AE7BA49F48305F50856BFC01EB383CB7CDE59C75A

Uniqueness

Uniqueness Score: -1.00%

Function 0045CC68 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CC82
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CCA2
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CCAF
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CCBC
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CCCA

Part of subcall function 0045CB70: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CC0F,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CBE9

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CEBD,?,?,00000000), ref: 0045CD83
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CEBD,?,?,00000000), ref: 0045CD8C

Strings

SetEntriesInAclW, xrefs: 0045CCC4
advapi32.dll, xrefs: 0045CC9D
W, xrefs: 0045CD9A
GetNamedSecurityInfoW, xrefs: 0045CCA9
SetNamedSecurityInfoW, xrefs: 0045CCB6

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 25e18c871b4f8ee330dd2b6c5c3f1bffcb34b277cb06e65cb9f4471773f940d9
Instruction ID: e70f229ab34f11e3bb96b7fa9db8dd957f06ce772e443448e3a5811e0bd6c06d
Opcode Fuzzy Hash: 25e18c871b4f8ee330dd2b6c5c3f1bffcb34b277cb06e65cb9f4471773f940d9
Instruction Fuzzy Hash: BA5195B1900704EFDB10DF99C881BEEB7B9EB48715F14806AF915F7282C2789945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3BC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3D3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3DD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3EF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B406
GetDC.USER32(00000000), ref: 0041B412
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B43F
ReleaseDC.USER32(00000000,00000000), ref: 0041B465
SelectObject.GDI32(00000000,?), ref: 0041B480
SelectObject.GDI32(?,00000000), ref: 0041B48F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4BB
SelectObject.GDI32(00000000,00000000), ref: 0041B4C9
SelectObject.GDI32(?,00000000), ref: 0041B4D7
DeleteDC.GDI32(00000000), ref: 0041B4E0
DeleteDC.GDI32(?), ref: 0041B4E9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: a07e3cbb24df5042cba66812f0bcbe2bed2d5bf396793bbd6052f972fec3ec6c
Instruction ID: 6b909a1540c808143a27ece7eebc35972739c5532850bae840edfb4e77f88e68
Opcode Fuzzy Hash: a07e3cbb24df5042cba66812f0bcbe2bed2d5bf396793bbd6052f972fec3ec6c
Instruction Fuzzy Hash: 5641CE71E44609AFDB10DAE9C846FEFB7BCEB08704F104466B614F7282C7786D408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004548E8 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegQueryValueExA.ADVAPI32(0045AC12,00000000,00000000,?,00000000,?,00000000,00454B81,?,0045AC12,00000003,00000000,00000000,00454BB8), ref: 00454A01

Part of subcall function 0042E8D8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004532E7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8F7

RegQueryValueExA.ADVAPI32(0045AC12,00000000,00000000,00000000,?,00000004,00000000,00454ACB,?,0045AC12,00000000,00000000,?,00000000,?,00000000), ref: 00454A85
RegQueryValueExA.ADVAPI32(0045AC12,00000000,00000000,00000000,?,00000004,00000000,00454ACB,?,0045AC12,00000000,00000000,?,00000000,?,00000000), ref: 00454AB4

Strings

, xrefs: 00454972
RegOpenKeyEx, xrefs: 00454984
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045491F
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454958

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 96d48e7607ffe2b614b00703a534fe24f13a717bbd3f23e13080b51836406b73
Instruction ID: f9892de48a8f191bc49ac76cf4be280f3350b447777e8b89a87aacf0c036b8b5
Opcode Fuzzy Hash: 96d48e7607ffe2b614b00703a534fe24f13a717bbd3f23e13080b51836406b73
Instruction Fuzzy Hash: 31912571E44208ABDB41DB95C941BDEB7FCEB89309F10447BF900FB282D6789E458B69

Uniqueness

Uniqueness Score: -1.00%

Function 00459500 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0045940C: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459549,00000000,00459701,?,00000000,00000000,00000000), ref: 00459459

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459701,?,00000000,00000000,00000000), ref: 004595A7
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459701,?,00000000,00000000,00000000), ref: 00459611

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459701,?,00000000,00000000,00000000), ref: 00459678

Strings

v2.0.50727, xrefs: 00459603
v4.0.30319, xrefs: 00459599
.NET Framework version %s not found, xrefs: 004596B1
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 004595C4
.NET Framework not found, xrefs: 004596C5
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 0045962B
v1.1.4322, xrefs: 0045966A
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 0045955A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: efb7f51e244a9cbadba5a28ce353df7223dc00c92d8b3220088f6614b2e99033
Instruction ID: 13449528a83cd7bd3976393389562d3fcc4363bdf2ba35ed2198dacadad7a936
Opcode Fuzzy Hash: efb7f51e244a9cbadba5a28ce353df7223dc00c92d8b3220088f6614b2e99033
Instruction Fuzzy Hash: FC51B135A04145EBCB01DF64C8A1BEE77A6DB89305F54447BE8019B393EB3D9E0E8B18

Uniqueness

Uniqueness Score: -1.00%

Function 00458AEC Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00458B23
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00458B3F
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00458B4D
GetExitCodeProcess.KERNEL32(?), ref: 00458B5E
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458BA5
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458BC1

Strings

Helper process exited with failure code: 0x%x, xrefs: 00458B8B
Helper isn't responding; killing it., xrefs: 00458B2F
Helper process exited., xrefs: 00458B6D
Helper process exited, but failed to get exit code., xrefs: 00458B97
Stopping 64-bit helper process. (PID: %u), xrefs: 00458B15

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 17a319fa5b606cce47f309d39e44684ea6bb31c5554c2685b5e40918274b793d
Instruction ID: 7e49c79e8349cf5087e4bea88bd9331b7e76427b7ebfc1862ecfa5aa0db55867
Opcode Fuzzy Hash: 17a319fa5b606cce47f309d39e44684ea6bb31c5554c2685b5e40918274b793d
Instruction Fuzzy Hash: 462162706047409BC760E77DC442B5B76D89F44305F008C2EB999E7283DF7CE8489B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0045459C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDF4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE20

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00454773,?,00000000,00454837), ref: 004546C3
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00454773,?,00000000,00454837), ref: 004547FF

Part of subcall function 0042E8D8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004532E7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8F7

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004545DB
RegCreateKeyEx, xrefs: 00454637
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045460B
, xrefs: 00454625

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 476bb10c59b0043d733d483ae28e7727cbf1c473a85270c55f76d1914d0854bb
Instruction ID: dcb2efb4518004930bb79e36ff4c26a26f41c5c3291808b61d16842317edebf7
Opcode Fuzzy Hash: 476bb10c59b0043d733d483ae28e7727cbf1c473a85270c55f76d1914d0854bb
Instruction Fuzzy Hash: E6810175A00209AFDB00EFD5C941BEEB7B9EB49305F50442AF900FB282D7789A45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00497B88 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00453930: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,Y}I,_iu,?,00000000,00453A6A), ref: 00453A1F
Part of subcall function 00453930: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,Y}I,_iu,?,00000000,00453A6A), ref: 00453A2F

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00497C05
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00497D59), ref: 00497C26
CreateWindowExA.USER32(00000000,STATIC,00497D68,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00497C4D
SetWindowLongA.USER32(?,000000FC,004973E0), ref: 00497C60
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00497D2C,?,?,000000FC,004973E0,00000000,STATIC,00497D68), ref: 00497C90
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00497D04
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00497D2C,?,?,000000FC,004973E0,00000000), ref: 00497D10

Part of subcall function 00453DA4: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E8B

DestroyWindow.USER32(?,00497D33,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00497D2C,?,?,000000FC,004973E0,00000000,STATIC), ref: 00497D26

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00497CBF
STATIC, xrefs: 00497C46

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 9703ddfa9042bf661740fd5151c9f2a360ad34a75422ab22a881029b1ebe9bdf
Instruction ID: 3804e0fcdaaefd5d1a569ce4af199ccbdcebc9408d7bf1737fde13e6aae1440d
Opcode Fuzzy Hash: 9703ddfa9042bf661740fd5151c9f2a360ad34a75422ab22a881029b1ebe9bdf
Instruction Fuzzy Hash: 17414170A18208AFDF10EFA5DC42FAE7BB8EF09714F514576F500F7291D679AA008B68

Uniqueness

Uniqueness Score: -1.00%

Function 00462E90 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00462E9C
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462EB0
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462EBD
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462ECA
GetWindowRect.USER32(?,00000000), ref: 00462F16
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462F54

Strings

MonitorFromWindow, xrefs: 00462EB7
GetMonitorInfoA, xrefs: 00462EC4
user32.dll, xrefs: 00462EAB
(, xrefs: 00462EF5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: cd5ac00e0b813c2dad08efa735e04df3816ddba5b903b5732650584cc97827c2
Instruction ID: f7be0898d797cbf4206d4c5a73b17157baec9bf5b5734d7f8b1683937b114940
Opcode Fuzzy Hash: cd5ac00e0b813c2dad08efa735e04df3816ddba5b903b5732650584cc97827c2
Instruction Fuzzy Hash: 3B21C272704A056BD704D668CD81F3B33A8EB98710F08092AF944EB3C5EAB8DC059B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F1E8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F1F4
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F208
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F215
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F222
GetWindowRect.USER32(?,00000000), ref: 0042F26E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F2AC

Strings

user32.dll, xrefs: 0042F203
MonitorFromWindow, xrefs: 0042F20F
(, xrefs: 0042F24D
GetMonitorInfoA, xrefs: 0042F21C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: c22e864e8621cd401e85ed0c650373977bc5d6ab1c5925e2e74ba17c181ca476
Instruction ID: cafee556b4ff86616240ec82e2754e32886365cebaf319099c414f584e750c92
Opcode Fuzzy Hash: c22e864e8621cd401e85ed0c650373977bc5d6ab1c5925e2e74ba17c181ca476
Instruction Fuzzy Hash: 3421D77A704614ABD300D664DD81F3B33E4DB89B14F89057AFD40DB381DA79DC084BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00458CC4 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458EA3,?,00000000,00458F06,?,?,00000000,00000000), ref: 00458D21
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458E38,?,00000000,00000001,00000000,00000000,00000000,00458EA3), ref: 00458D7E
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458E38,?,00000000,00000001,00000000,00000000,00000000,00458EA3), ref: 00458D8B
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458DD7
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458E11,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458E38,?,00000000), ref: 00458DFD
GetLastError.KERNEL32(?,?,00000000,00000001,00458E11,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458E38,?,00000000), ref: 00458E04

Part of subcall function 00453510: GetLastError.KERNEL32(00000000,004540A5,00000005,00000000,004540DA,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004992DD,00000000), ref: 00453513

Strings

CreateEvent, xrefs: 00458D2F
TransactNamedPipe, xrefs: 00458D97

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 4aedb3effb131eb12096de23c6ec266e4eccd52ab9ba69b589d38fb429daa943
Instruction ID: b755420f5ccc64554a28e8d5f72de5b6a69c50c517f2f1d69fd7c456eb535d6c
Opcode Fuzzy Hash: 4aedb3effb131eb12096de23c6ec266e4eccd52ab9ba69b589d38fb429daa943
Instruction Fuzzy Hash: 4A417371A00608EFDB15DF95CD81F9EB7F9EB48715F10406AF904E7292DA789E44CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00456DC8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456F2D,?,?,00000031,?), ref: 00456DF0
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456DF6
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456E43

Part of subcall function 00453510: GetLastError.KERNEL32(00000000,004540A5,00000005,00000000,004540DA,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004992DD,00000000), ref: 00453513

Strings

GetProcAddress, xrefs: 00456E03
ITypeLib::GetLibAttr, xrefs: 00456E79
LoadTypeLib, xrefs: 00456E4E
UnRegisterTypeLib, xrefs: 00456EAF
OLEAUT32.DLL, xrefs: 00456DEB
UnRegisterTypeLib, xrefs: 00456DE6

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 7b1ec654037b0c607dfe6d04a3082381f0cbc5cf9cb070b5b8bf219295e165cb
Instruction ID: 2b224e74544e423aed3b5227b18181137566e670263372cbc00570a3e14d3cd7
Opcode Fuzzy Hash: 7b1ec654037b0c607dfe6d04a3082381f0cbc5cf9cb070b5b8bf219295e165cb
Instruction Fuzzy Hash: 2B319275A00504AFDB11EFAACC42D5FB7BEEB89705752846AF804D3652DA38DD04CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0042E428 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E52D,?,00000000,0047F060,00000000), ref: 0042E451
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E457
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E52D,?,00000000,0047F060,00000000), ref: 0042E4A5

Strings

kernel32.dll, xrefs: 0042E44C
.DEFAULT\Control Panel\International, xrefs: 0042E47C
GetUserDefaultUILanguage, xrefs: 0042E447
Locale, xrefs: 0042E494
Control Panel\Desktop\ResourceLocale, xrefs: 0042E4B4

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 116c7ea7482ee854b27677d23d388e227389d3b458dccd8df34239c13ad1cbf2
Instruction ID: 3fe9fe372c4d794b24d5987f6434f9a2f248a379bc076d0360e6e1ac237d63e0
Opcode Fuzzy Hash: 116c7ea7482ee854b27677d23d388e227389d3b458dccd8df34239c13ad1cbf2
Instruction Fuzzy Hash: 16216430B10219BBCB10EAF7DC45A9E77A8EB04308FA04877A500E7281EB7CDE459B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00416D90 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E23
SaveDC.GDI32(?), ref: 00416E37
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E5A
RestoreDC.GDI32(?,?), ref: 00416E75
CreateSolidBrush.GDI32(00000000), ref: 00416EF5
FrameRect.USER32(?,?,?), ref: 00416F28
DeleteObject.GDI32(?), ref: 00416F32
CreateSolidBrush.GDI32(00000000), ref: 00416F42
FrameRect.USER32(?,?,?), ref: 00416F75
DeleteObject.GDI32(?), ref: 00416F7F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 5cfd911b6dc3f54e742c9a1af7ebf2e654604ebbbc7a8e211eeb1ec9d0731ece
Instruction ID: c727efbf8946963a4c0451e641fd5f3f57076e2c2b79ed229a1c60f75d7412ee
Opcode Fuzzy Hash: 5cfd911b6dc3f54e742c9a1af7ebf2e654604ebbbc7a8e211eeb1ec9d0731ece
Instruction Fuzzy Hash: A0513AB12047455FDB50EF69C8C4B9B77E8AF48314F1546AAFD488B286C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 004221F8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422243
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422261
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042227B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422288
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422295
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 004222A2
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 004222AF
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222CD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222E9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: e6f6e88d9f510f0f3b0e8e18c3ab89d78e01910971af7c90ba43089d9e84d88e
Instruction ID: efa19709b170cd1c2d0de868379c086f5835f405e594c588ded1d161c250978f
Opcode Fuzzy Hash: e6f6e88d9f510f0f3b0e8e18c3ab89d78e01910971af7c90ba43089d9e84d88e
Instruction Fuzzy Hash: 112124703807447AE720E725CD8BF9B7BD89B04718F5440A9BA48BF2D3C6F9AA40865C

Uniqueness

Uniqueness Score: -1.00%

Function 00461A20 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 00461A5B
GetActiveWindow.USER32 ref: 00461ABF
CoInitialize.OLE32(00000000), ref: 00461AD3
SHBrowseForFolder.SHELL32(?), ref: 00461AEA
756CD120.OLE32(00461B2B,00000000,?,?,?,?,?,00000000,00461BAF), ref: 00461AFF
SetActiveWindow.USER32(?,00461B2B,00000000,?,?,?,?,?,00000000,00461BAF), ref: 00461B15
SetActiveWindow.USER32(?,?,00461B2B,00000000,?,?,?,?,?,00000000,00461BAF), ref: 00461B1E

Strings

A, xrefs: 00461A93

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: 87fc1a129e356b8a28f21a5759df59c6fa1fd08ca766617989575b20af432755
Instruction ID: 6d7c99e10df056dd131aa7d77872138206f8f41126057bbe590213a6c48adeb5
Opcode Fuzzy Hash: 87fc1a129e356b8a28f21a5759df59c6fa1fd08ca766617989575b20af432755
Instruction Fuzzy Hash: 8A312171E00248AFDB10EFE6D885A9EBBF8EB09704F55447BF804E7251E7785A04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00472FC8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00473089,?,?,?,00000008,00000000,00000000,00000000,?,004732E5,?,?,00000000,00473568), ref: 00472FEC

Part of subcall function 0042CDA4: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE1A

Part of subcall function 00406F60: DeleteFileA.KERNEL32(00000000,0049C628,00499629,00000000,0049967E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F6B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00473089,?,?,?,00000008,00000000,00000000,00000000,?,004732E5), ref: 00473063
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00473089,?,?,?,00000008,00000000,00000000,00000000), ref: 00473069

Strings

.ShellClassInfo, xrefs: 0047301B
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 00473025
target.lnk, xrefs: 00473041
desktop.ini, xrefs: 00473000
CLSID2, xrefs: 00473016

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: c65df11cc014ba2c3f040c5fc7a13ae6dd935502d443437e19c6d20310e212ea
Instruction ID: 3ebe5e11ec2be92e3442dec6bb78e3a53129e06e00566201cc74f0af751ca908
Opcode Fuzzy Hash: c65df11cc014ba2c3f040c5fc7a13ae6dd935502d443437e19c6d20310e212ea
Instruction Fuzzy Hash: DA11D0307006547BD701EA7A8C82B9EB7ACDB48714F60817BB404A72C5DB3CAF01965D

Uniqueness

Uniqueness Score: -1.00%

Function 0045D35C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D365
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D375
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D385
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D395

Strings

inflateInit_, xrefs: 0045D35F
inflateReset, xrefs: 0045D38F
inflate, xrefs: 0045D36F
inflateEnd, xrefs: 0045D37F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: dc90f1f262602021e393954f48f97557164b85cd901e8b5ff6cac9b118bc13cf
Instruction ID: a094d50e791027cbd3930c6bcb0dd8b00ad2176992dcb97735ddb1afc71f87fe
Opcode Fuzzy Hash: dc90f1f262602021e393954f48f97557164b85cd901e8b5ff6cac9b118bc13cf
Instruction Fuzzy Hash: 170128B0D00700DAE324DF36AC4272636A5EFA430EF14903BAD48962B7D779485B9A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8EC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9C9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041AA03
SetBkColor.GDI32(?,?), ref: 0041AA18
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA62
SetTextColor.GDI32(00000000,00000000), ref: 0041AA6D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA7D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AABC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAC6
SetBkColor.GDI32(00000000,?), ref: 0041AAD3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: d71819692956c1e35f7249c5b1debfe9fe6de0bb8e9f127e5c8e0a5049c0b5c3
Instruction ID: 3742fc556daaed9ad14d930c470d40cb5efd251a519f467f7f8e710c3ba79c5e
Opcode Fuzzy Hash: d71819692956c1e35f7249c5b1debfe9fe6de0bb8e9f127e5c8e0a5049c0b5c3
Instruction Fuzzy Hash: A561E5B5A00105EFCB40EFA9D985E9ABBF8EF08314B108166F518DB261CB34ED50CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0045816C Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8D4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8E7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458320,?, /s ",?,regsvr32.exe",?,00458320), ref: 00458292

Strings

0x%x, xrefs: 004582B5
Spawning 32-bit RegSvr32: , xrefs: 00458219
CreateProcess, xrefs: 00458284
D, xrefs: 00458248
/u, xrefs: 004581CE
/s ", xrefs: 004581DB
Spawning 64-bit RegSvr32: , xrefs: 004581F7
regsvr32.exe", xrefs: 004581B3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: c7731139bdfcb9c5ac68742a8368e2c3903522e5df6c50ddb3ac97de8863c3be
Instruction ID: 3217153a075e29e22e4edd5f99a32045657764684ff44c5b21fe10df6120cd58
Opcode Fuzzy Hash: c7731139bdfcb9c5ac68742a8368e2c3903522e5df6c50ddb3ac97de8863c3be
Instruction Fuzzy Hash: 28411770A00308ABDB10EFD5C842BDEB7F9AF45705F50407FA904BB292DF799A098B59

Uniqueness

Uniqueness Score: -1.00%

Function 0044D1EC Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D21D
GetSysColor.USER32(00000014), ref: 0044D224
SetTextColor.GDI32(00000000,00000000), ref: 0044D23C
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D265
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D26F
GetSysColor.USER32(00000010), ref: 0044D276
SetTextColor.GDI32(00000000,00000000), ref: 0044D28E
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D2B7
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D2E2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 5d63a09364871b27c41f031840cf1d5e0d39309869d3cc0de464a31652ddf03a
Instruction ID: bddce6b53f256ac6c171d17b767d3a31006e7acd236a538b09f11432ecbe9b7c
Opcode Fuzzy Hash: 5d63a09364871b27c41f031840cf1d5e0d39309869d3cc0de464a31652ddf03a
Instruction Fuzzy Hash: 6921AFB42015047FC710FB6ACD8AE8B7BDC9F19319B01857AB918EB392C678DE404669

Uniqueness

Uniqueness Score: -1.00%

Function 0041B67C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B755
GetDC.USER32(?), ref: 0041B761
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B796
RealizePalette.GDI32(00000000), ref: 0041B7A2
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7D0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B804

Strings

O0H, xrefs: 0041B684

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: O0H
API String ID: 3275473261-600239294
Opcode ID: c0b27d3b7a66d9be5bed6a7f47b95188f2d45c1e9081e04c5e1905c96dbfd583
Instruction ID: a2c5ddb66569cb6b77bb8b351ce757b8a6afb07cbb9f01b77a2eee85226ebd67
Opcode Fuzzy Hash: c0b27d3b7a66d9be5bed6a7f47b95188f2d45c1e9081e04c5e1905c96dbfd583
Instruction Fuzzy Hash: BB512F74A00208DFCB11DFA9C855AEEBBB9FF49704F104066F504A7390D7789981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B94C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA27
GetDC.USER32(?), ref: 0041BA33
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA6D
RealizePalette.GDI32(00000000), ref: 0041BA79
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA9D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAD1

Strings

O0H, xrefs: 0041B954

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: O0H
API String ID: 3275473261-600239294
Opcode ID: 2ce40bb40bbcf4fda08707fe581e59aceef162c3ea3b02671fd4d2ee797de512
Instruction ID: 9811d2e4aff7790a224b19fb8c07a8c8a8d7caa6f03daf8ca787c0bc2bb5238d
Opcode Fuzzy Hash: 2ce40bb40bbcf4fda08707fe581e59aceef162c3ea3b02671fd4d2ee797de512
Instruction Fuzzy Hash: 48512974A002189FCB11DFA9C891AAEBBF9FF48700F15806AF504EB751D7789D40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0049742C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 004509A0: SetEndOfFile.KERNEL32(?,?,0045C3EA,00000000,0045C575,?,00000000,00000002,00000002), ref: 004509A7

Part of subcall function 00406F60: DeleteFileA.KERNEL32(00000000,0049C628,00499629,00000000,0049967E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F6B

GetWindowThreadProcessId.USER32(00000000,?), ref: 004974BD
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 004974D1
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 004974EB
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004974F7
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004974FD
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497510

Strings

Deleting Uninstall data files., xrefs: 00497433

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 5a4638620c35850298309b7f54e2c31a9ebcaa3c0d404bc10bb24c2aa0ee3937
Instruction ID: 6aecf21d6b9d889d24110d98aa9fa01515905ed67d311fc9d71862c51ed89e4f
Opcode Fuzzy Hash: 5a4638620c35850298309b7f54e2c31a9ebcaa3c0d404bc10bb24c2aa0ee3937
Instruction Fuzzy Hash: B3214171718204BFEB11E77AED42B263B98D75836CF51443BB50196292D67C9C01CF2D

Uniqueness

Uniqueness Score: -1.00%

Function 004707C8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004708C5,?,?,?,?,00000000), ref: 0047082F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004708C5), ref: 00470846
AddFontResourceA.GDI32(00000000), ref: 00470863
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00470877

Strings

Failed to set value in Fonts registry key., xrefs: 00470838
AddFontResource, xrefs: 00470881
Failed to open Fonts registry key., xrefs: 0047084D

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 1aa6c14af8f4713e7237fad4c78a6845d1098113b13690e55099eec46e46e33a
Instruction ID: 2b2f66cf8757b5e1319f2889bf04b98eef7c893bd9e8ceb2197fe524f638d6d2
Opcode Fuzzy Hash: 1aa6c14af8f4713e7237fad4c78a6845d1098113b13690e55099eec46e46e33a
Instruction Fuzzy Hash: C521A370741204B7EB10FA668C42FAA67ACDF55704F61807BB908EB3C2D67C9E0546AE

Uniqueness

Uniqueness Score: -1.00%

Function 004632D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416420: GetClassInfoA.USER32(00400000,?,?), ref: 0041648F
Part of subcall function 00416420: UnregisterClassA.USER32(?,00400000), ref: 004164BB
Part of subcall function 00416420: RegisterClassA.USER32(?), ref: 004164DE

GetVersion.KERNEL32 ref: 00463300
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 0046333E
SHGetFileInfo.SHELL32(004633DC,00000000,?,00000160,00004011), ref: 0046335B
LoadCursorA.USER32(00000000,00007F02), ref: 00463379
SetCursor.USER32(00000000,00000000,00007F02,004633DC,00000000,?,00000160,00004011), ref: 0046337F
SetCursor.USER32(?,004633BF,00007F02,004633DC,00000000,?,00000160,00004011), ref: 004633B2

Strings

Explorer, xrefs: 0046331A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: ac3bdc2a3f0b403ac4ee9ed8515078e32b2bd683749590332e8e7f2c61a3f06f
Instruction ID: 982b9adcbb158b7d686adda6cfc5fefe4d97728e180ce11b5e23522381ac7952
Opcode Fuzzy Hash: ac3bdc2a3f0b403ac4ee9ed8515078e32b2bd683749590332e8e7f2c61a3f06f
Instruction Fuzzy Hash: A9210A707403446AE710BF759C87F9A76989B05709F4000BFBA09EE2C3EEBC9955866D

Uniqueness

Uniqueness Score: -1.00%

Function 00478C30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02112BD8,?,?,?,02112BD8,00478DF4,00000000,00478F12,?,?,?,?), ref: 00478C49
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00478C4F
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02112BD8,?,?,?,02112BD8,00478DF4,00000000,00478F12,?,?,?,?), ref: 00478C62
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02112BD8,?,?,?,02112BD8), ref: 00478C8C
CloseHandle.KERNEL32(00000000,?,?,?,02112BD8,00478DF4,00000000,00478F12,?,?,?,?), ref: 00478CAA

Strings

kernel32.dll, xrefs: 00478C44
GetFinalPathNameByHandleA, xrefs: 00478C3F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: ffe43fc24211ed6e894bad1274c1730e78a55e03942665e3c74dbd80705a7dcd
Instruction ID: 1a704c58934110da59e83a12eab1a6e3c3c580596322261ef5a45fd173ac17a7
Opcode Fuzzy Hash: ffe43fc24211ed6e894bad1274c1730e78a55e03942665e3c74dbd80705a7dcd
Instruction Fuzzy Hash: 2701A1A07817042AE522316A4D8AFBB244C8B50768F14813F7A1CFB3D2EDAC994A017E

Uniqueness

Uniqueness Score: -1.00%

Function 00459EB4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A036,?,00000000,00000000,00000000,?,00000006,?,00000000,00498795,?,00000000,00498838), ref: 00459F7A

Part of subcall function 00454468: FindClose.KERNEL32(000000FF,0045455E), ref: 0045454D

Strings

Failed to strip read-only attribute., xrefs: 00459F48
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459F54
Deleting directory: %s, xrefs: 00459F03
Stripped read-only attribute., xrefs: 00459F3C
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459FEF
Failed to delete directory (%d)., xrefs: 0045A010
Failed to delete directory (%d). Will retry later., xrefs: 00459F93

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: a3beb4a6cf6c11115dae5ac1670a5197d2635f59a27f60c87ba19cffdc84621f
Instruction ID: f7c933924608f42955d773fda0cc7ecec7f056cd1af039b488d7310b1683b7b3
Opcode Fuzzy Hash: a3beb4a6cf6c11115dae5ac1670a5197d2635f59a27f60c87ba19cffdc84621f
Instruction Fuzzy Hash: 2741AF30A142459ACB14DF6988013AEBAA59F4970AF50867BAC05D73C3CB7D8D1DC75E

Uniqueness

Uniqueness Score: -1.00%

Function 00422E60 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EB4
GetCapture.USER32 ref: 00422EC3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EC9
ReleaseCapture.USER32 ref: 00422ECE
GetActiveWindow.USER32 ref: 00422EDD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F5C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FC0
GetActiveWindow.USER32 ref: 00422FCF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 06c2c25ab4625e6a12ef9fe20926c64d163ddab9116358fb536025dafeb4e416
Instruction ID: 5ea5fd569023dc8c87c0f060f2033c8effa86d07781bc97308b393d06b21a190
Opcode Fuzzy Hash: 06c2c25ab4625e6a12ef9fe20926c64d163ddab9116358fb536025dafeb4e416
Instruction Fuzzy Hash: 42414F70B00254AFDB10EB69DA82B9E77F1EF48304F5540BAF500AB292D7B89E40DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429490 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042949A
GetTextMetricsA.GDI32(00000000), ref: 004294A3

Part of subcall function 0041A1F8: CreateFontIndirectA.GDI32(?), ref: 0041A2B7

SelectObject.GDI32(00000000,00000000), ref: 004294B2
GetTextMetricsA.GDI32(00000000,?), ref: 004294BF
SelectObject.GDI32(00000000,00000000), ref: 004294C6
ReleaseDC.USER32(00000000,00000000), ref: 004294CE
GetSystemMetrics.USER32(00000006), ref: 004294F3
GetSystemMetrics.USER32(00000006), ref: 0042950D

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: b028a42e1d338c124bb671de452d6d3a0937d8d05e32a077c3bcbdbedd7fb025
Instruction ID: 697d7c7282338d87a55ab62dd7e79ac53eeb01c5e9ca74f61c727bf968a75029
Opcode Fuzzy Hash: b028a42e1d338c124bb671de452d6d3a0937d8d05e32a077c3bcbdbedd7fb025
Instruction Fuzzy Hash: 4B01E1517087113AF311767A8CC2F6F65C8CB48348F44043AFA46963D3D96C9C81872A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE34 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE37
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE41
ReleaseDC.USER32(00000000,00000000), ref: 0041DE4E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE5D
GetStockObject.GDI32(00000007), ref: 0041DE6B
GetStockObject.GDI32(00000005), ref: 0041DE77
GetStockObject.GDI32(0000000D), ref: 0041DE83
LoadIconA.USER32(00000000,00007F00), ref: 0041DE94

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: acbeab26448ca7b360d039afddd60c8d357067f60e495a2bdddab1aa7473d77b
Instruction ID: 417a648a5fb8aa5baf3b27a45d37177240889d53830a96f1de9ccb55acdbe8d0
Opcode Fuzzy Hash: acbeab26448ca7b360d039afddd60c8d357067f60e495a2bdddab1aa7473d77b
Instruction Fuzzy Hash: D0113D706443015AE340FFA65992BAA3690EB24709F00913FF609AF3D1DA7E1C849B6E

Uniqueness

Uniqueness Score: -1.00%

Function 004636E0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 004637E4
SetCursor.USER32(00000000,00000000,00007F02,00000000,00463879), ref: 004637EA
SetCursor.USER32(?,00463861,00007F02,00000000,00463879), ref: 00463854

Strings

Internal error: Item already expanding, xrefs: 00463781
, xrefs: 00463A5F
, xrefs: 00463A7A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 2300a346019b11ec47d82bf311afb44ef2081ec21b57adf04087d6f08baa07a0
Instruction ID: 755a7d15cd163995efd0f048b6ef87916f3cae601d3eb5c640b5bea63b8f6f92
Opcode Fuzzy Hash: 2300a346019b11ec47d82bf311afb44ef2081ec21b57adf04087d6f08baa07a0
Instruction Fuzzy Hash: A2B1B330600284DFDB10DF69C585B9ABBF5BF04309F1484AEE8459B792E778EE44DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00453DA4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E8B

Strings

[rename], xrefs: 00453EEE, 00453F2A
MoveFileEx, xrefs: 0045409B
WININIT.INI, xrefs: 00453E39
NUL, xrefs: 00453F4D
.tmp, xrefs: 00453E47

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 9171f20be8f54d4adefb9c879b814aa5df87e36d38a4543021e51d4736811d77
Instruction ID: b3c584f0f22674ad0fcc633aedcec79f77295145a47899f9a0f541d7d967d7d4
Opcode Fuzzy Hash: 9171f20be8f54d4adefb9c879b814aa5df87e36d38a4543021e51d4736811d77
Instruction Fuzzy Hash: 9191F534E001099BDF11EFA5D881BDEB7F5EF4834AF508466E900B7292D7789E49CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00477510 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00477569
SetWindowLongW.USER32(00000000,000000FC,004774C4), ref: 00477590
GetACP.KERNEL32(00000000,004777A8,?,00000000,004777D2), ref: 004775CD
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00477613

Strings

Inno Setup: Language, xrefs: 0047769B
COMBOBOX, xrefs: 00477562

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: 5efcccae01d5344896dced53933ac2c5e65e0b4290dd7dce696ef102ce40803c
Instruction ID: 1a9eaad6f9bdb1b707daed62b6614fc76cadf7e066d6985a61d1a0c05164c82a
Opcode Fuzzy Hash: 5efcccae01d5344896dced53933ac2c5e65e0b4290dd7dce696ef102ce40803c
Instruction Fuzzy Hash: 05813C34A046059FC710EF69C885AEAB7F1FB09314F5584BBE808EB762D738AD41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408730 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408978,?,?,?,?,00000000,00000000,00000000,?,0040997F,00000000,00409992), ref: 0040874A

Part of subcall function 00408578: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049C4C0,00000001,?,00408643,?,00000000,00408722), ref: 00408596

Part of subcall function 004085C4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087C6,?,?,?,00000000,00408978), ref: 004085D7

Strings

mmmm d, yyyy, xrefs: 0040883B
AMPM, xrefs: 00408915
:mm:ss, xrefs: 00408946
:mm, xrefs: 0040892C
m/d/yy, xrefs: 00408819

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 70ae38f132fc3d3f9053d40cb900b3f5106e9b3c11c1bc8091f0af349ffabeb6
Instruction ID: 31fd29742738ad3ef4a1c8f63862b88eefe7a444323e1968e1f56601496a4ee9
Opcode Fuzzy Hash: 70ae38f132fc3d3f9053d40cb900b3f5106e9b3c11c1bc8091f0af349ffabeb6
Instruction Fuzzy Hash: 55512D74B001486BDB01FBA69D91AAE77A9DB94308F50D47FA181BB3C6CE3CDA05871D

Uniqueness

Uniqueness Score: -1.00%

Function 00411704 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411909), ref: 0041179C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041185A

Part of subcall function 00411ABC: CreatePopupMenu.USER32 ref: 00411AD6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118E6

Part of subcall function 00411ABC: CreateMenu.USER32 ref: 00411AE0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118CD

Strings

?, xrefs: 004117B6
,, xrefs: 004117AF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 3feee2cc82d10c26d4b86850a743ffc6a86feed31ad411745486a62538e9dbd1
Instruction ID: c427c9b06a4b8e224850f8fd68708263cabc4ba561a0b31d0e571b4226371ffb
Opcode Fuzzy Hash: 3feee2cc82d10c26d4b86850a743ffc6a86feed31ad411745486a62538e9dbd1
Instruction Fuzzy Hash: 0C511774A00144ABDB10EF7ADC816EA7BF9AF08304B1185BBF914E73A6D738D941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE73 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF38
GetObjectA.GDI32(?,00000018,?), ref: 0041BF47
GetBitmapBits.GDI32(?,?,?), ref: 0041BF98
GetBitmapBits.GDI32(?,?,?), ref: 0041BFA6
DeleteObject.GDI32(?), ref: 0041BFAF
DeleteObject.GDI32(?), ref: 0041BFB8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFD5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 5a427f00feddb577fff5167fa7821d20935eac0201827996bfcfefe2a8efdbf4
Instruction ID: 04b97f25464b58ff436fe1885c4dd039914ee627ffefe5dec802ec1f9d3f819a
Opcode Fuzzy Hash: 5a427f00feddb577fff5167fa7821d20935eac0201827996bfcfefe2a8efdbf4
Instruction Fuzzy Hash: 8A510571A006199FCB14DFA9C8819EEB7F9EF48314B11442AF914E7391D738AD81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041CEE8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CF0E
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF2D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF93
RealizePalette.GDI32(?), ref: 0041CFA2
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041D00C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D04A
SelectPalette.GDI32(?,?,00000001), ref: 0041D06F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: e3a85d6e6fa925448d6bed0422dd0faebb80c5c0618a65e8c1b968a445c90455
Instruction ID: 901e13b734fcfe26ab98e85b677eebf668a0bb257bdc2dc03c804f52c9ec24c8
Opcode Fuzzy Hash: e3a85d6e6fa925448d6bed0422dd0faebb80c5c0618a65e8c1b968a445c90455
Instruction Fuzzy Hash: 47514FB0600204AFDB14DFA9C995F9BBBF9EF08304F108599B549DB292C778ED81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00457384 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 004573D6

Part of subcall function 0042428C: GetWindowTextA.USER32(?,?,00000100), ref: 004242AC

Part of subcall function 0041EEB4: GetCurrentThreadId.KERNEL32 ref: 0041EF03
Part of subcall function 0041EEB4: EnumThreadWindows.USER32(00000000,0041EE64,00000000), ref: 0041EF09

Part of subcall function 004242D4: SetWindowTextA.USER32(?,00000000), ref: 004242EC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0045743D
TranslateMessage.USER32(?), ref: 0045745B
DispatchMessageA.USER32(?), ref: 00457464

Strings

[Paused] , xrefs: 0045740C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: eaaf3eacdaa0f7c25fcf10bced8ae6494e1aa27b09506b952884d30066b5af62
Instruction ID: dae39b44a8721021bfcf47da434b07c1a86f758a792d2d621748dfb7f1b1fb5a
Opcode Fuzzy Hash: eaaf3eacdaa0f7c25fcf10bced8ae6494e1aa27b09506b952884d30066b5af62
Instruction Fuzzy Hash: 47319531908248AEDB11DBB5EC41BDE7FB8DB4E314F558077E800E7292D67C9909CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046B8F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046BA33), ref: 0046B9B0
LoadCursorA.USER32(00000000,00007F02), ref: 0046B9BE
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046BA33), ref: 0046B9C4
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046BA33), ref: 0046B9CE
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046BA33), ref: 0046B9D4

Strings

CheckPassword, xrefs: 0046B958

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 53bc6e24384004d7d20bad586efa3d7e7ae41f931fedb1e33547852c92195869
Instruction ID: b0fbba28b703892adac32534ba020c2087de0be77d61b231d3663e0ec2163d2d
Opcode Fuzzy Hash: 53bc6e24384004d7d20bad586efa3d7e7ae41f931fedb1e33547852c92195869
Instruction Fuzzy Hash: 903186346443049FD711EB69C889F997BE0EF09304F558076B944EB3A2D778AE44CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0047852C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00478454: GetWindowThreadProcessId.USER32(00000000), ref: 0047845C
Part of subcall function 00478454: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478553,0049D0A8,00000000), ref: 0047846F
Part of subcall function 00478454: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00478475

SendMessageA.USER32(00000000,0000004A,00000000,004788E6), ref: 00478561
GetTickCount.KERNEL32 ref: 004785A6
GetTickCount.KERNEL32 ref: 004785B0
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00478605

Strings

CallSpawnServer: Unexpected response: $%x, xrefs: 00478596
CallSpawnServer: Unexpected status: %d, xrefs: 004785EE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: fc340e4e391d6b60fe91d1d42a673752c4f61929e8282ec956717a4768dfd9d7
Instruction ID: 8ac25aedf2878e4708fca6cf801c625a02ddfe4285d155efa4879fa8741ed09c
Opcode Fuzzy Hash: fc340e4e391d6b60fe91d1d42a673752c4f61929e8282ec956717a4768dfd9d7
Instruction Fuzzy Hash: BE31CA74F502159ADB10EBB9C98A7EE76A49F44314F50C03FB548EB382DA7C8D4187AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045982C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 004598E7

Strings

Fusion.dll, xrefs: 00459887
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 004598F2
Failed to load .NET Framework DLL "%s", xrefs: 004598CC
.NET Framework CreateAssemblyCache function failed, xrefs: 0045990A
CreateAssemblyCache, xrefs: 004598DE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: df3b1e785ea3c61b2fd69bd06c90e3551c2d252948530ff3bec70ac35fcb667a
Instruction ID: f91bc12d19f1fe408be280579c06801c7313a3191b14845461a6c76c6493a406
Opcode Fuzzy Hash: df3b1e785ea3c61b2fd69bd06c90e3551c2d252948530ff3bec70ac35fcb667a
Instruction Fuzzy Hash: B1318470E04659ABCB01EFA5C88169EB7A8AF44315F50857EE814A7382DB389E08C799

Uniqueness

Uniqueness Score: -1.00%

Function 0041C158 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C058: GetObjectA.GDI32(?,00000018), ref: 0041C065

GetFocus.USER32 ref: 0041C178
GetDC.USER32(?), ref: 0041C184
SelectPalette.GDI32(?,?,00000000), ref: 0041C1A5
RealizePalette.GDI32(?), ref: 0041C1B1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1C8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1F0
ReleaseDC.USER32(?,?), ref: 0041C1FD

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 7919d48a5b742b990554a8e16781250233d38a1b512c062c402771df9818cd79
Instruction ID: 8ccc34f866771a30a1661531480aea9d283d3c3e19187e20a9e7c35f18d949ed
Opcode Fuzzy Hash: 7919d48a5b742b990554a8e16781250233d38a1b512c062c402771df9818cd79
Instruction Fuzzy Hash: 45112C71A40609BBDB10DBE9DC85FAFB7FCEB48700F54446AB514E7281D67899408B68

Uniqueness

Uniqueness Score: -1.00%

Function 00418C64 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C80
GetSystemMetrics.USER32(0000000D), ref: 00418C88
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C8E

Part of subcall function 00410808: 6F54C400.COMCTL32(0049C628,000000FF,00000000,00418CBC,00000000,00418D18,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 0041080C

6F5BCB00.COMCTL32(0049C628,00000000,00000000,00000000,00000000,00418D18,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CDE
6F5BC740.COMCTL32(00000000,?,0049C628,00000000,00000000,00000000,00000000,00418D18,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CE9
6F5BCB00.COMCTL32(0049C628,00000001,?,?,00000000,?,0049C628,00000000,00000000,00000000,00000000,00418D18,?,00000000,0000000D,00000000), ref: 00418CFC
6F550860.COMCTL32(0049C628,00418D1F,?,00000000,?,0049C628,00000000,00000000,00000000,00000000,00418D18,?,00000000,0000000D,00000000,0000000E), ref: 00418D12

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID:
API String ID: 1828538299-0
Opcode ID: ea814aff01982a735542cfcaa5f2d759ebf4f13d0bc11ea9e85cdf93c4d7c833
Instruction ID: 86feed5bc36cb920ea04fcbc52f338b48e1a9a04039637533027038eb31c68aa
Opcode Fuzzy Hash: ea814aff01982a735542cfcaa5f2d759ebf4f13d0bc11ea9e85cdf93c4d7c833
Instruction Fuzzy Hash: 43114975B44304BBEB10FBA5DC83F9D73B9DB48704F6040A6B604EB2D1DAB99D808758

Uniqueness

Uniqueness Score: -1.00%

Function 004846D8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00484790), ref: 00484775

Strings

LanmanNT, xrefs: 0048473F
System\CurrentControlSet\Control\ProductOptions, xrefs: 004846FC
ServerNT, xrefs: 00484759
WinNT, xrefs: 00484725
ProductType, xrefs: 00484714

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 717c591504accb3829e297f759d520f8c36b6c7d883f62f5fad790650968ffa6
Instruction ID: f602dc80d04f3680fd9cb750b517dbdbebfefd8553d807f58cd6690a859f4bc2
Opcode Fuzzy Hash: 717c591504accb3829e297f759d520f8c36b6c7d883f62f5fad790650968ffa6
Instruction Fuzzy Hash: E0116038B14246AADB01FB65DC02B5E7BA9DB96344FA14877A800E7691E77CAD01C71C

Uniqueness

Uniqueness Score: -1.00%

Function 00496440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00496451

Part of subcall function 0041A1F8: CreateFontIndirectA.GDI32(?), ref: 0041A2B7

SelectObject.GDI32(00000000,00000000), ref: 00496473
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004969F1), ref: 00496487
GetTextMetricsA.GDI32(00000000,?), ref: 004964A9
ReleaseDC.USER32(00000000,00000000), ref: 004964C6

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0049647E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: dff2a21203ee93632802608d36be3e43c6f06f73005aac48825b6feceb9ff2d9
Instruction ID: 3eca50b986ff9571081ea2cdf1fb883588005d023d82deecb3e9906fb7477e11
Opcode Fuzzy Hash: dff2a21203ee93632802608d36be3e43c6f06f73005aac48825b6feceb9ff2d9
Instruction Fuzzy Hash: 3F018476A44608BFDB05DBE9CC51F5FB7ECDB49704F11047ABA04E7281D678AE008B28

Uniqueness

Uniqueness Score: -1.00%

Function 0041B472 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B480
SelectObject.GDI32(?,00000000), ref: 0041B48F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4BB
SelectObject.GDI32(00000000,00000000), ref: 0041B4C9
SelectObject.GDI32(?,00000000), ref: 0041B4D7
DeleteDC.GDI32(00000000), ref: 0041B4E0
DeleteDC.GDI32(?), ref: 0041B4E9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: ae96c6176d6eb3f3494de580be991e563f9897aa79c0ee3e7df45ff247fef712
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 89115C72F44619ABDB10DADDD886FEFB7BCEB08704F044455B614F7282C678AD418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004233A4 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233BF
WindowFromPoint.USER32(?,?), ref: 004233CC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233DA
GetCurrentThreadId.KERNEL32 ref: 004233E1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233FA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423411
SetCursor.USER32(00000000), ref: 00423423

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 0489214c39e5746bc568676ade8a3ee1219ea943f6d585d977b545401c7ee2ca
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: 2001D42230562036D6217B795C86E2F22A8CB85B65F50447FB645BB283D93D8C00537D

Uniqueness

Uniqueness Score: -1.00%

Function 00496264 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00496274
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00496281
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0049628E

Strings

GetMonitorInfoA, xrefs: 00496288
user32.dll, xrefs: 0049626F
MonitorFromRect, xrefs: 0049627B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: d74cd33f2a381ddd71989488f41813cefb8e8231c495ce4190ab50dbefdef179
Instruction ID: 0c88ecc74983827f1edc0c4b5bfff73c7f1ebae56de2e04e94b801c9b85359eb
Opcode Fuzzy Hash: d74cd33f2a381ddd71989488f41813cefb8e8231c495ce4190ab50dbefdef179
Instruction Fuzzy Hash: 29F0F656741A1527DA1033760C82B7B698CCB81770F0600B7BD44B7382ED6D8C0942AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D230 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D239
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D249
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D259

Strings

ArcFourCrypt, xrefs: 0045D253
ArcFourInit, xrefs: 0045D243
ISCryptGetVersion, xrefs: 0045D233

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: e7d405a4ff4eebbc0640f86d2c220ba04bd3b21cd5ce18d39a7322497cc2147d
Instruction ID: 61c9e43cd1f728e0e46d113f0b501511b53ff9056e95746757012e10b94b60ba
Opcode Fuzzy Hash: e7d405a4ff4eebbc0640f86d2c220ba04bd3b21cd5ce18d39a7322497cc2147d
Instruction Fuzzy Hash: 9EF01DF1D01700DAD314DF76AD457263796EBA831AF08807BB800D61A2D779884ADE1C

Uniqueness

Uniqueness Score: -1.00%

Function 0045D730 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D739
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D749
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D759

Strings

BZ2_bzDecompress, xrefs: 0045D743
BZ2_bzDecompressEnd, xrefs: 0045D753
BZ2_bzDecompressInit, xrefs: 0045D733

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 575c4cb06a2452c1401fa841c1313ffc0221effe76d11e7dd1aabe4620aafca8
Instruction ID: 6c96be05a1394ea18707f7eb6152f5503904c11dec58d168239e3d414ffdbae6
Opcode Fuzzy Hash: 575c4cb06a2452c1401fa841c1313ffc0221effe76d11e7dd1aabe4620aafca8
Instruction Fuzzy Hash: 6FF0D0B0D00600DFE724EF369C8672736D5ABA871EF54943BA9499526AD778084ECE1C

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA2C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,0049A934,00457299,0045763C,004571F0,00000000,00000B06,00000000,00000000,00000000,00000002,00000000,00481CF1), ref: 0042EA45
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA4B
InterlockedExchange.KERNEL32(0049C668,00000001), ref: 0042EA5C

Part of subcall function 0042E9BC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA80,00000004,0049A934,00457299,0045763C,004571F0,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042E9D2
Part of subcall function 0042E9BC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9D8
Part of subcall function 0042E9BC: InterlockedExchange.KERNEL32(0049C660,00000001), ref: 0042E9E9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,0049A934,00457299,0045763C,004571F0,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EA70

Strings

user32.dll, xrefs: 0042EA40
ChangeWindowMessageFilterEx, xrefs: 0042EA3B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 1a4120a275a7a58fb50942f7be9802eb4510f593f9b94c8c2bcf046027c2ff71
Instruction ID: ee3a30ffd41cbbfe6d6edcae89b7e54a60ed140ac131bcc27b6a733ad903a47d
Opcode Fuzzy Hash: 1a4120a275a7a58fb50942f7be9802eb4510f593f9b94c8c2bcf046027c2ff71
Instruction Fuzzy Hash: 7FE06DA1741620BAEA10B7B66CC6FAA2668AB18B19F50103BF100A51D1C2BD0C80CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0044C850 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F0FD), ref: 0044C85F
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C870
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C880

Strings

LresultFromObject, xrefs: 0044C86A
oleacc.dll, xrefs: 0044C85A
CreateStdAccessibleObject, xrefs: 0044C87A

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 09135f5945541ae78a6af7b678b7c17e974eae42bf5bb0e3fde62042262af164
Instruction ID: 3dac3c94951c3f326fc139052019a1d9618f5d358237ac6f028f958aa2bdce3c
Opcode Fuzzy Hash: 09135f5945541ae78a6af7b678b7c17e974eae42bf5bb0e3fde62042262af164
Instruction Fuzzy Hash: E6F01CB02823068BF750BBB1ECC5B263294E76570AF18117BA001A62E2D7BD4888CF1C

Uniqueness

Uniqueness Score: -1.00%

Function 004794E0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00499B5C), ref: 004794E6
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 004794F3
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00479503

Strings

VerSetConditionMask, xrefs: 004794ED
VerifyVersionInfoW, xrefs: 004794FD
kernel32.dll, xrefs: 004794E1

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 790c95ace78c420c32195d2ed9d9d2be34ce80da3b25f54a075d69f34dabb378
Instruction ID: 3b6a67bb969ba812fe328f8caa95c114719ec879005be68f43451eb0a9e022b1
Opcode Fuzzy Hash: 790c95ace78c420c32195d2ed9d9d2be34ce80da3b25f54a075d69f34dabb378
Instruction Fuzzy Hash: 23C012E1641710B9D601BB712CC397A265CD610B1CB20843B708975182E57C0C048F3C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B518 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B58E
GetDC.USER32(?), ref: 0041B59A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5B6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5D3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5EA
ReleaseDC.USER32(?,?), ref: 0041B636

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: 93cc6d3c32f59bb0d3866a424ed22eeeeb8d669c97e98ac0717914e792a0e722
Instruction ID: 54132ba296c0afcfcf6bcc6108250e3b4accff89e00e7de8f4d517709d1e9298
Opcode Fuzzy Hash: 93cc6d3c32f59bb0d3866a424ed22eeeeb8d669c97e98ac0717914e792a0e722
Instruction Fuzzy Hash: CF41D571A04258AFCB10DFA9C885A9FBBB4EF55704F1484AAF500EB351D3389D11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045D0F4 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D1C0,?,?,?,?,00000000), ref: 0045D15F
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D22C,?,00000000,0045D1C0,?,?,?,?,00000000), ref: 0045D19E

Strings

MACHINE, xrefs: 0045D142
CLASSES_ROOT, xrefs: 0045D124
USERS, xrefs: 0045D151
CURRENT_USER, xrefs: 0045D133

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: e5d6d334a763e1cbb8f1666fe6de59715d05f57489b5bab2b54e19ba110a4e8d
Instruction ID: 7b2924e434c2d2a6e8a64b45c898520acf8211660a530507fefc98e5318dd698
Opcode Fuzzy Hash: e5d6d334a763e1cbb8f1666fe6de59715d05f57489b5bab2b54e19ba110a4e8d
Instruction Fuzzy Hash: C911D535A04A04AFDB31DEA1C941A9E76ADDF44306F6040777C00A2783D63C9F0AD52E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD9C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDE5
GetSystemMetrics.USER32(0000000C), ref: 0041BDEF
GetDC.USER32(00000000), ref: 0041BDF9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE20
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE2D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE66

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: e7ae0f99dd269f353d7b7641ed485f387b8aeae4be2e5651bec5d04fa653b95a
Instruction ID: e886330f15f7a5316131e86c26d6fb078e3572472e198ea0fe97a07bc4f3c0b5
Opcode Fuzzy Hash: e7ae0f99dd269f353d7b7641ed485f387b8aeae4be2e5651bec5d04fa653b95a
Instruction Fuzzy Hash: 54212A74E04748AFEB00EFA9C942BEEB7B4EB48714F10842AF514B7781D7785940CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0047F0DC Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047F0EA
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046D21D), ref: 0047F110
GetWindowLongA.USER32(?,000000EC), ref: 0047F120
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047F141
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047F155
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047F171

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 933e41311fcf0812002e7eb394c818938080a6c97ffc0537f95c5dcd8f1b5975
Instruction ID: e5ac1ff8908a37ad257af9d7f60a07f48e2d288d1a2a96472df87265a41d0dff
Opcode Fuzzy Hash: 933e41311fcf0812002e7eb394c818938080a6c97ffc0537f95c5dcd8f1b5975
Instruction Fuzzy Hash: 5F0148B2651210ABD600DBA8CD91F2637E8AB0C330F094276B588EF3E3C228DC448B18

Uniqueness

Uniqueness Score: -1.00%

Function 0041B280 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6F0: CreateBrushIndirect.GDI32 ref: 0041A75B

UnrealizeObject.GDI32(00000000), ref: 0041B28C
SelectObject.GDI32(?,00000000), ref: 0041B29E
SetBkColor.GDI32(?,00000000), ref: 0041B2C1
SetBkMode.GDI32(?,00000002), ref: 0041B2CC
SetBkColor.GDI32(?,00000000), ref: 0041B2E7
SetBkMode.GDI32(?,00000001), ref: 0041B2F2

Part of subcall function 0041A068: GetSysColor.USER32(?), ref: 0041A072

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: f7789479bb42d6d63a82e92436423a6fea40f6b6a905c0023d8cad956bbacbbe
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: BAF072B56015019BDE00FFBAD9CAE4B77989F043097088457B944DF197C97DD8548B3D

Uniqueness

Uniqueness Score: -1.00%

Function 00472724 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,004728F5,?,00000000,?,0049D1E0,00000000,00472AE5,?,00000000,?,00000000,?,00472CB1), ref: 004728D1
FindClose.KERNEL32(000000FF,004728FC,004728F5,?,00000000,?,0049D1E0,00000000,00472AE5,?,00000000,?,00000000,?,00472CB1,?), ref: 004728EF
FindNextFileA.KERNEL32(000000FF,?,00000000,00472A17,?,00000000,?,0049D1E0,00000000,00472AE5,?,00000000,?,00000000,?,00472CB1), ref: 004729F3
FindClose.KERNEL32(000000FF,00472A1E,00472A17,?,00000000,?,0049D1E0,00000000,00472AE5,?,00000000,?,00000000,?,00472CB1,?), ref: 00472A11

Strings

X-G, xrefs: 00472AD7, 00472A3B, 00472A65, 00472A73, 00472AA5, 00472A52, 004727FD, 004728A0, 00472838, 0047284F, 0047285D, 00472814, 0047281D, 004728A3

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: X-G
API String ID: 2066263336-1434200262
Opcode ID: dee9adb0c3a20ba82cba519497d40b54772c13e25abc7b8872a8040dc39d1d48
Instruction ID: cd4a640429f490fd613ff5a6e63564d83fa6ed59639983758308e1e57ea4a430
Opcode Fuzzy Hash: dee9adb0c3a20ba82cba519497d40b54772c13e25abc7b8872a8040dc39d1d48
Instruction Fuzzy Hash: E3C14A3090424D9FCF11DFA9C981ADEBBB9BF48304F5081AAE808B3291D7799E46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00455780 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00455917,?,00000000,00455957), ref: 0045585D

Strings

PendingFileRenameOperations, xrefs: 004557FC
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004557E0
WININIT.INI, xrefs: 0045588C
PendingFileRenameOperations2, xrefs: 0045582C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 4ab85872d625d705c763a26b96fd488577af199a1a6c8585b0c768be72ee395e
Instruction ID: 0edf169a16dfa4fb7533b8b55fc7b889579560f25e46b257abcc71cf1b5dc2f9
Opcode Fuzzy Hash: 4ab85872d625d705c763a26b96fd488577af199a1a6c8585b0c768be72ee395e
Instruction Fuzzy Hash: AB519874E00608DBDB10EF62DC51AEEB7B9EF44315F50847BEC04A7292DB7CAA45CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00453930 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,Y}I,_iu,?,00000000,00453A6A), ref: 00453A1F
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,Y}I,_iu,?,00000000,00453A6A), ref: 00453A2F

Strings

.tmp, xrefs: 004539D3
Y}I, xrefs: 00453960, 0045396B, 004539C6, 004539D0, 004539A0, 004539AA
_iu, xrefs: 004539C1

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$Y}I$_iu
API String ID: 3498533004-3847898043
Opcode ID: 46e4244ac8577cde88a7cde4842e0d43aa75befccb9c2852c0b530efd0552fc6
Instruction ID: b5244aac63c968e20baa0947e479141d383441796118bbd3b2ad3f6bf7aa4b2b
Opcode Fuzzy Hash: 46e4244ac8577cde88a7cde4842e0d43aa75befccb9c2852c0b530efd0552fc6
Instruction Fuzzy Hash: 94319770E40149ABCB01EFA5C942B9EFBB5AF44349F60447AF840B72C2D7785F058A99

Uniqueness

Uniqueness Score: -1.00%

Function 00498C94 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242D4: SetWindowTextA.USER32(?,00000000), ref: 004242EC

ShowWindow.USER32(?,00000005,00000000,00498EF9,?,?,00000000), ref: 00498CCA

Part of subcall function 0042D8D4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8E7

Part of subcall function 004072B8: SetCurrentDirectoryA.KERNEL32(00000000,?,00498CF2,00000000,00498EC5,?,?,00000005,00000000,00498EF9,?,?,00000000), ref: 004072C3

Part of subcall function 0042D45C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4EA,?,?,?,00000001,?,00456126,00000000,0045618E), ref: 0042D491

Strings

IMsg, xrefs: 00498D9E
.msg, xrefs: 00498D30
Uninstall, xrefs: 00498CB0
.dat, xrefs: 00498D11

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: b00f9719c7e6af88468cf4ffd1f560606cf3e41e1807e00d90a1b17717318ad4
Instruction ID: f516de09ac91d61b1a3d7503e329b583f52153838448bbebd549f9627d85fab4
Opcode Fuzzy Hash: b00f9719c7e6af88468cf4ffd1f560606cf3e41e1807e00d90a1b17717318ad4
Instruction Fuzzy Hash: C5315234A10114AFCB00EF69DC529AEBBB5EB59318F51847AF800A7796DB38AD00CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042EAB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EAEA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAF0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB19

Strings

ShutdownBlockReasonCreate, xrefs: 0042EAE0
user32.dll, xrefs: 0042EAE5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: d7b5e8f06d25cf2e82843ddd2a686aee5f6cfebd975f7e169ae89c51933d11b0
Instruction ID: 8013201a01c1a3ce4b1282a4ea415291a3823007c30eea77c81bb12cf145ddb4
Opcode Fuzzy Hash: d7b5e8f06d25cf2e82843ddd2a686aee5f6cfebd975f7e169ae89c51933d11b0
Instruction Fuzzy Hash: 34F0C8D174066137E620A57F9C83F6B598C8F94759F140436F109E62C1D96C9905426E

Uniqueness

Uniqueness Score: -1.00%

Function 004580A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 004580D0
GetExitCodeProcess.KERNEL32(?,?), ref: 004580F1
CloseHandle.KERNEL32(?,00458124), ref: 00458117

Strings

MsgWaitForMultipleObjects, xrefs: 004580DD
GetExitCodeProcess, xrefs: 004580FA

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 373b8985a00968747dfe2970a2e28db8777affb583760887119259ad1a14c0ef
Instruction ID: eff4a35bea7a62289d80d9c26220f44f895e3d9a2531d43f7f7dfd5bd268873c
Opcode Fuzzy Hash: 373b8985a00968747dfe2970a2e28db8777affb583760887119259ad1a14c0ef
Instruction Fuzzy Hash: C401A230600604AFDB10EBA98C42E2E73A8EB49755F10457ABC10E73C3EE389D059B18

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE60
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFFB,00000000,0042E013,?,?,?,?,00000006,?,00000000,00498795), ref: 0042DE7B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE81

Strings

advapi32.dll, xrefs: 0042DE76
RegDeleteKeyExA, xrefs: 0042DE71

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 780e4264db312733bee64b8429de1b59d21d94b92bca9a45197840037c94c444
Instruction ID: 9cada17f2adbafa0ebcb77ec43832f820b82eaaa71c9ca0bcc52793b6cf27115
Opcode Fuzzy Hash: 780e4264db312733bee64b8429de1b59d21d94b92bca9a45197840037c94c444
Instruction Fuzzy Hash: EFE065B1B40A70BAD62036657C89B972718DB79325F615537F105A91D182BC1C40CE9C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA80,00000004,0049A934,00457299,0045763C,004571F0,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042E9D2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9D8
InterlockedExchange.KERNEL32(0049C660,00000001), ref: 0042E9E9

Strings

user32.dll, xrefs: 0042E9CD
ChangeWindowMessageFilter, xrefs: 0042E9C8

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 29e3fe99fd39411a87420eaca3bfaa87a3f8c8d91b56c7102c175830130eccb1
Instruction ID: c49eaaa8fdb071360f38502b50e3c23bad510ecb3814e64996c12b789333cacc
Opcode Fuzzy Hash: 29e3fe99fd39411a87420eaca3bfaa87a3f8c8d91b56c7102c175830130eccb1
Instruction Fuzzy Hash: 78E0ECB1740314AAEA10AB62AECBF662558AB24F19F902437F101B51E2C7FC0C84C92D

Uniqueness

Uniqueness Score: -1.00%

Function 00478454 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 0047845C
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478553,0049D0A8,00000000), ref: 0047846F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00478475

Strings

user32.dll, xrefs: 0047846A
AllowSetForegroundWindow, xrefs: 00478465

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: cbf365943261f0679605978759bd366b21101b5e37d07551be4b7e442413f57c
Instruction ID: e02e6a441617b08407c98d3f2d52d56d05f822297dcea8981d648c2ccb6a4c89
Opcode Fuzzy Hash: cbf365943261f0679605978759bd366b21101b5e37d07551be4b7e442413f57c
Instruction Fuzzy Hash: E6D0A7B028030369D950B3B14D0EE9F224C8D4071CF18C53F7408E2187EEBCD800453D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C62
SaveDC.GDI32(?), ref: 00416C93
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D55), ref: 00416CF4
RestoreDC.GDI32(?,?), ref: 00416D1B
EndPaint.USER32(00000000,?,00416D5C,00000000,00416D55), ref: 00416D4F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: 6e943c95b49c6f236292f7e3f4c968b2c26fc47392d5a45f7d0b8c39400a8a14
Instruction ID: fd6e93c78d11005d9ba704e8aa7896ba8bfa997e2438936ed7ae042a7726967b
Opcode Fuzzy Hash: 6e943c95b49c6f236292f7e3f4c968b2c26fc47392d5a45f7d0b8c39400a8a14
Instruction Fuzzy Hash: 67411C70A04204AFDB04DB99D985FAAB7F9FF48304F1680AEE4059B362D778ED45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414810 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414846
MulDiv.KERNEL32(?,?,?), ref: 00414860
MulDiv.KERNEL32(?,?,?), ref: 00414889
MulDiv.KERNEL32(?,?,?), ref: 004148B4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148FC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26890b3473d1de9ad500ea3210d514958385b88118080daeb4b5d2349ec22244
Instruction ID: fc599d946787c0506e623d191f8eefd10b4a308858d20a9272ac2d3790a9447e
Opcode Fuzzy Hash: 26890b3473d1de9ad500ea3210d514958385b88118080daeb4b5d2349ec22244
Instruction Fuzzy Hash: A1314F746047449FC320EF69C984BABB7E8AF89314F04891EF9D9C3752C638EC858B19

Uniqueness

Uniqueness Score: -1.00%

Function 004297DC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429818
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429847
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429863
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042988E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 004298AC

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 37c779b953a04f4a12efe840b5dae96d6b1eda754ba999e5db1c97090b84cbca
Instruction ID: 3a43d17cedf841754d2741ff269161da15bdaac6ac028e7563c87cbc4d8d060b
Opcode Fuzzy Hash: 37c779b953a04f4a12efe840b5dae96d6b1eda754ba999e5db1c97090b84cbca
Instruction Fuzzy Hash: 87219D707507057AE710BB66CC82F5B76ECEB41708F94043EB541AB2D2DF78AD41861C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBC8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBDA
GetSystemMetrics.USER32(0000000C), ref: 0041BBE4
GetDC.USER32(00000000), ref: 0041BC22
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC69
DeleteObject.GDI32(00000000), ref: 0041BCAA

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: 6e5f92cac6927d4c8622965cf5499bf0577c4e8cc05c04df1912703be0f6a612
Instruction ID: c69e797babd58ff3ff02391fbdd927ad6b6ed61c45feb1cc22c7e7fbd0aaf132
Opcode Fuzzy Hash: 6e5f92cac6927d4c8622965cf5499bf0577c4e8cc05c04df1912703be0f6a612
Instruction Fuzzy Hash: BA314F74E00209EFDB04DFA5CA41AAEB7F5EB48700F1185AAF514AB381D7789E40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00473DE8 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045D0F4: SetLastError.KERNEL32(00000057,00000000,0045D1C0,?,?,?,?,00000000), ref: 0045D15F

GetLastError.KERNEL32(00000000,00000000,00000000,00473EBC,?,?,0049D1E0,00000000), ref: 00473E75
GetLastError.KERNEL32(00000000,00000000,00000000,00473EBC,?,?,0049D1E0,00000000), ref: 00473E8B

Strings

Setting permissions on registry key: %s\%s, xrefs: 00473E3A
Could not set permissions on the registry key because it currently does not exist., xrefs: 00473E7F
Failed to set permissions on registry key (%d)., xrefs: 00473E9C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 94c2da530f363ea8cb10a45bf575f0ecc91452573c23b1ca1c6cf29e3b5eec62
Instruction ID: 0d7adc10544a197a02520927edcbcff0914f872bc29503f5b23eff97567118d7
Opcode Fuzzy Hash: 94c2da530f363ea8cb10a45bf575f0ecc91452573c23b1ca1c6cf29e3b5eec62
Instruction Fuzzy Hash: E3218670A042449FCB11DFA9D8416EEBBE8DF49315F50817AF408E7392D7785E05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 353a0757e9fd9d11b623670cfd803f5b8829311614747a855f6672fd601e9639
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: 353a0757e9fd9d11b623670cfd803f5b8829311614747a855f6672fd601e9639
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 004143F0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414429
RealizePalette.GDI32(00000000), ref: 00414431
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414445
RealizePalette.GDI32(00000000), ref: 0041444B
ReleaseDC.USER32(00000000,00000000), ref: 00414456

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c27572ba3b318a97157e2ff630850643e717ce291e632f808275401916b3f835
Instruction ID: 45e707893e7549553209a356c9d37de8c9d5e61d21803148832d8e75357fff83
Opcode Fuzzy Hash: c27572ba3b318a97157e2ff630850643e717ce291e632f808275401916b3f835
Instruction Fuzzy Hash: 6B01D47120C3806AD600A63D8C85A9F6BEC8FC6318F05946EF584DB3C2C979C8008761

Uniqueness

Uniqueness Score: -1.00%

Function 00406FB4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407013
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040708D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070E5

Strings

Z, xrefs: 0040704C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 33049c7ea11c30121095e337e56ababc2e5377dae656412ba48cd4e8f0b87484
Instruction ID: bcee853a6b72702f38c87c8f124e100014cbe8ba86cd5f63ed9636da07a90c42
Opcode Fuzzy Hash: 33049c7ea11c30121095e337e56ababc2e5377dae656412ba48cd4e8f0b87484
Instruction Fuzzy Hash: 1C515170E042089FDB15DF65C941A9EBBB9EF09304F1081BAE900BB3D1D778AE458F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044D034 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D0C2
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D0ED
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D175

Strings

, xrefs: 0044D0A7

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: c3ae53c4a2e846ab02f28d0fc033a1d4be040ce8e43b64eae078083a2cc8af42
Instruction ID: 523be4b6c2791812100f8c37f9dfaf26ef338fc18bb75760613781b343a57c3a
Opcode Fuzzy Hash: c3ae53c4a2e846ab02f28d0fc033a1d4be040ce8e43b64eae078083a2cc8af42
Instruction Fuzzy Hash: 5E516170E00248AFEB11DFA9C885BDEBBF9BF49304F14447AE845EB252D7789944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042EFD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EFFE

Part of subcall function 0041A1F8: CreateFontIndirectA.GDI32(?), ref: 0041A2B7

SelectObject.GDI32(?,00000000), ref: 0042F021
ReleaseDC.USER32(00000000,?), ref: 0042F100

Strings

...\, xrefs: 0042F0B2

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 25ffee15cdc5cb18a02803ef1f816046bfa874a41c62f3eaa1894f17d6898431
Instruction ID: fc9511131d6b73f8b5d25d5b58e31b0db863437dcfa52910c3569242d90b8927
Opcode Fuzzy Hash: 25ffee15cdc5cb18a02803ef1f816046bfa874a41c62f3eaa1894f17d6898431
Instruction Fuzzy Hash: C6316370B00128ABDB11DF96D841BAEB7F8EB48704FD1447BF410A7292D7785E45CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00416420 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041648F
UnregisterClassA.USER32(?,00400000), ref: 004164BB
RegisterClassA.USER32(?), ref: 004164DE

Strings

@, xrefs: 00416439

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: c765a7a02a883bbcb8cbce831275752241e88c1fc2a09794a8b9031458939db0
Instruction ID: 0582e4decd83047b7d259989b1a1a5a7d11b83513a4c29c925389085b8c31041
Opcode Fuzzy Hash: c765a7a02a883bbcb8cbce831275752241e88c1fc2a09794a8b9031458939db0
Instruction Fuzzy Hash: 9E316F706042409BD720EF68C881B9B77E5AB85308F04457FF989DB396DB39D984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00499148 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00499A98,00000000,0049923E,?,?,00000000,0049C628), ref: 004991B8
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00499A98,00000000,0049923E,?,?,00000000,0049C628), ref: 004991E1
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004991FA

Strings

isRS-%.3u.tmp, xrefs: 00499197

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: bfd86a2674427d81e3176373aba7b95af41ee7ec3bd42d580852b7a15f379e04
Instruction ID: 3d7b7621ff81b7b48df1da933e8af7fef605e6404db8275854254d5ff1fd37eb
Opcode Fuzzy Hash: bfd86a2674427d81e3176373aba7b95af41ee7ec3bd42d580852b7a15f379e04
Instruction Fuzzy Hash: A8217570D04209AFDF14EFA9C8819AFBBB8EF54314F50457EB814B72D1D6385E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 00456CA4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C814: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C838

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456CF8
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456D25

Strings

RegisterTypeLib, xrefs: 00456D30
LoadTypeLib, xrefs: 00456D03

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: f0fa4eb5ebe45c922c3dc586aac30000597ac91e8294356b8a9e27c423337520
Instruction ID: e26b8d5a5ba7491cefd4e72126217f2167f7f2a36d46249135fbb0ec9729d1e1
Opcode Fuzzy Hash: f0fa4eb5ebe45c922c3dc586aac30000597ac91e8294356b8a9e27c423337520
Instruction Fuzzy Hash: 55119670B00608BFDB11EFA6CD51A5EB7FDEB89705B518876F804D3652DA3C9D18CA24

Uniqueness

Uniqueness Score: -1.00%

Function 004571FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00457216
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 004572B3

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00457242
Failed to create DebugClientWnd, xrefs: 0045727C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 91144030c22feb2f099457278136b1417cedab6b1ce125d938223cf61fb03c35
Instruction ID: 5506c06a8221756307c809245476df56b82a3d734b0b2cc8939648723d1678e2
Opcode Fuzzy Hash: 91144030c22feb2f099457278136b1417cedab6b1ce125d938223cf61fb03c35
Instruction Fuzzy Hash: 4A1123706082406BD710AB689C81B5F7B989B59319F04447BF984DF383D7788849CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004972D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004973A0,?,00497394,00000000,0049737B), ref: 00497346
CloseHandle.KERNEL32(sI,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004973A0,?,00497394,00000000), ref: 0049735D

Part of subcall function 00497230: GetLastError.KERNEL32(00000000,004972C8,?,?,?,?), ref: 00497254

Strings

sI, xrefs: 00497359, 0049735C
h}I, xrefs: 00497311, 00497320

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: h}I$sI
API String ID: 3798668922-1380480089
Opcode ID: cc884431f4e1efd51327e20565ab1bb9f08f08f55406f6e75652e7316fb3a40c
Instruction ID: c8ef93ad5936ec93d47169323e1fbd3938ce5e4356788b6d28a55b934fb5f781
Opcode Fuzzy Hash: cc884431f4e1efd51327e20565ab1bb9f08f08f55406f6e75652e7316fb3a40c
Instruction Fuzzy Hash: C601A1B0618248AFDB10DBE2CC82F9F7BACDF48704F51007AB904E7281E6385E01D628

Uniqueness

Uniqueness Score: -1.00%

Function 00478FAC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242D4: SetWindowTextA.USER32(?,00000000), ref: 004242EC

GetFocus.USER32 ref: 00479017
GetKeyState.USER32(0000007A), ref: 00479029
WaitMessage.USER32(?,00000000,00479050,?,00000000,00479077,?,?,00000001,00000000,?,?,00480DCF,00000000,00481CF1), ref: 00479033

Strings

Wnd=$%x, xrefs: 00478FFB

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: dde9f3b5e241e88b55d30c7f4a7bb3d72be61a5b55810371ca51b69295f1abc8
Instruction ID: eba5f29414d36f6e74fb426b45439cb9067feebd7b9c7b0d5244711cfb972ec4
Opcode Fuzzy Hash: dde9f3b5e241e88b55d30c7f4a7bb3d72be61a5b55810371ca51b69295f1abc8
Instruction Fuzzy Hash: 8811A370610284AFCB11EF65DC46ADE77B8EB09314F5184BAF408E7681D7386E00DA69

Uniqueness

Uniqueness Score: -1.00%

Function 0046EBDC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046EBE4
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046EBF3

Strings

(invalid), xrefs: 0046EC76
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046EC68

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: e9aa8717e3b9622a35d6e0d9c94418729db1d8771c5a6e9b56768ac536189957
Instruction ID: c6e1e0e163734dab756301fd1d53d50b0cd20160abcdc9dd336ee1d0beb0d19d
Opcode Fuzzy Hash: e9aa8717e3b9622a35d6e0d9c94418729db1d8771c5a6e9b56768ac536189957
Instruction Fuzzy Hash: 5D1106A440C3909ED340DF2AC44472FBAE4AB89708F04496EF9C8D6381E779C948DBB7

Uniqueness

Uniqueness Score: -1.00%

Function 00453FEA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453FF7

Part of subcall function 00406F60: DeleteFileA.KERNEL32(00000000,0049C628,00499629,00000000,0049967E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F6B

MoveFileA.KERNEL32(00000000,00000000), ref: 0045401C

Part of subcall function 00453510: GetLastError.KERNEL32(00000000,004540A5,00000005,00000000,004540DA,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004992DD,00000000), ref: 00453513

Strings

MoveFile, xrefs: 00454025
DeleteFile, xrefs: 00454008

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 97295a17013aa4b3dc77a2a09839e3fc1e8ae573cf139192e5a902501439da58
Instruction ID: 5b319f4d86c429aaf34c497ec622aa84374fa007c64af5b461aa928f93ad298c
Opcode Fuzzy Hash: 97295a17013aa4b3dc77a2a09839e3fc1e8ae573cf139192e5a902501439da58
Instruction Fuzzy Hash: 42F036742041055BEB00FBB6D95266E67ECEB8470EF60443BF900BB6C3EA3D9E49492D

Uniqueness

Uniqueness Score: -1.00%

Function 00484630 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00484671
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00484694

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0048463E
CSDVersion, xrefs: 00484668

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 9d3a22ecba2f3a79b3c0b564ba1b97159dc83f3560e976227a53668e6b7b4399
Instruction ID: 8436c0b1a309cfdc218d64686ecfcab6bb7f3f7d10cb48757ea4b44d3f142d23
Opcode Fuzzy Hash: 9d3a22ecba2f3a79b3c0b564ba1b97159dc83f3560e976227a53668e6b7b4399
Instruction Fuzzy Hash: A9F08175E0020AEADF11EAE09C45B9F73BC9B45304F104967E910F7280F67CAA448B59

Uniqueness

Uniqueness Score: -1.00%

Function 0045940C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459549,00000000,00459701,?,00000000,00000000,00000000), ref: 00459459

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 0045942C
.NET Framework not found, xrefs: 00459468
InstallRoot, xrefs: 00459448

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: aa95fedafbf507fd0b112374eddf82c4da77457730ac29b69e76b3e74460bd70
Instruction ID: da45e090e08c2af83dc97eff45d409e8c8a7a5d294f3c067393b5131bf5ff8bf
Opcode Fuzzy Hash: aa95fedafbf507fd0b112374eddf82c4da77457730ac29b69e76b3e74460bd70
Instruction Fuzzy Hash: F2F0AF31B04110ABC710AB1AD845B6E6398DBD235AF50803BF985DB253EA7CCC0B8769

Uniqueness

Uniqueness Score: -1.00%

Function 0042D900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453BCE,00000000,00453C71,?,?,00000000,00000000,00000000,00000000,00000000,?,00454061,00000000), ref: 0042D91A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D920

Strings

kernel32.dll, xrefs: 0042D915
GetSystemWow64DirectoryA, xrefs: 0042D910

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 668015d286dac6ed483b16a742b0e62700dc4db53c3f9f7b812670d1427f7fe3
Instruction ID: c73f6de4eb886e968b085a6e7c7cc63e3b6fdbea6d7e209729b619e098e19142
Opcode Fuzzy Hash: 668015d286dac6ed483b16a742b0e62700dc4db53c3f9f7b812670d1427f7fe3
Instruction Fuzzy Hash: F9E04FE1B40B5113E710667A5C8276B158E4B84728F90443B3994E52C7DDBCD9C8566D

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAE0), ref: 0042EB72
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB78

Strings

user32.dll, xrefs: 0042EB6D
ShutdownBlockReasonDestroy, xrefs: 0042EB68

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: bee4edb2c449a5dfd1c01cdfe9b6f7374d179aa79d7f6a8ce8d951f478ed0695
Instruction ID: d308361a71a1e4dc0c71eda52d15a5d5ca57c7b6b7e2bde91db1678b7815b427
Opcode Fuzzy Hash: bee4edb2c449a5dfd1c01cdfe9b6f7374d179aa79d7f6a8ce8d951f478ed0695
Instruction Fuzzy Hash: 8DD0A792301732626900F1F73CC1DBB0A8C89102793540077F601E1241D54DDC01156C

Uniqueness

Uniqueness Score: -1.00%

Function 0044F7B8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00499B2A), ref: 0044F7F3
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F7F9

Strings

user32.dll, xrefs: 0044F7EE
NotifyWinEvent, xrefs: 0044F7E9

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: c3786242a14ca03a62e3406b7bd0f53fb28c80e98e7c47f23881a3d4f16b908f
Instruction ID: b1e2d04df43b1f620e0cf6c091983f233af54cc0e24e64f5668f936ad46d7efe
Opcode Fuzzy Hash: c3786242a14ca03a62e3406b7bd0f53fb28c80e98e7c47f23881a3d4f16b908f
Instruction Fuzzy Hash: 6BE012F0A417469EEB00BBF5998671A3AA0E75431CF51007BB1006A192CB7C44184F6E

Uniqueness

Uniqueness Score: -1.00%

Function 004998A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00499B80,00000001,00000000,00499BA4), ref: 004998AA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004998B0

Strings

DisableProcessWindowsGhosting, xrefs: 004998A0
user32.dll, xrefs: 004998A5

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 63b5e066d383ed61718fdf827d50471752a7eb8038db74cdb4ba8809ce302950
Instruction ID: 0f14f4e571f6949463ed43cecf20ccb7b04f507d8b1b0954bb347e2d233844ff
Opcode Fuzzy Hash: 63b5e066d383ed61718fdf827d50471752a7eb8038db74cdb4ba8809ce302950
Instruction Fuzzy Hash: 50B0929026061158AC00B2BA0C0AA1B0C084842718B1C003F7800B00CADE6D8C04093D

Uniqueness

Uniqueness Score: -1.00%

Function 00464A94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B6CC: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F7E9,00499B2A), ref: 0044B6F3
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B70B
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B71D
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B72F
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B741
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B753
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B765
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B777
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B789
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B79B
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B7AD
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B7BF
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B7D1
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B7E3
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B7F5
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B807
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B819
Part of subcall function 0044B6CC: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B82B

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00499B52), ref: 00464AA3
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464AA9

Strings

SHPathPrepareForWriteA, xrefs: 00464A99
shell32.dll, xrefs: 00464A9E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 9c4a4225a90741cfc16d17dfca6301cc39abb786b2dac48e1dbadd076d338437
Instruction ID: dc4b450cfd92a0b7db9b84c459fdd5450c712a56b94bf485ef513bb3c2930083
Opcode Fuzzy Hash: 9c4a4225a90741cfc16d17dfca6301cc39abb786b2dac48e1dbadd076d338437
Instruction Fuzzy Hash: EDB092E0AC1A01748900B7F2580790F289489D0B1CB18013B704076097EA7C8400095E

Uniqueness

Uniqueness Score: -1.00%

Function 0047E000 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047E174,?,?,?,?,00000000,0047E2C9,?,?,?,00000000,?,0047E3D8), ref: 0047E150
FindClose.KERNEL32(000000FF,0047E17B,0047E174,?,?,?,?,00000000,0047E2C9,?,?,?,00000000,?,0047E3D8,00000000), ref: 0047E16E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: a267eea9ea4579cdc7aebb45299537a734fbbbdc31bd4e909ee7e9a173ea0dd1
Instruction ID: 50664e790a12338b5234b12f063618686a51dfbd8a4ac76ef579719da18d1fda
Opcode Fuzzy Hash: a267eea9ea4579cdc7aebb45299537a734fbbbdc31bd4e909ee7e9a173ea0dd1
Instruction Fuzzy Hash: 1F815E3090424DAFCF11DFA6C841ADFBBB9EF4D304F5081EAE908A7291D6399A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00480688 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,00480881,?,00000000,00000000,?,?,00481B6B,?,?,00000000), ref: 0048072E
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,00480881,?,00000000,00000000,?,?,00481B6B,?,?), ref: 0048073B
FindNextFileA.KERNEL32(000000FF,?,00000000,00480854,?,?,?,?,00000000,00480881,?,00000000,00000000,?,?,00481B6B), ref: 00480830
FindClose.KERNEL32(000000FF,0048085B,00480854,?,?,?,?,00000000,00480881,?,00000000,00000000,?,?,00481B6B,?), ref: 0048084E

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 864a24a504f5750b0ab9bf826ad491323b7eccbd799a5356892cf633257529b2
Instruction ID: 73a51b669209aeb9f3281886077c076ffedbeac35c280293325844911f4e96d3
Opcode Fuzzy Hash: 864a24a504f5750b0ab9bf826ad491323b7eccbd799a5356892cf633257529b2
Instruction Fuzzy Hash: 6D514C75A00648EFCB61EF65CC45ADEB7B8EF88315F1045AAA808A7341D6389E89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00475DBC Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE90: GetTickCount.KERNEL32 ref: 0042EE96

Part of subcall function 0042EC98: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECCD

GetLastError.KERNEL32(00000000,00475F31,?,?,0049D1E0,00000000), ref: 00475E1A

Strings

, xrefs: 00475E52, 00475E6D
MoveFileEx, xrefs: 00475E7F
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00475EEF

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: 97fab293178d2c5f454746cbba82b8ef0494885ddecd1bc80e0d1c5bbcc43420
Instruction ID: 01bfb7ad0d94c0cadac6f2ec7ce53bce460c21e7d1773dca6cd103d18b9d4c13
Opcode Fuzzy Hash: 97fab293178d2c5f454746cbba82b8ef0494885ddecd1bc80e0d1c5bbcc43420
Instruction Fuzzy Hash: 75419770A006098BDB10EFA5D886AEE77B5EF48314F50853BE414BB391D7789A058BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00413D08 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D56
GetDesktopWindow.USER32 ref: 00413E0E

Part of subcall function 00418ED0: 6F5BC6F0.COMCTL32(?,00000000,00413FD3,00000000,004140E3,?,?,0049C628), ref: 00418EEC
Part of subcall function 00418ED0: ShowCursor.USER32(00000001,?,00000000,00413FD3,00000000,004140E3,?,?,0049C628), ref: 00418F09

SetCursor.USER32(00000000,?,?,?,?,00413B03,00000000,00413B16), ref: 00413E4C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: c82077e875ceebfb446ca8bdba497cc44f2f016adda31143cf8d95e20cbb1c8e
Instruction ID: a5e00dcc6fd9115ed5a77459d70fea990a5215d510f46849e0ce2877443e0a13
Opcode Fuzzy Hash: c82077e875ceebfb446ca8bdba497cc44f2f016adda31143cf8d95e20cbb1c8e
Instruction Fuzzy Hash: CA413771600260EFC714EF29E9C4B9677E1AB69325F16807BE404DB366DA38BD81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00408A64 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A85
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AF4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B8F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BCE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 2478aacc1cc0604c87cef9c23ce28a73e3b8baee1560f3a98c189eb7686d3011
Instruction ID: c07fd310ac7ce6f4f6bdd3d287b746ce8d52192ab59c667046e5b60d4d48b312
Opcode Fuzzy Hash: 2478aacc1cc0604c87cef9c23ce28a73e3b8baee1560f3a98c189eb7686d3011
Instruction Fuzzy Hash: 0E3134716083849BD730EB65C945BDBB7E8AB85704F40483FB6C8DB2D1EB7859048B6B

Uniqueness

Uniqueness Score: -1.00%

Function 0044E938 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E981

Part of subcall function 0044CFC4: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CFF6

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044EA05

Part of subcall function 0042BBC4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBD8

IsRectEmpty.USER32(?), ref: 0044E9C7
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E9EA

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 46eae8e9de5ea3c9000d03e8e36def8cc44527ed889a735a265eecffd6d2accb
Instruction ID: 77b7b7799a66ce86f667cf0b036ff1ab111c9581c09ca9d8f795578908ad38d2
Opcode Fuzzy Hash: 46eae8e9de5ea3c9000d03e8e36def8cc44527ed889a735a265eecffd6d2accb
Instruction Fuzzy Hash: 36118C72B0034027E610BA3E8C86B5B66C99B88708F14083FB605EB3C7DE7CDC094399

Uniqueness

Uniqueness Score: -1.00%

Function 0049685C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 004968C0
OffsetRect.USER32(?,00000000,?), ref: 004968DB
OffsetRect.USER32(?,?,00000000), ref: 004968F5
OffsetRect.USER32(?,00000000,?), ref: 00496910

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 5555108a7d625db51293286a0ce7fa3eb04b01450ceee0d6f7523951ca0f43f5
Instruction ID: 7aa92b87493bba554a99766a1615b89fa8334574b81c4b109563ad0fb2dae8ca
Opcode Fuzzy Hash: 5555108a7d625db51293286a0ce7fa3eb04b01450ceee0d6f7523951ca0f43f5
Instruction Fuzzy Hash: 08217CB6700201ABCB00DE69CC85E5BB7EEEBC4344F15CA3AF544C724AD638E9048796

Uniqueness

Uniqueness Score: -1.00%

Function 00496514 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 00496529
MulDiv.KERNEL32(50142444,00000008,?), ref: 0049653D
MulDiv.KERNEL32(F6F00FE8,00000008,?), ref: 00496551
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 0049656F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: 847755547a92c4f112a6b26d02117c362750007f742ecc980331f7332c8834be
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: B711EF72604204BBCB40DEA9D8C4D9B7BECEF49374B15416AF918DB246D674ED408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F490 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F480,?), ref: 0041F4B1
UnregisterClassA.USER32(0041F480,00400000), ref: 0041F4DA
RegisterClassA.USER32(0049A598), ref: 0041F4E4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F51F

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 46111e49518ace76b25441b5b8420e7e5a88ee32249e97549851b52d686e3228
Instruction ID: bc278c4f6faf11cefbb7876bdabff60d814ef9460a0beef0b041e337848a6ca8
Opcode Fuzzy Hash: 46111e49518ace76b25441b5b8420e7e5a88ee32249e97549851b52d686e3228
Instruction Fuzzy Hash: BB014071300104BBCB10EBA9ED81E9B779C9719314F51423BB505E72E2D6399C158BBD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D037
LoadResource.KERNEL32(00400000,72756F73,0040A7D8,00400000,00000001,00000000,?,0040CF94,00000000,?,00000000,?,?,0047D4DC,0000000A,00000000), ref: 0040D051
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7D8,00400000,00000001,00000000,?,0040CF94,00000000,?,00000000,?,?,0047D4DC), ref: 0040D06B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7D8,00400000,00000001,00000000,?,0040CF94,00000000,?,00000000,?), ref: 0040D075

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: 36a118f2821a5a72c918f59cdb85223c1d13502428e6f53becfecf356bbc3684
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: ECF062B36055046F9B04EFADA881D5B77DCDE88364310017FF908E7282DA39DD118B78

Uniqueness

Uniqueness Score: -1.00%

Function 004703C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 00470411

Strings

Setting NTFS compression on directory: %s, xrefs: 004703DF
Unsetting NTFS compression on directory: %s, xrefs: 004703F7
Failed to set NTFS compression state (%d)., xrefs: 00470422

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 620cf543d87485af6a9e4a41696411bfbf2f83edd75fa76625a5ddf8275c3c05
Instruction ID: 3ad91d961f727c5da6fb7b7b963695631e89d260689480273bd4935e6f10c610
Opcode Fuzzy Hash: 620cf543d87485af6a9e4a41696411bfbf2f83edd75fa76625a5ddf8275c3c05
Instruction Fuzzy Hash: 25016731E0D248A6CB04D7AD60412DDBFA89F49314F44C1EFE559E7382DB790909879A

Uniqueness

Uniqueness Score: -1.00%

Function 00470B6C Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 00470BBD

Strings

Setting NTFS compression on file: %s, xrefs: 00470B8B
Unsetting NTFS compression on file: %s, xrefs: 00470BA3
Failed to set NTFS compression state (%d)., xrefs: 00470BCE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: dcf028af307f37bc600256f608f6abbf6f460cc5b665037416d0acbd82129501
Instruction ID: c3829467bfceef7118d39fb7c8e257a548c3570dc26a5c71b24f226aab98a3ed
Opcode Fuzzy Hash: dcf028af307f37bc600256f608f6abbf6f460cc5b665037416d0acbd82129501
Instruction Fuzzy Hash: EF016731D0D248A6CB04D7ED60416DDBFE49F49308F44C1EFA459E7282DB791A08879A

Uniqueness

Uniqueness Score: -1.00%

Function 00455E44 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B856,?,?,?,?,?,00000000,0045B87D), ref: 00455E80
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B856,?,?,?,?,?,00000000), ref: 00455E89
RemoveFontResourceA.GDI32(00000000), ref: 00455E96
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455EAA

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 4367fff8c833de44b842900a1b4d2923c098ee0f4df00cb22d54c14f58863b2d
Instruction ID: 2b3bc76bcbe24f9a378c9fd2a9d0a5bd871778c5a23a50a9ca37bd21dd0b5b9e
Opcode Fuzzy Hash: 4367fff8c833de44b842900a1b4d2923c098ee0f4df00cb22d54c14f58863b2d
Instruction Fuzzy Hash: C2F030B574470176EA10B7B69C47F1B228C8B54745F14483ABA00EB2C3D97CD904966D

Uniqueness

Uniqueness Score: -1.00%

Function 00478AC4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,00000001,00000000,00000002,00000000,00481CF1,?,?,?,?,?,00499C13,00000000,00499C3B), ref: 00478ACD
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,00000001,00000000,00000002,00000000,00481CF1,?,?,?,?,?,00499C13,00000000), ref: 00478AD3
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,00000001,00000000,00000002,00000000,00481CF1), ref: 00478AF5
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,00000001,00000000,00000002,00000000,00481CF1), ref: 00478B06

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 6c6ee25cd18fac22b77f5270f203e614981349e7ffe73e55fe41b9a07b930360
Instruction ID: d3b5959cc04f8136cc7387efe0894034f0cfdc433bf3605f5a0240715fd86ed0
Opcode Fuzzy Hash: 6c6ee25cd18fac22b77f5270f203e614981349e7ffe73e55fe41b9a07b930360
Instruction Fuzzy Hash: E6F037B16443006BD600EAB58C86F5B73DCEB44354F04493E7D94C71C1DA78DC08AB36

Uniqueness

Uniqueness Score: -1.00%

Function 00424250 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042425C
IsWindowVisible.USER32(?), ref: 0042426D
IsWindowEnabled.USER32(?), ref: 00424277
SetForegroundWindow.USER32(?), ref: 00424281

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 2109033ea831b29bd9df366a07658152925abf99056041cee36ff3df8dd8cd11
Instruction ID: 2755c926dfb62d6ecb2d5c8fb2e1e882bb3f56b09ddc897a1aa573e645a4fcd2
Opcode Fuzzy Hash: 2109033ea831b29bd9df366a07658152925abf99056041cee36ff3df8dd8cd11
Instruction Fuzzy Hash: 99E0EC61B0257196AAB1EA7B2881A9F118CDD46BE434602A7FD41F7287DB2CDC1045BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040627C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040627F
GlobalUnWire.KERNEL32(00000000), ref: 00406286
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040628B
GlobalFix.KERNEL32(00000000), ref: 00406291

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 024a49765fc045a09389489d8ed5919b86daafa6bea6a005e9f609907830066e
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 64B009C6925A46B8EC0473B24C4BD3F041CE88472C3809A6E7554BA0839C7C9C002E3A

Uniqueness

Uniqueness Score: -1.00%

Function 0047AB9C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047C485,?,00000000,00000000,00000001,00000000,0047AE39,?,00000000), ref: 0047ADFD

Strings

Failed to parse "reg" constant, xrefs: 0047AE04
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047AC71

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 32e71fc7a03c15efa7b99d977ff5035086010f2dc6983220fc2d1efa0f706db0
Instruction ID: 8958fc13432e1fdc5d7334ebe648dcfdd296a3f15338663f3006e9232e1ed6f4
Opcode Fuzzy Hash: 32e71fc7a03c15efa7b99d977ff5035086010f2dc6983220fc2d1efa0f706db0
Instruction Fuzzy Hash: 81814374E00148AFCB11EF95C481ADEBBF9AF48354F60816AE814FB391D7389E45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0045C30C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 004509A0: SetEndOfFile.KERNEL32(?,?,0045C3EA,00000000,0045C575,?,00000000,00000002,00000002), ref: 004509A7

FlushFileBuffers.KERNEL32(?), ref: 0045C541

Strings

NumRecs range exceeded, xrefs: 0045C43E
EndOffset range exceeded, xrefs: 0045C475

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: c34bc2268922531c10e625127453f9aaccd645283e49f4d6e3fe701b1b6bded9
Instruction ID: 57127da9839884e48f93c65e4688b7b5a24f3d4ce709f11da5987aa0442ebed2
Opcode Fuzzy Hash: c34bc2268922531c10e625127453f9aaccd645283e49f4d6e3fe701b1b6bded9
Instruction Fuzzy Hash: E461A234A003588FDB25DF25C891AD9B7B5EF49305F0084DAED89AB352DA74AEC8CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0046D0E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046D20C
Failed to proceed to next wizard page; aborting., xrefs: 0046D1F8

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 3b8c9bd5351e74d9bf97e7a5d6bc1aa8cbbe8aadd2c34ef49bac50f3de7354e1
Instruction ID: 8004c26ef4cb504047a222646726943f1bbb94b4e8b8dc98ea392f66818be873
Opcode Fuzzy Hash: 3b8c9bd5351e74d9bf97e7a5d6bc1aa8cbbe8aadd2c34ef49bac50f3de7354e1
Instruction Fuzzy Hash: 10319C70E042049FD711EB59D949BD977F5AB06304F6500BAF0089B3A2D778AE44DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00479758 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE2C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,OFH,?,00000001,?,?,0048464F,?,00000001,00000000), ref: 0042DE48

RegCloseKey.ADVAPI32(?,0047983E,?,?,00000001,00000000,00000000,00479859), ref: 00479827

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004797B2
%s\%s_is1, xrefs: 004797D0

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: ac71d9ff293ab2c578142f2ab28f6c1149e94b0fde6d71e308fad74fde98ec73
Instruction ID: 005788e0d783da3053e3295fdee8361bd532c57f8c65d350b3ee6381f09b7b21
Opcode Fuzzy Hash: ac71d9ff293ab2c578142f2ab28f6c1149e94b0fde6d71e308fad74fde98ec73
Instruction Fuzzy Hash: 8E218074A14244AFDB01DFAAC841A9EBBE8EB49304F91847AE408E7381D7789D01CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004501DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 00450271
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004502A2

Strings

open, xrefs: 00450295

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 1d47999e67842d91bbdff3080109e9f99b92e08493ad044d5529b9a4f90a2308
Instruction ID: 579e8a969fc791085b17213fdcb8cb543336c6f56b5ff41e9c914d75dd94f84d
Opcode Fuzzy Hash: 1d47999e67842d91bbdff3080109e9f99b92e08493ad044d5529b9a4f90a2308
Instruction Fuzzy Hash: 9D215174A00204AFDB04DFA5CC85B9EB7F9EB44705F2085BAB404E7292DB789E45CA48

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049C420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049C420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049C420,0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049C420,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049C420,00401A89,00000000,00401A82,?,?,0040222E,02170000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 94eed0a9be2c3ee170c705f4af63db45f02aa9b7064399c91cb7111f76640db2
Instruction ID: 1fa17fb08616f6b4eef2bbe9ac14d29337f111a30cd6b0cffb698505e2c33406
Opcode Fuzzy Hash: 94eed0a9be2c3ee170c705f4af63db45f02aa9b7064399c91cb7111f76640db2
Instruction Fuzzy Hash: A21134307042006FEB10AB795F6A62A6AD4D795358B60087FF404F32D2D9BD8C02825C

Uniqueness

Uniqueness Score: -1.00%

Function 00497A66 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00497AA1

Strings

/INITPROCWND=$%x , xrefs: 00497ACC
@, xrefs: 00497A6C

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: f19f9fce94bc0eafe6272d3d57771ce5769331f8f6a0c2cbaae4f670b1d3a1cc
Instruction ID: 1ad3777498bcdd41386727965e7ff972d52a271568fc5e1506d16cbf90a27834
Opcode Fuzzy Hash: f19f9fce94bc0eafe6272d3d57771ce5769331f8f6a0c2cbaae4f670b1d3a1cc
Instruction Fuzzy Hash: D911B431A182088FDB01DBA4E851FAEBFE9EB48318F50847BE504E7291D73CA905CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00447488 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 0044753A

Strings

NIL Interface Exception, xrefs: 004474DC
Unknown Method, xrefs: 00447513

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: b5b3b2027cd9392a30aef52b357f29023a93b6cb0369269594e46825eb3d0212
Instruction ID: e21740dd19ee0d3aaa7bf219fd9fa850e2e2e771d5dc584e192d83827b059975
Opcode Fuzzy Hash: b5b3b2027cd9392a30aef52b357f29023a93b6cb0369269594e46825eb3d0212
Instruction Fuzzy Hash: 9211E930A04204AFEB00DFA59D42A6EBBBCEB49704F51447AF500EB681DB789D00CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD88
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDC8

Strings

Inno Setup: No Icons, xrefs: 0042DD86

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 8eee03c1fbfc328194d38fab97817ecd3167584576368d321fe403edd0428e5d
Instruction ID: 8a75d463627faac0db3bfd1327658b2d26d196a72fd2cd26e512c66f67a8876f
Opcode Fuzzy Hash: 8eee03c1fbfc328194d38fab97817ecd3167584576368d321fe403edd0428e5d
Instruction Fuzzy Hash: E0012B36F5A77079F73046216D02BBB56888B82B60F68053BF940EA2C0D6589C04D36E

Uniqueness

Uniqueness Score: -1.00%

Function 0049879C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0045568C: GetCurrentProcess.KERNEL32(00000028), ref: 0045569B
Part of subcall function 0045568C: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004556A1

SetForegroundWindow.USER32(?), ref: 004987CE

Strings

Not restarting Windows because Uninstall is being run from the debugger., xrefs: 004987F9
Restarting Windows., xrefs: 004987AB

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 065f10d365b3e67c37dbed7903cd71e32c90bb282f8dec5a6544000b5908d871
Instruction ID: bcfaeb0037d15a90c8bb1897fb7ccd23d4f66f133b09101216ab89c2af7782bb
Opcode Fuzzy Hash: 065f10d365b3e67c37dbed7903cd71e32c90bb282f8dec5a6544000b5908d871
Instruction Fuzzy Hash: 7E012574A441805BEB01FBA9E8427AD2F989B56309F90807FF444672D3CB7D9949873D

Uniqueness

Uniqueness Score: -1.00%

Function 00498F3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047DA50: FreeLibrary.KERNEL32(00000000,0048249B), ref: 0047DA66

Part of subcall function 0047D720: GetTickCount.KERNEL32 ref: 0047D76A

Part of subcall function 0045733C: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 0045735B

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00499893), ref: 00498F91
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00499893), ref: 00498F97

Strings

Detected restart. Removing temporary directory., xrefs: 00498F4B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 6a428ffbd076ab7f2d58134fc6febc6bd8709069e4e754f582cee4b09c7cf267
Instruction ID: a7e07619f5fc8a08e5d7cb665734614ab03f6f8d9f675c4c5effc8875e0c05c4
Opcode Fuzzy Hash: 6a428ffbd076ab7f2d58134fc6febc6bd8709069e4e754f582cee4b09c7cf267
Instruction Fuzzy Hash: D2E0E53120CA442EDB0277BA7C1696B3F9CDB4637CB61443FF90491552DD2D5800C67C

Uniqueness

Uniqueness Score: -1.00%

Function 00475A5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475C93), ref: 00475A81
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475C93), ref: 00475A98

Part of subcall function 00453510: GetLastError.KERNEL32(00000000,004540A5,00000005,00000000,004540DA,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004992DD,00000000), ref: 00453513

Strings

CreateFile, xrefs: 00475A8D

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: aaaba4956cf0f736bd052c50eaf3553fa76ee4cd59eddaf15a8c93a5a83e90c1
Instruction ID: e0b57929aea53c1ca704ff426cf874c6720f3cee2e461f956b250fce4e794a15
Opcode Fuzzy Hash: aaaba4956cf0f736bd052c50eaf3553fa76ee4cd59eddaf15a8c93a5a83e90c1
Instruction Fuzzy Hash: 66E065302403447FDA10E669DCC6F4577889B04728F108161B5446F3D2C5B9EC408658

Uniqueness

Uniqueness Score: -1.00%

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00499AEE), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,00499AEE), ref: 00403356

Strings

H6g, xrefs: 0040335B

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: H6g
API String ID: 2123368496-3674366180
Opcode ID: f58f8e950532dcfe9cce0c082a6550bb3b71f662624f5e87828fb25057d706ed
Instruction ID: 9846383379d11da5b3979ec5ca3a4cf6b38316955b58c391e9082901a5cd845e
Opcode Fuzzy Hash: f58f8e950532dcfe9cce0c082a6550bb3b71f662624f5e87828fb25057d706ed
Instruction Fuzzy Hash: 98C00260901205CBE750AFF6A886B156A94A751389F8044BFB104BA2E2DA7C82056BEE

Uniqueness

Uniqueness Score: -1.00%

Function 0045571C Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 0045573B
Sleep.KERNEL32(?), ref: 0045574B
GetLastError.KERNEL32 ref: 0045575E
GetLastError.KERNEL32 ref: 00455768

Memory Dump Source

Source File: 00000001.00000002.2103305529.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2103250406.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103523660.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103591357.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103638877.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2103691558.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_CuteWriter.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: d211106ad059561869653a3b0dfaaf7d27e2c372db37f4c9f063725c6158e360
Instruction ID: c9025c94a886fb5f76285139ad04fc7cdabfdd445e85fa9ce07bcd72d8186167
Opcode Fuzzy Hash: d211106ad059561869653a3b0dfaaf7d27e2c372db37f4c9f063725c6158e360
Instruction Fuzzy Hash: 0FF0B472B00914E74F20A5AAA99197F678CEA9D376F10852BFC04D7307C53DDD098AED

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Setup.exePID: 6500, Parent PID: 4632COMMON

Execution Graph

Execution Coverage:	46.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	55.3%
Total number of Nodes:	740
Total number of Limit Nodes:	26

Executed Functions

Function 00403160 Relevance: 1272.8, APIs: 586, Strings: 139, Instructions: 4064stringregistryfileCOMMON

Download Yara Rule

APIs

#1134.MFC42(00000000,?,?,?,?,?,00407783,000000FF), ref: 0040318F
__p___argc.MSVCRT ref: 004031B7
__p___argv.MSVCRT ref: 004031CD
#537.MFC42(00000001), ref: 004031DC
_mbscmp.MSVCRT ref: 004031F1
#2764.MFC42(/Pro32), ref: 00403211
#2764.MFC42(/pro32,/Pro32), ref: 00403226
#4129.MFC42(?,00000002,/pro32,/Pro32), ref: 0040323C
_mbsicmp.MSVCRT ref: 0040324D
#4129.MFC42(?,00000002), ref: 0040325F
_mbsicmp.MSVCRT ref: 0040326C
#800.MFC42 ref: 00403279
#4129.MFC42(?,00000002), ref: 0040328B
_mbsicmp.MSVCRT ref: 00403298
#800.MFC42 ref: 004032A5
#800.MFC42 ref: 004032B7
#800.MFC42(/Pro32), ref: 0040352F
__p___argc.MSVCRT ref: 00403541
#2621.MFC42 ref: 00403554
#540.MFC42 ref: 0040355C
#823.MFC42(000003E8), ref: 0040356D
#1168.MFC42 ref: 00403577
GetModuleFileNameA.KERNEL32(?,00000000,000001F4), ref: 00403586
_splitpath.MSVCRT ref: 0040359C
#860.MFC42(?), ref: 004035B1
#941.MFC42(?,?), ref: 004035BF
#858.MFC42(?,?,?), ref: 004035C8
#941.MFC42(Setup.inf,?,?,?), ref: 004035D4
#858.MFC42(?,Setup.inf,?,?,?), ref: 004035E2
#941.MFC42(Setup.Ini,?,Setup.inf,?,?,?), ref: 004035F1
#825.MFC42(00000000,Setup.Ini,?,Setup.inf,?,?,?), ref: 004035F7
#540.MFC42(?), ref: 00403602
#354.MFC42(?), ref: 0040360E
#5186.MFC42(?,00000000,00000000,?), ref: 00403621
#5442.MFC42(?,00000004), ref: 00403647
#823.MFC42(?,?,00000004), ref: 00403650
#5442.MFC42(00000000,?,?,00000004), ref: 00403662
#5442.MFC42(?,00000004,00000000,?,?,00000004), ref: 00403673
#823.MFC42(?,?,00000004,00000000,?,?,00000004), ref: 0040367C
#5442.MFC42(00000000,?,?,?,00000004), ref: 0040368E
#1979.MFC42(00000000,?,?,?,00000004), ref: 00403696
#825.MFC42(00000000,00000000,?,?,?,00000004), ref: 004036BD
#403.MFC42(00000400,?,?,?,00000004), ref: 004036D0
#6389.MFC42(00000000,?), ref: 004036F7
#825.MFC42(00000000,00000000,?), ref: 004036FD
#5445.MFC42(?,0000000A,?,?,?,00000000,?), ref: 00403724
#5445.MFC42(?,00000004,?,0000000A,?,?,?,00000000,?), ref: 00403735
#2919.MFC42(?,?,00000004,?,0000000A,?,?,?,00000000,?), ref: 00403747
#5445.MFC42(00000000,?,?,?,00000004,?,0000000A,?,?,?,00000000,?), ref: 00403759
#5445.MFC42(?,00000004,00000000,?,?,?,00000004,?,0000000A,?,?,?,00000000,?), ref: 00403771
#2919.MFC42(?,?,00000004,00000000,?,?,?,00000004,?,0000000A,?,?,?,00000000,?), ref: 00403784
#5445.MFC42(00000000,?,?,?,00000004,00000000,?,?,?,00000004,?,0000000A,?,?,?,00000000), ref: 00403796
#5445.MFC42(?,00000004,00000000,?,?,?,00000004,00000000,?,?,?,00000004,?,0000000A), ref: 004037AE
#2919.MFC42(?,?,00000004,00000000,?,?,?,00000004,00000000,?,?,?,00000004,?,0000000A), ref: 004037C1
#5445.MFC42(00000000,?,?,?,00000004,00000000,?,?,?,00000004,00000000,?,?,?,00000004,?), ref: 004037D3
#5445.MFC42(?,00000004,00000000,?,?,?,00000004,00000000,?,?,?,00000004,00000000,?,?,?), ref: 004037EB
#5445.MFC42(CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004,00000000,?,?,?,00000004,00000000,?), ref: 004037FF
#5445.MFC42(0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004,00000000,?,?,?,00000004), ref: 0040381A
#2919.MFC42(0000000B,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004,00000000,?,?,?), ref: 00403833
#5445.MFC42(00000000,0000000A,0000000B,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004,00000000,?), ref: 00403845
#5445.MFC42(?,0000000A,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004,00000000,?,?), ref: 00403861
#5445.MFC42(?,00000004,?,0000000A,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004,00000000), ref: 00403872
#2919.MFC42(?,?,00000004,?,0000000A,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?,?,00000004), ref: 00403882
#5445.MFC42(00000000,?,?,?,00000004,?,0000000A,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000,?,?), ref: 00403894
#5445.MFC42(?,00000004,00000000,?,?,?,00000004,?,0000000A,0000000A,00000004,CutePDF Writer Installation,?,?,00000004,00000000), ref: 004038AC
#5445.MFC42(?,?,?,00000004,00000000,?,?,?,00000004,?,0000000A,0000000A,00000004,CutePDF Writer Installation,?,?), ref: 004038C2
#5445.MFC42(?,00000004,?,?,?,00000004,00000000,?,?,?,00000004,?,0000000A,0000000A,00000004,CutePDF Writer Installation), ref: 004038D3
#5445.MFC42(?,00000004,?,00000004,?,?,?,00000004,00000000,?,?,?,00000004,?,0000000A,0000000A), ref: 004038F4
#5445.MFC42(?,00000004,?,00000004,?,00000004,?,?,?,00000004,00000000,?,?,?,00000004,?), ref: 00403905
#924.MFC42(?,?,LICENSE.TXT,?,00000004,?,00000004,?,00000004,?,?,?,00000004,00000000,?,?), ref: 00403927
PathFileExistsA.SHLWAPI(?,?,?,LICENSE.TXT,?,00000004,?,00000004,?,00000004,?,?,?,00000004,00000000,?), ref: 00403936
#800.MFC42(?,?,?,00000000,?), ref: 0040393E
#924.MFC42(?,?), ref: 00403957
#858.MFC42(00000000,?,?), ref: 00403964
#800.MFC42(00000000,?,?), ref: 00403970
PathFileExistsA.SHLWAPI(?,00000000,?,?), ref: 00403979
#924.MFC42(?,?,README.HTM), ref: 00403996
#858.MFC42(00000000,?,?,README.HTM), ref: 004039A3
#800.MFC42(00000000,?,?,README.HTM), ref: 004039AF
PathFileExistsA.SHLWAPI(?,00000000,?,?,README.HTM), ref: 004039B8
#924.MFC42(?,?,README.PDF), ref: 004039D2
#858.MFC42(00000000,?,?,README.PDF), ref: 004039DF
#800.MFC42(00000000,?,?,README.PDF), ref: 004039EB
PathFileExistsA.SHLWAPI(?,00000000,?,?,README.PDF), ref: 004039F4
#860.MFC42(README.DOC), ref: 00403A3E
#703.MFC42(README.DOC), ref: 00403A54
GetPrivateProfileStringA.KERNEL32(Installation,AutoPaperSize,0040AEE0,?,0000000A,00762C28), ref: 00403ABB
atoi.MSVCRT ref: 00403AD4
GetUserDefaultLCID.KERNEL32(?,?,?,?,00000000,?), ref: 00403AE1
#860.MFC42(Letter,?,?,?,?,00000000,?), ref: 00403B04
#1168.MFC42 ref: 00403B37
lstrcpyA.KERNEL32(CutePDF Writer Monitor v4.0,CutePDF Writer Monitor v4.0), ref: 00403B4E
GetVersionExA.KERNEL32(?), ref: 00403B65
RegOpenKeyExA.KERNEL32(80000002,?,00000000,-00020018,0040B2EC), ref: 00403CDD
RegCloseKey.ADVAPI32(00000690), ref: 00403CF2
LoadStringA.USER32(00400000,00000069,?,000000FF), ref: 00403D42
wsprintfA.USER32 ref: 00403D60
#537.MFC42(CutePDF Writer), ref: 00403D71
#924.MFC42(?,00000000,0040C730,CutePDF Writer), ref: 00403D85
#924.MFC42(?,00000000, Setup,?,00000000,0040C730,CutePDF Writer), ref: 00403D98
MessageBoxA.USER32(00000000,?,?,00000000), ref: 00403DAB
#800.MFC42 ref: 00403DB4
#800.MFC42 ref: 00403DBF
#800.MFC42 ref: 00403DCB
#665.MFC42 ref: 00403DD7
#800.MFC42 ref: 00403DE3
#800.MFC42 ref: 00403DF2
EnumMonitorsA.WINSPOOL.DRV(00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00403E27
lstrcmpA.KERNEL32(00000000,CutePDF Writer Monitor,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00403E6D
lstrcmpA.KERNEL32(00000000,CutePDF Writer Monitor v3.2), ref: 00403E8A
lstrcmpA.KERNEL32(00000000,CutePDF Writer Monitor v4.0), ref: 00403EA8
lstrcpyA.KERNEL32(?,Windows 4.0), ref: 00403EF7
lstrcpyA.KERNEL32(?,Windows x64), ref: 00403F0E
DeletePrinterDriverA.WINSPOOL.DRV(00000000,?,CutePDF Writer), ref: 00403F1E
DeletePortA.WINSPOOL.DRV(00000000,00000000,CPW2:,00000000,?,CutePDF Writer), ref: 00403F31
DeleteMonitorA.WINSPOOL.DRV(00000000,00000000,CutePDF Writer Monitor,00000000,00000000,CPW2:,00000000,?,CutePDF Writer), ref: 00403F44
GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00000100), ref: 00403F69
lstrcpyA.KERNEL32(http://www.CutePDF.com,C:\Windows\system32\), ref: 00403F81
lstrcatA.KERNEL32(http://www.CutePDF.com,0040A29C), ref: 00403F93
lstrcatA.KERNEL32(http://www.CutePDF.com,cpwmon2k.dll), ref: 00403FAE
DeleteFileA.KERNEL32(http://www.CutePDF.com), ref: 00403FB5
CreateProcessA.KERNEL32(00000000,unInstcpw64.exe /delete-cpwmon64,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?,00000000,00000000,CutePDF Writer Monitor,00000000,00000000,CPW2:), ref: 0040401D
GetExitCodeProcess.KERNEL32(?,?), ref: 00404036
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404042
TerminateProcess.KERNEL32(?,?), ref: 00404054
CloseHandle.KERNEL32(?), ref: 00404064
CloseHandle.KERNEL32(?), ref: 0040406A
lstrcpyA.KERNEL32(?,Windows 4.0), ref: 004040AE
lstrcpyA.KERNEL32(?,Windows x64), ref: 004040C5
DeletePrinterDriverA.WINSPOOL.DRV(00000000,?,CutePDF Writer v3.2), ref: 004040D5
DeletePortA.WINSPOOL.DRV(00000000,00000000,CPW3:,00000000,?,CutePDF Writer v3.2), ref: 004040E8
DeleteMonitorA.WINSPOOL.DRV(00000000,00000000,CutePDF Writer Monitor v3.2,00000000,00000000,CPW3:,00000000,?,CutePDF Writer v3.2), ref: 004040FB
GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00000100), ref: 00404120
lstrcpyA.KERNEL32(http://www.CutePDF.com,C:\Windows\system32\), ref: 00404138
lstrcatA.KERNEL32(http://www.CutePDF.com,0040A29C), ref: 00404144
lstrcatA.KERNEL32(http://www.CutePDF.com,cpwmon2k_v32.dll), ref: 0040415F
DeleteFileA.KERNEL32(http://www.CutePDF.com), ref: 00404166
CreateProcessA.KERNEL32(00000000,unInstcpw64.exe /delete-cpwmon64_v32,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?,00000000,00000000,CutePDF Writer Monitor v3.2,00000000,00000000,CPW3:), ref: 004041CE
GetExitCodeProcess.KERNEL32(?,?), ref: 004041E7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004041F3
TerminateProcess.KERNEL32(?,?), ref: 00404205
CloseHandle.KERNEL32(?), ref: 00404215
CloseHandle.KERNEL32(?), ref: 0040421B
lstrcpyA.KERNEL32(?,Windows 4.0), ref: 00404251
lstrcpyA.KERNEL32(?,Windows x64), ref: 00404268
DeletePrinterDriverA.WINSPOOL.DRV(00000000,?,CutePDF Writer v4.0), ref: 00404278
DeletePortA.WINSPOOL.DRV(00000000,00000000,CPW4:,00000000,?,CutePDF Writer v4.0), ref: 0040428B
DeleteMonitorA.WINSPOOL.DRV(00000000,00000000,CutePDF Writer Monitor v4.0,00000000,00000000,CPW4:,00000000,?,CutePDF Writer v4.0), ref: 0040429E
GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00000100), ref: 004042C5
lstrcpyA.KERNEL32(http://www.CutePDF.com,C:\Windows\system32\), ref: 004042DD
lstrcatA.KERNEL32(http://www.CutePDF.com,0040A29C), ref: 004042ED
lstrcatA.KERNEL32(http://www.CutePDF.com,cpwmon32_v40.dll), ref: 004042F9
DeleteFileA.KERNEL32(http://www.CutePDF.com), ref: 00404300
CreateProcessA.KERNEL32(00000000,unInstcpw64.exe /delete-cpwmon64_v40,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?,00000000,00000000,CutePDF Writer Monitor v4.0,00000000,00000000,CPW4:), ref: 00404366
GetExitCodeProcess.KERNEL32(?,?), ref: 00404383
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040438F
TerminateProcess.KERNEL32(?,00000000), ref: 004043A1
CloseHandle.KERNEL32(?), ref: 004043B1
CloseHandle.KERNEL32(?), ref: 004043B7
LoadStringA.USER32(00400000,00000068,?,000000FF), ref: 004043E2
#540.MFC42 ref: 004043EB
#2818.MFC42(?,?,CutePDF Writer Installation,CutePDF Writer), ref: 00404409
#537.MFC42(CutePDF Writer Installation), ref: 00404419
#924.MFC42(?,00000000,0040C730,CutePDF Writer Installation), ref: 0040442C
#924.MFC42(?,00000000, Setup,?,00000000,0040C730,CutePDF Writer Installation), ref: 0040443F
MessageBoxA.USER32(00000000,?,?,00000004), ref: 0040444F
#800.MFC42(?), ref: 0040445F
#800.MFC42(?), ref: 0040446B
#800.MFC42(?), ref: 00404477
#800.MFC42(?), ref: 0040448A
#665.MFC42(?), ref: 00404496
#800.MFC42(?), ref: 004044A2
#800.MFC42(?), ref: 004044B1
#800.MFC42(?), ref: 004044C9
#2818.MFC42(?,Do you accept all the terms of the preceding License Agreement? If you choose No, Setup will close. To install %s, you must accept this agreement.,CutePDF Writer Installation,00000000,?), ref: 00404508
#924.MFC42(?,?,LICENSE.TXT,?,00000000,?), ref: 0040451D
#858.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 0040452D
#800.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404539
#2514.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404544
#800.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404558
#800.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404567
#656.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404576
#641.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404585
#665.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 00404591
#800.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 0040459D
#800.MFC42(00000000,?,?,LICENSE.TXT,?,00000000,?), ref: 004045AC
#800.MFC42(00000000,?), ref: 004045CE
#800.MFC42(00000000,?), ref: 004045DD
#656.MFC42(00000000,?), ref: 004045EC
#641.MFC42(00000000,?), ref: 004045FB
#540.MFC42(00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00404610

Part of subcall function 00401000: #324.MFC42(00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00401028
Part of subcall function 00401000: #567.MFC42(00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 0040103A
Part of subcall function 00401000: #540.MFC42(00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00401052
Part of subcall function 00401000: #860.MFC42(0040AEE0,00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308), ref: 00401069

#537.MFC42(C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00404632
#922.MFC42(?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 0040464A
#858.MFC42(00000000,?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 0040465A
#800.MFC42(00000000,?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00404666
#800.MFC42(00000000,?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00404672
#860.MFC42(C:\Program Files\,00000000,?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 0040467F
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000,C:\Program Files\,00000000,?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308), ref: 0040469A
#860.MFC42(?), ref: 004046B5
#940.MFC42(0000005C,?), ref: 004046D2
#858.MFC42(?,?), ref: 004046E1
#939.MFC42(000000DC,?,?), ref: 004046ED
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00000000,000F003F,0040B2EC,C:\Program Files\,00000000,?,00000000,000000DC,C:\Program Files\,00000000,00000000,00000001,http://www.CutePDF.com,00001000), ref: 0040470D
RegQueryValueExA.ADVAPI32(00000690,ProgramFilesDir,00000000,?,?,?), ref: 00404745
#860.MFC42(?), ref: 0040475C
#940.MFC42(0000005C,?), ref: 00404779
#858.MFC42(?,?), ref: 00404788
#939.MFC42(000000DC,?,?), ref: 00404794
RegCloseKey.ADVAPI32(00000690), ref: 0040479F
GetPrivateProfileStringA.KERNEL32(Parameters,DestinationFolder,0040AEE0,?,000003E8,00762C28), ref: 004047C7
#860.MFC42(?), ref: 004047EC
#2514.MFC42(?), ref: 00404804
#800.MFC42(?), ref: 00404818
#656.MFC42(?), ref: 00404827
#641.MFC42(?), ref: 00404836
#800.MFC42(?), ref: 00404842
#665.MFC42(?), ref: 0040484E
#800.MFC42(?), ref: 0040485A
#800.MFC42(?), ref: 00404869
#860.MFC42(?), ref: 004048EB
#800.MFC42(?), ref: 004048FA
#656.MFC42(?), ref: 00404909
#641.MFC42(?), ref: 00404918
#800.MFC42(?), ref: 00404924
RegCreateKeyExA.KERNEL32(80000002,SOFTWARE\Acro Software Inc\CutePDF Writer,00000000,00000000,00000000,-000F003E,00000000,?,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00404958
RegSetValueExA.KERNEL32(?,Port Name,00000000,00000001,?), ref: 00404995
RegSetValueExA.KERNEL32(?,Printer Name,00000000,00000001,?,-00000001), ref: 004049C0
RegSetValueExA.KERNEL32(?,Destination Folder,00000000,00000001), ref: 004049E9
RegSetValueExA.KERNEL32(?,Programmatic Access,00000000,00000004,?,00000004), ref: 00404A07
GetPrivateProfileStringA.KERNEL32(Parameters,Command,0040AEE0,?,000003E8,00762C28), ref: 00404A2B
RegSetValueExA.ADVAPI32(?,Command,00000000,00000001,?), ref: 00404A65
GetPrivateProfileStringA.KERNEL32(Parameters,Arguments,0040AEE0,?,000003E8,00762C28), ref: 00404A88
RegSetValueExA.ADVAPI32(?,Arguments,00000000,00000001,?), ref: 00404AC2
RegCloseKey.ADVAPI32(?), ref: 00404AC8
RegCreateKeyExA.KERNEL32(80000002,SOFTWARE\Acro Software Inc\CutePDF Writer,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00404AF4
RegSetValueExA.KERNEL32(?,Destination Folder,00000000,00000001), ref: 00404B1D
RegCloseKey.ADVAPI32(?), ref: 00404B23
GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00000100), ref: 00404B33
lstrcatA.KERNEL32(C:\Windows\system32\,0040A29C), ref: 00404B4E
GetModuleFileNameA.KERNEL32(00400000,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\,00000100), ref: 00404B60
strrchr.MSVCRT ref: 00404B6D
CreateDirectoryA.KERNEL32(?,00000000), ref: 00404BDB
#5683.MFC42(0000005C), ref: 00404BF4
#4129.MFC42(?,00000000,0000005C), ref: 00404C14
#800.MFC42(?,00000000,0000005C), ref: 00404C43
CreateDirectoryA.KERNEL32(?,00000000,0000005C), ref: 00404C67
#537.MFC42(?), ref: 00404C7F
#5683.MFC42(0000005C,?), ref: 00404C8D
#4129.MFC42(?,00000000,0000005C,?), ref: 00404CA2
#800.MFC42(?,00000000,0000005C,?), ref: 00404CD1

Part of subcall function 00406AB0: GetCurrentDirectoryA.KERNEL32(00000104,?,?), ref: 00406AC1
Part of subcall function 00406AB0: SearchPathA.KERNEL32(?,?,00000000,00000104,?,?), ref: 00406AE8
Part of subcall function 00406AB0: GetLongPathNameW.KERNEL32(?), ref: 00406AF3

CreateDirectoryA.KERNEL32(?,00000000,0000005C,?), ref: 00404CF1
#4129.MFC42(?,?,0000005C,?), ref: 00404D0C
#800.MFC42(?,?,0000005C,?), ref: 00404D3B
CreateDirectoryA.KERNEL32(?,00000000,?,?,0000005C,?), ref: 00404D49
#800.MFC42 ref: 00404D56
CreateDirectoryA.KERNEL32(?,00000000), ref: 00404DA8
#800.MFC42(0000005C,?), ref: 00404DD2
lstrcpyA.KERNEL32(C:\Program Files (x86)\CutePDF Writer\Error.log,?), ref: 00404DEE
lstrcatA.KERNEL32(C:\Program Files (x86)\CutePDF Writer\Error.log,\Error.log), ref: 00404DFA
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00404E08
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\CPWSave.exe), ref: 00404E14
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 00404E20
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,pdfwriter.exe), ref: 00404E4C
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00404E60
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00404E78
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00404E91
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\CPWriter2.exe), ref: 00404E9D
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 00404EA9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,CPWriter2.exe), ref: 00404EB5
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00404ECC
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00404EDD
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00404EF6
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\CPWFtp.dll), ref: 00404F02
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 00404F0E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,CPWFtp.dll), ref: 00404F1A
PathFileExistsA.SHLWAPI(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF), ref: 00404F37
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00404F4D
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00404F65

Part of subcall function 00401D10: GetFileAttributesA.KERNEL32(000000FF,00000000,004073D8,000000FF,00404E82,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00401D2A
Part of subcall function 00401D10: #800.MFC42 ref: 00401D3D

#537.MFC42(regsvr32 /s "), ref: 00404F7A
#941.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,regsvr32 /s "), ref: 00404F8B
#941.MFC42(0040AA58,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,regsvr32 /s "), ref: 00404F98
WinExec.KERNEL32(?,00000000), ref: 00404FA3
#800.MFC42 ref: 00404FB0
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00404FC8
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,0040A29C), ref: 00404FD4
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00404FDF
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 00404FEB
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,?), ref: 00404FF6
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00405004
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 0040501C
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00405035
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\setup.inf), ref: 00405041
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 0040504D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,setup.inf), ref: 00405059
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00405067
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 0040507F
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00405098
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\setup.ini), ref: 004050A4
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 004050B0
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,setup.ini), ref: 004050CC
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 004050DA
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 004050EB
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00405104
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\message.txt), ref: 00405110
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 0040511C
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,message.txt), ref: 00405128
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00405136
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405147
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00405160
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,\CustExt.exe), ref: 0040516C
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 00405178
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,CustExt.exe), ref: 00405184
PathFileExistsA.SHLWAPI(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF), ref: 00405194
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 004051AA
#537.MFC42(CutePDF Writer Installation), ref: 0040662F
#924.MFC42(?,00000000,0040C730,CutePDF Writer Installation), ref: 00406642
#924.MFC42(?,00000000, Setup,?,00000000,0040C730,CutePDF Writer Installation), ref: 00406655
#537.MFC42(CutePDF Writer Installation,?,00000000, Setup,?,00000000,0040C730,CutePDF Writer Installation), ref: 00406669
#924.MFC42(?,00000000, does not support Windows95/NT.,CutePDF Writer Installation,?,00000000, Setup,?,00000000,0040C730,CutePDF Writer Installation), ref: 0040667C
MessageBoxA.USER32(00000000,?,CutePDF Writer,00000000), ref: 00406689
#800.MFC42 ref: 00406692
#800.MFC42 ref: 0040669D
#800.MFC42 ref: 004066A9
#800.MFC42 ref: 004066B5
#800.MFC42 ref: 004066C1
#665.MFC42 ref: 004066CD
#800.MFC42 ref: 004066D9
#800.MFC42 ref: 004066E8
#665.MFC42(00000000,?), ref: 00406713
#800.MFC42(00000000,?), ref: 0040671F
#800.MFC42(00000000,?), ref: 0040672E

Strings

CutePDF Writer v3.2, xrefs: 004040CD
CutePDF Writer, xrefs: 00403A6D, 00406212, 00406685
CutePDFWriter.exe, xrefs: 004054D6
CustExt, xrefs: 004065BF
Command, xrefs: 00404A21, 00404A5F, 00406329
Shortcut to CutePDF Editor, xrefs: 004060FC
Windows x64, xrefs: 00403C01, 00403F08, 004040BF, 00404262
Preferences.exe, xrefs: 0040547A
C:\Program Files (x86)\CutePDF Writer\Error.log, xrefs: 00404DE9, 00404DF5
System\CurrentControlSet\Control\Print\Printers\%s, xrefs: 00406272
HelpLink, xrefs: 00405E74
\CuteEncrypt.exe, xrefs: 00405258
\CutePDFWriter.exe, xrefs: 004054BE
cpwmon2k.dll, xrefs: 00403F9C
\PDFWrite.rsp, xrefs: 00405347
pdfwriter.exe, xrefs: 00404E42
UninstallString, xrefs: 00405D6F
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00403C3B, 00405C0F
message.txt, xrefs: 0040511E
SOFTWARE\Acro Software Inc\CutePDF Writer, xrefs: 0040494E, 00404AEA, 004062EB, 00406407
unInstcpw64.exe /delete-cpwmon64_v32, xrefs: 004041A3
CutePDF Writer Monitor v3.2, xrefs: 00403E81, 004040ED
4.0, xrefs: 00405D7B
Arguments, xrefs: 00404A7E, 00404ABC, 00406334
Monitor, xrefs: 00405BB0
http://download.cutepdf.com/download/converter2.asp, xrefs: 0040571E
README.TXT, xrefs: 00403946, 0040397F
CutePDF Writer, xrefs: 00403D48, 00403D53, 00403D6C, 00403F16, 004043F0, 00405CD3, 00405FF9
Install PDF Writer failed. (Err-109), xrefs: 0040557A, 0040558C
\iSEDQuickPDFSL.dll, xrefs: 004051DD
C:\Program Files\, xrefs: 00404626, 00404677
"-d, xrefs: 004033A9
https://www.cutepdf-editor.com, xrefs: 00406102
C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF, xrefs: 00404E03, 00404E0F, 00404E56, 00404E73, 00404E8C, 00404E98, 00404EC2, 00404ED8, 00404EF1, 00404EFD, 00404F43, 00404F60, 00404F7F, 00404FC3, 00404FCF, 00404FDA, 00404FFA, 00405017, 00405030, 0040503C, 0040505D, 0040507A, 00405093, 0040509F, 004050D0, 004050E6, 004050FF, 0040510B, 0040512C, 00405142, 0040515B, 00405167, 004051A0, 004051BD, 004051D6, 004051E2, 0040521B, 00405238, 00405251, 0040525D, 00405296, 004052B3, 004052CC, 004052D8, 00405311, 00405327, 00405340, 0040534C, 0040536D, 0040538A, 004053A3, 004053AF, 004053D0, 004053E6, 004053FF, 0040540B, 0040542C, 00405442, 0040545B, 00405467, 00405488, 0040549E, 004054B7, 004054C3, 004054E4, 004054FA, 00405520, 0040552C, 0040554D, 004055DB, 004055F2, 004055FE, 0040560A, 0040562B, 00405651, 00405666, 00405B2C, 00405B3A, 00405B5D, 00405B83
CPWSave.exe.manifest, xrefs: 004053C2
AutoPaperSize, xrefs: 00403AB1
CutePDF\PDF Writer, xrefs: 00405EA4
cpwmon.dll, xrefs: 00403FA3, 00403FA8, 00404154, 00404159
Programmatic Access, xrefs: 004049FE, 0040631E
Setup.inf, xrefs: 004035CD
Z, xrefs: 004061E9
CPWFtp.dll, xrefs: 00404F10
CuteEncrypt.lan, xrefs: 004052EB
Port, xrefs: 00405BDF
ProgramFilesDir, xrefs: 00404731
/uninstall, xrefs: 00405D23
CutePDF Writer Monitor, xrefs: 00403E64, 00403F36
unInstcpw64.exe, xrefs: 0040553F
Parameters, xrefs: 004047C2, 00404A26, 00404A83
Setup, xrefs: 00403D8A, 00404431, 004063B8, 00406647
http://download.cutepdf.com/download/converter.asp?V=P1, xrefs: 00405741
\CustExt.exe, xrefs: 00405162, 00406596
CPW3:, xrefs: 004040DA
Windows 4.0, xrefs: 00403BE9, 00403EEB, 004040A8, 00404245
README.DOC, xrefs: 00403A04, 00403A36
Letter, xrefs: 00403AFC
C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF, xrefs: 00404E1B, 00404E47, 00404E5B, 00404EA4, 00404EB0, 00404EC7, 00404F09, 00404F15, 00404F32, 00404F48, 00404FE6, 00404FF1, 00404FFF, 00405048, 00405054, 00405062, 004050AB, 004050C7, 004050D5, 00405117, 00405123, 00405131, 00405173, 0040517F, 0040518F, 004051A5, 004051EE, 004051FA, 0040520A, 00405220, 00405269, 00405275, 00405285, 0040529B, 004052E4, 004052F0, 00405300, 00405316, 00405358, 00405364, 00405372, 004053BB, 004053C7, 004053D5, 00405417, 00405423, 00405431, 00405473, 0040547F, 0040548D, 004054CF, 004054DB, 004054E9, 00405538, 00405544, 00405552, 00405616, 00405622, 00405630, 00405B46, 00405B54, 00405B62, 004061FB, 0040620B, 00406217, 00406223, 0040622E
Port Name, xrefs: 0040498F, 00406308
Destination Folder, xrefs: 004049E3, 00404B17, 0040655C
setup.inf, xrefs: 0040504F
iSEDQuickPDFSL.dll, xrefs: 004051F5
setup.ini, xrefs: 004050C2
.bin, xrefs: 0040621E
/pro32, xrefs: 0040321E
CutePDF Writer must be used with PS2PDF converter. Would you like this Setup program to download and install a free converter (recommended) for you?NOTE: this will require Internet access to our Website., xrefs: 00405698
setup_svr.ini, xrefs: 004050BB
http://download.acrosoftware.com/download/converter.asp?V=P1, xrefs: 00405765
Shortcut to readme, xrefs: 004060A1, 0040618B
\message.txt, xrefs: 00405106
\setup.inf, xrefs: 00405037
Do you accept all the terms of the preceding License Agreement? If you choose No, Setup will close. To install %s, you must accept this agreement., xrefs: 00404502
DisplayName, xrefs: 00405CFD
unInstcpw64.exe /delete-cpwmon64_v40, xrefs: 0040433B
Acro Software Inc., xrefs: 00405DAB
pdfwriter64.exe, xrefs: 00404E2B
CPW2:, xrefs: 00403F23
Windows NT x86, xrefs: 00403BA2, 00403EDD, 0040408C, 00404237
\CPWFtp.dll, xrefs: 00404EF8
/auto, xrefs: 004058E0
regsvr32 /s ", xrefs: 00404F75
Default DevMode, xrefs: 004062AA
Connecting ... ..., xrefs: 004056F4
\unInstcpw64.exe, xrefs: 00405527
\CuteEdit.ico, xrefs: 00405406, 00405DEC, 00406081, 004060E2, 00406144
Downloading ... ... %d %%, xrefs: 0040585F, 0040598F
\converter.exe, xrefs: 004057D8
\Try Free CutePDF Editor.lnk, xrefs: 004060DA
DisplayVersion, xrefs: 00405D9F
PDFWrite.rsp, xrefs: 0040535F
CUTEPDF_SDK, xrefs: 0040570E
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00404703
CutePDF Writer Setup, xrefs: 00405693
unInstcpw64.exe /delete-cpwmon64, xrefs: 00403FF2
http://www.CutePDF.com, xrefs: 00403E19, 00403E3E, 00403F7C, 00403F8E, 00403FA9, 00403FB0, 00404133, 0040413F, 0040415A, 00404161, 004042D8, 004042E8, 004042F4, 004042FB, 00405CD8, 00405CE5, 00405CF4, 00405D1C, 00405D34, 00405D40, 00405D51, 00405D58, 00405D66, 00405D80, 00405D87, 00405D96, 00405DB0, 00405DB7, 00405DC6, 00405DE5, 00405DF1, 00405DF8, 00405E07, 00405E26, 00405E2D, 00405E3B, 00405E55, 00405E5C, 00405E6B
\CPWriter2.exe, xrefs: 00404E93
README.HTM, xrefs: 0040398C, 004039BE
(,v, xrefs: 004035DD, 004035EC, 00403A8B, 004047A5, 00404A09, 00404A67
LICENSE.TXT, xrefs: 00403914, 00404516
CuteEdit.ico, xrefs: 0040541E
pdfwriter32.exe, xrefs: 00404E3B
http://www.CutePDF.com, xrefs: 00405E50
does not support Windows95/NT., xrefs: 0040666E
README.PDF, xrefs: 004039C8, 004039FA
cpwmon2k_v32.dll, xrefs: 0040414D
InstallLocation, xrefs: 00405E44
https://www.cutepdf-editor.com/support/writerhelp.asp, xrefs: 004060A7
\setup.ini, xrefs: 0040509A
uninstcpw.exe, xrefs: 00405605, 0040561D
D, xrefs: 00405A85
CutePDF Writer Installation, xrefs: 004037FA, 00403C95, 00403CF8, 004043FB, 00404414, 004044F7, 00405C71, 00406376, 00406381, 0040639A, 00406627, 0040665E
\, xrefs: 004048BA
CutePDF Writer v4.0, xrefs: 00404270
CustExt.exe, xrefs: 0040517A, 00406570
Installation, xrefs: 00403AB6
\CPWSave.exe, xrefs: 00404E0A
<, xrefs: 00406483
cpwmon32_v40.dll, xrefs: 00403BAC, 004042EF
DestinationFolder, xrefs: 004047BD
CPWriter2.exe, xrefs: 00404EAB
CPW4:, xrefs: 0040427D
/inscpw4, xrefs: 004031E4
Driver\, xrefs: 00406206
Printer Name, xrefs: 004049BA, 00406313
CutePDF Writer Monitor v4.0, xrefs: 00403B3F, 00403E9F, 00404290
CPW4:, xrefs: 00403A94
CuteEncrypt.exe, xrefs: 00405270
C:\Windows\system32\, xrefs: 00403F64, 00403F77, 0040411B, 0040412E, 004042C0, 004042D3, 00404B2E, 00404B49, 00405B27
\CuteEncrypt.lan, xrefs: 004052D3
\Readme.lnk, xrefs: 00406076, 00406139
C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\, xrefs: 00404B5A, 00404B68, 00404B7D, 00404E16, 00404E9F, 00404F04, 00404FE1, 00405043, 004050A6, 00405112, 0040516E, 004051E9, 00405264, 004052DF, 00405353, 004053B6, 00405412, 0040546E, 004054CA, 00405533, 00405611, 00405B41, 004061F6
Publisher, xrefs: 00405DCF
\Preferences.exe, xrefs: 00405462
DisplayIcon, xrefs: 00405E10
\Error.log, xrefs: 00404DF0
unInstcpw64.exe /copy, xrefs: 00405AA3
Setup.Ini, xrefs: 004035E7
/Pro32, xrefs: 00403209
CutePDF Writer Monitor v4.0, xrefs: 00403B44, 00403B94, 00405BC4
\CPWSave.exe.manifest, xrefs: 004053AA

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$lstrcpy$lstrcat$File$#5445$#537$#924Delete$CloseCreateDirectory$#858#860PathProcess$CopyValue$#4129#665ExistsHandleString$#2919#540#941$#5442#641#656PrivateProfileSystem$#823#825CodeDriverExitMessageMonitorNameObjectPortPrinterSingleTerminateWait_mbsicmplstrcmp$#1168#2514#2764#2818#5683#939#940LoadModuleOpen__p___argc$#1134#1979#2621#324#354#403#5186#567#6389#703#922AttributesCurrentDefaultEnumExecFolderLongMonitorsQuerySearchSpecialUserVersion__p___argv_mbscmp_splitpathatoistrrchrwsprintf
String ID: /auto$ /uninstall$ 4.0$ Setup$ does not support Windows95/NT.$"-d$(,v$.bin$/Pro32$/inscpw4$/pro32$<$Acro Software Inc.$Arguments$AutoPaperSize$C:\Program Files (x86)\CutePDF Writer\Error.log$C:\Program Files\$C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\$C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF$C:\Windows\system32\$C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF$CPW2:$CPW3:$CPW4:$CPW4:$CPWFtp.dll$CPWSave.exe.manifest$CPWriter2.exe$CUTEPDF_SDK$Command$Connecting ... ...$CustExt$CustExt.exe$CuteEdit.ico$CuteEncrypt.exe$CuteEncrypt.lan$CutePDF Writer$CutePDF Writer$CutePDF Writer Installation$CutePDF Writer Monitor$CutePDF Writer Monitor v3.2$CutePDF Writer Monitor v4.0$CutePDF Writer Monitor v4.0$CutePDF Writer Setup$CutePDF Writer must be used with PS2PDF converter. Would you like this Setup program to download and install a free converter (recommended) for you?NOTE: this will require Internet access to our Website.$CutePDF Writer v3.2$CutePDF Writer v4.0$CutePDFWriter.exe$CutePDF\PDF Writer$D$Default DevMode$Destination Folder$DestinationFolder$DisplayIcon$DisplayName$DisplayVersion$Do you accept all the terms of the preceding License Agreement? If you choose No, Setup will close. To install %s, you must accept this agreement.$Downloading ... ... %d %%$Driver\$HelpLink$Install PDF Writer failed. (Err-109)$InstallLocation$Installation$LICENSE.TXT$Letter$Monitor$PDFWrite.rsp$Parameters$Port$Port Name$Preferences.exe$Printer Name$ProgramFilesDir$Programmatic Access$Publisher$README.DOC$README.HTM$README.PDF$README.TXT$SOFTWARE\Acro Software Inc\CutePDF Writer$SOFTWARE\Microsoft\Windows\CurrentVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$Setup.Ini$Setup.inf$Shortcut to CutePDF Editor$Shortcut to readme$System\CurrentControlSet\Control\Print\Printers\%s$UninstallString$Windows 4.0$Windows NT x86$Windows x64$Z$\$\CPWFtp.dll$\CPWSave.exe$\CPWSave.exe.manifest$\CPWriter2.exe$\CustExt.exe$\CuteEdit.ico$\CuteEncrypt.exe$\CuteEncrypt.lan$\CutePDFWriter.exe$\Error.log$\PDFWrite.rsp$\Preferences.exe$\Readme.lnk$\Try Free CutePDF Editor.lnk$\converter.exe$\iSEDQuickPDFSL.dll$\message.txt$\setup.inf$\setup.ini$\unInstcpw64.exe$cpwmon.dll$cpwmon2k.dll$cpwmon2k_v32.dll$cpwmon32_v40.dll$http://download.acrosoftware.com/download/converter.asp?V=P1$http://download.cutepdf.com/download/converter.asp?V=P1$http://download.cutepdf.com/download/converter2.asp$http://www.CutePDF.com$http://www.CutePDF.com$https://www.cutepdf-editor.com$https://www.cutepdf-editor.com/support/writerhelp.asp$iSEDQuickPDFSL.dll$message.txt$pdfwriter.exe$pdfwriter32.exe$pdfwriter64.exe$regsvr32 /s "$setup.inf$setup.ini$setup_svr.ini$unInstcpw64.exe$unInstcpw64.exe /copy$unInstcpw64.exe /delete-cpwmon64$unInstcpw64.exe /delete-cpwmon64_v32$unInstcpw64.exe /delete-cpwmon64_v40$uninstcpw.exe
API String ID: 1050026283-3673096220
Opcode ID: d7baf39355446494aa857490d93c5c5d8b805860be3c4296efe2e2ead12cd673
Instruction ID: 4e8e3be5aedf6f09954a17712fb5b61dcd1a33838cf68bb0eb6b050b2d4f416b
Opcode Fuzzy Hash: d7baf39355446494aa857490d93c5c5d8b805860be3c4296efe2e2ead12cd673
Instruction Fuzzy Hash: 7863A370A40309AADB14EBA5CD46FAE7774EF84704F10417EF906B72C1DBB86A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D90 Relevance: 73.8, APIs: 32, Strings: 10, Instructions: 320
stringmemorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStringA.KERNEL32(Installation,PrintDirectly,0040AEE0,?,0000000A,00762C28), ref: 00401DB9
atoi.MSVCRT ref: 00401DD4
OpenPrinterA.WINSPOOL.DRV ref: 00401E10
lstrcmpA.KERNEL32(Letter,?), ref: 00401E40
SetLastError.KERNEL32(00000000), ref: 00401E4F
GetPrinterA.WINSPOOL.DRV(?,00000008,00000000,00000000,?), ref: 00401E63
GetLastError.KERNEL32(?,00000008,00000000,00000000,?), ref: 00401E6E
GlobalAlloc.KERNEL32(00000040,?,?,00000008,00000000,00000000,?), ref: 00401E8C
GetPrinterA.WINSPOOL.DRV(?,00000008,00000000,?,?), ref: 00401EAE
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,CutePDF Writer,00000000,00000000,00000000,?,00000008,00000000,?,?), ref: 00401ED5
malloc.MSVCRT ref: 00401EDF
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,CutePDF Writer,00000000,00000000,00000002,74DE8A60), ref: 00401EFB
free.MSVCRT(00000000,00000000,?,CutePDF Writer,00000000,00000000,00000002,74DE8A60), ref: 00401F06
lstrcmpA.KERNEL32(0040A0C8,?,?,00000008,00000000,?,?), ref: 00401F2B
lstrcpynA.KERNEL32(-00000046,?,00000020), ref: 00401F4D
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,CutePDF Writer,00000000,00000000,0000000A), ref: 00401F66
SetPrinterA.WINSPOOL.DRV(?,00000008,00000000,00000000,00000000,?,CutePDF Writer,00000000,00000000,0000000A), ref: 00401F7E
GetPrinterA.WINSPOOL.DRV(?,00000002,00000000,00000000,?), ref: 00401F9D
GlobalAlloc.KERNEL32(00000042,?,?,00000002,00000000,00000000,?), ref: 00401FB1
GlobalLock.KERNEL32(00000000), ref: 00401FC6
GetPrinterA.WINSPOOL.DRV(?,00000002,00000000,?,?), ref: 00401FE8
lstrcmpA.KERNEL32(0040A0BC,?,?,00000002,00000000,?,?), ref: 00402048
lstrcmpA.KERNEL32(Legal,?), ref: 00402063
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,CutePDF Writer,?,?,0000000A), ref: 004020AF
SetPrinterA.WINSPOOL.DRV(?,00000002,00000000,00000000,00000000,?,CutePDF Writer,?,?,0000000A), ref: 004020EC
MessageBoxA.USER32(00000000,OpenPrinter failed,Error,00000000), ref: 00402111
GetLastError.KERNEL32 ref: 00402117
GlobalFree.KERNEL32(00000000), ref: 00402131
GlobalUnlock.KERNEL32(?), ref: 0040213C
GlobalFree.KERNEL32(?), ref: 00402147
ClosePrinter.WINSPOOL.DRV(?), ref: 00402152

Strings

Letter, xrefs: 00401E3B
Legal, xrefs: 0040205E
CutePDF Writer, xrefs: 00401DF9, 00401ECD, 00401EF3, 00401F5E, 004020A7
Installation, xrefs: 00401DB0
(,v, xrefs: 00401D93
Error, xrefs: 004020F8, 00402106
OpenPrinter failed, xrefs: 0040210B
PrintDirectly, xrefs: 00401DAB
SetPrinter failed, xrefs: 004020FD
ISO A0, xrefs: 00401F3A

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: Printer$Global$DocumentPropertieslstrcmp$ErrorLast$AllocFree$CloseLockMessageOpenPrinter.PrivateProfileStringUnlockatoifreelstrcpynmalloc
String ID: (,v$CutePDF Writer$Error$ISO A0$Installation$Legal$Letter$OpenPrinter failed$PrintDirectly$SetPrinter failed
API String ID: 2402571714-2118877239
Opcode ID: 75503b89b8bf10b6e125baf121037e16c851a32dbe7a52c1b8158ee40d99a2eb
Instruction ID: 4719cce639e29d27f48433eb87fd68eabef8179593201b8bcc9831e7b405a2f4
Opcode Fuzzy Hash: 75503b89b8bf10b6e125baf121037e16c851a32dbe7a52c1b8158ee40d99a2eb
Instruction Fuzzy Hash: 4DB12E70604705ABD320DF64CE85F2776E8EB84B44F10452EFA45BB3C1DBB8E8058B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30 Relevance: 6.1, APIs: 4, Instructions: 90
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00406B3A
CoCreateInstance.OLE32(004089E4,00000000,00000001,004089D4,?), ref: 00406B5A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00406BF3
CoUninitialize.OLE32 ref: 00406C20

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: ByteCharCreateInitializeInstanceMultiUninitializeWide
String ID:
API String ID: 2968213145-0
Opcode ID: 577d80921d468578bc781cc3001e6eabf5dd98be83478984f8e4af8e03717aae
Instruction ID: b9c95ce1ecdecc9c74e77de0df7c40d2d2ddf036f2341ec0f675b409868a2add
Opcode Fuzzy Hash: 577d80921d468578bc781cc3001e6eabf5dd98be83478984f8e4af8e03717aae
Instruction Fuzzy Hash: 82315075204211AFC210DB54C948F5B77E8EFC9714F11896CF989EB390DA70EC45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402170 Relevance: 151.0, APIs: 63, Strings: 23, Instructions: 521
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#537.MFC42(Windows NT x86,74DE83C0,6C777310,?,74DE8A60,?,0040741C,000000FF,00405A65,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 004021AB
#860.MFC42(Windows x64,Windows NT x86,74DE83C0,6C777310,?,74DE8A60,?,0040741C,000000FF,00405A65,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 004021C9
#287.MFC42(Windows NT x86,74DE83C0,6C777310,?,74DE8A60,?,0040741C,000000FF,00405A65,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00402228
EnumPrinterDriversA.WINSPOOL.DRV ref: 00402249
GetLastError.KERNEL32 ref: 00402262
#6139.MFC42(00002808,000000FF), ref: 0040227A
EnumPrinterDriversA.WINSPOOL.DRV(00000000,0040741C,00000003,?,?,0040B308,0040B304,00002808,000000FF), ref: 0040229C
lstrcmpA.KERNEL32(0000000B,Apple Color LW 12/660 PS,00000000,0040741C,00000003,?,?,0040B308,0040B304,00002808,000000FF), ref: 004022D5
lstrcmpA.KERNEL32(0000000B,CutePDF Writer v4.0), ref: 004022ED
lstrcpyA.KERNEL32(?,?), ref: 00402322
lstrcpyA.KERNEL32(?,?), ref: 00402336
lstrcpyA.KERNEL32(?,?), ref: 0040234D
lstrcpyA.KERNEL32(?,?), ref: 00402364
GetLastError.KERNEL32(00000000,0040741C,00000003,?,?,0040B308,0040B304,00002808,000000FF), ref: 004023B0
GetPrinterDriverDirectoryA.WINSPOOL.DRV(00000000,0040741C,00000001,?,00000400,eZ@), ref: 004023F5
lstrcatA.KERNEL32(?,0040A29C,00000000,0040741C,00000001,?,00000400,eZ@), ref: 00402423
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?), ref: 00402440
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,0040741C), ref: 00402450
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 0040245C
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,Driver\), ref: 00402468
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,x64\), ref: 00402485
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,0040741C), ref: 00402495
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,?), ref: 004024D3
GetLongPathNameW.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 004024E2
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000001), ref: 004024F4
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00402506
lstrcpyA.KERNEL32(?,?), ref: 00402580
lstrcatA.KERNEL32(?,PSCRIPT5.DLL), ref: 0040258F
lstrcpyA.KERNEL32(?,?), ref: 004025AC
lstrcatA.KERNEL32(?,PS5UI.DLL), ref: 004025BB
lstrcpyA.KERNEL32(?,?), ref: 004025D8
lstrcatA.KERNEL32(?,CUTEPDFW.PPD), ref: 004025E7
AddPrinterDriverA.WINSPOOL.DRV(00000000,00000003,00000003), ref: 00402615
#540.MFC42(00000000,00000003,00000003), ref: 00402640
GetLastError.KERNEL32(00000000,00000003,00000003), ref: 0040264D
#2818.MFC42(0040741C,Install Printer Driver failed. - (Error %d),00000000), ref: 0040265E
#1200.MFC42(?,00000000,00000000,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00402678
#535.MFC42(?,?,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 0040268B
#800.MFC42 ref: 004026A4
#610.MFC42 ref: 004026B5
#800.MFC42 ref: 004026C9
#540.MFC42(00000000,0040741C,00000001,?,00000400,eZ@), ref: 004026F3
GetLastError.KERNEL32(00000000,0040741C,00000001,?,00000400,eZ@), ref: 00402700
#2818.MFC42(0040741C,Get Printer Driver Directory Failed - (Error %d),00000000), ref: 00402711
#1200.MFC42(?,00000000,00000000,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 0040272B
#535.MFC42(?,?,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 0040274D
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,C:\Windows\system32\), ref: 004027D1
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,0040A1E4), ref: 004027E1
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\), ref: 004027ED
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,Driver\), ref: 004027F9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,0040A1E4), ref: 00402809
DeleteFileA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00402818
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000001), ref: 00402826
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00402838
lstrcpyA.KERNEL32(?,C:\Windows\system32\), ref: 0040289A
lstrcatA.KERNEL32(?,PSCRIPT.DRV), ref: 004028A9
lstrcpyA.KERNEL32(?,C:\Windows\system32\), ref: 004028CE
lstrcatA.KERNEL32(?,CUSTPDFW.SPD), ref: 004028DD
AddPrinterDriverA.WINSPOOL.DRV(00000000,00000003,00000400), ref: 0040290B
#1200.MFC42(Install Printer Driver failed.,00000000,00000000,00000000,00000003,00000400), ref: 00402949
#537.MFC42(Install Printer Driver failed.,?,00000000,00000003,00000400), ref: 00402961

Strings

Driver\, xrefs: 0040245E, 004027EF
Install Printer Driver failed. - (Error %d), xrefs: 00402658
PSCRIPT.DRV, xrefs: 0040278F, 004028A3
PSCRIPT5.DLL, xrefs: 004023D5, 00402553, 00402589
CUTEPDFW.PPD, xrefs: 004023CD, 00402563, 004025E1
C:\Windows\system32\, xrefs: 004027C7, 00402894, 004028C0
x64\, xrefs: 0040247B
Windows x64, xrefs: 004021C0
Install Printer Driver failed., xrefs: 00402944, 0040295C
Printer Driver, xrefs: 0040262B, 00402921
C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\, xrefs: 00402452, 004027E3
eZ@, xrefs: 004027D3, 004027FB, 0040280B, 00402845, 004023B6, 004023BA
PS5UI.DLL, xrefs: 004023DD, 0040255B, 004025B5
Windows 4.0, xrefs: 00402885
CutePDF Writer v4.0, xrefs: 004022E0, 00402545, 00402873
Driver Directory, xrefs: 004026DE
C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF, xrefs: 00402457, 00402463, 00402480, 00402490, 004024CE, 004024EF, 004027E8, 004027F4, 00402804, 00402821
eZ@, xrefs: 00402442, 00402473
Windows NT x86, xrefs: 004021A2, 0040287B
CUSTPDFW.SPD, xrefs: 00402787, 004028D7
Get Printer Driver Directory Failed - (Error %d), xrefs: 0040270B
Apple Color LW 12/660 PS, xrefs: 004022CB
C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF, xrefs: 0040243B, 0040244B, 004024DD, 004024EA, 00402501, 004027CC, 004027DC, 00402813, 0040281C, 00402833

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: lstrcpy$lstrcat$Printer$#537ErrorLast$#1200DriverFile$#2818#535#540#800CopyDriversEnumlstrcmp$#287#610#6139#860DeleteDirectoryLongNamePath
String ID: Apple Color LW 12/660 PS$C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\$C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF$C:\Windows\system32\$C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF$CUSTPDFW.SPD$CUTEPDFW.PPD$CutePDF Writer v4.0$Driver Directory$Driver\$Get Printer Driver Directory Failed - (Error %d)$Install Printer Driver failed.$Install Printer Driver failed. - (Error %d)$PS5UI.DLL$PSCRIPT.DRV$PSCRIPT5.DLL$Printer Driver$Windows 4.0$Windows NT x86$Windows x64$eZ@$eZ@$x64\
API String ID: 3177758294-3937672704
Opcode ID: 33eca7d14b1fb2de15631426df39b7fff660995ff53c98059ccafa680b0d0251
Instruction ID: b750509c7e18c34118cc7e56df5f7c78a73d5de3ad112c9fbf5dc5c3e745cbdb
Opcode Fuzzy Hash: 33eca7d14b1fb2de15631426df39b7fff660995ff53c98059ccafa680b0d0251
Instruction Fuzzy Hash: 07129E70218345ABC710DF24C985B6BB7E8AF84744F10493EB985B72D1DBB9A508CB6F

Uniqueness

Uniqueness Score: -1.00%

Function 00402B00 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 278
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,SOFTWARE\GNU Ghostscript), ref: 00402B6E
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 00402B8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402BB6
lstrcpyA.KERNEL32(?,?), ref: 00402BDD
lstrcatA.KERNEL32(?,0040A29C), ref: 00402BE9
lstrcatA.KERNEL32(?,?), ref: 00402BF8
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?), ref: 00402C10
RegQueryValueExA.ADVAPI32(00000001,GS_DLL,00000000,?,?,00000104), ref: 00402C45
strrchr.MSVCRT ref: 00402C56
lstrcatA.KERNEL32(?,gswin32c.exe,?,74DE8A60), ref: 00402C7C
PathFileExistsA.SHLWAPI(?,?,74DE8A60), ref: 00402C83
RegCloseKey.ADVAPI32(?), ref: 00402C9A
RegEnumKeyA.ADVAPI32(?,00000001,?,00000105), ref: 00402CBC
RegCloseKey.ADVAPI32(?), ref: 00402CCF
lstrcpyA.KERNEL32(?,SOFTWARE\GNU Ghostscript), ref: 00402D43
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?), ref: 00402D5E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D89
lstrcpyA.KERNEL32(?,?), ref: 00402DB0
lstrcatA.KERNEL32(?,0040A29C), ref: 00402DBC
lstrcatA.KERNEL32(?,?), ref: 00402DCB
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020119,?), ref: 00402DE3
RegQueryValueExA.ADVAPI32(00000001,GS_DLL,00000000,?,?,00000104), ref: 00402E1C
strrchr.MSVCRT ref: 00402E2D
lstrcatA.KERNEL32(?,gswin64c.exe,?,74DE8A60), ref: 00402E53
PathFileExistsA.SHLWAPI(?,?,74DE8A60), ref: 00402E5A
RegCloseKey.ADVAPI32(?), ref: 00402E71
RegEnumKeyA.ADVAPI32(?,00000001,?,00000105), ref: 00402E93
RegCloseKey.ADVAPI32(?), ref: 00402EA6

Strings

gswin64c.exe, xrefs: 00402E45
GS_DLL, xrefs: 00402C2F, 00402E06
gswin32c.exe, xrefs: 00402C6E
SOFTWARE\GPL Ghostscript, xrefs: 00402B45, 00402D1A
SOFTWARE\Artifex Ghostscript, xrefs: 00402B59, 00402D2E
SOFTWARE\GNU Ghostscript, xrefs: 00402B68, 00402D3D

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: lstrcat$CloseEnumOpenlstrcpy$ExistsFilePathQueryValuestrrchr
String ID: GS_DLL$SOFTWARE\Artifex Ghostscript$SOFTWARE\GNU Ghostscript$SOFTWARE\GPL Ghostscript$gswin32c.exe$gswin64c.exe
API String ID: 2327342233-2555454200
Opcode ID: 01e94ef48441c13f84adf90bc0e4159cd636c7254b5f220a246daebb1cfa6291
Instruction ID: 6a79d8bb59d5d92367294d0efac005ce3136de841c273afaf3e00bcadc9cea83
Opcode Fuzzy Hash: 01e94ef48441c13f84adf90bc0e4159cd636c7254b5f220a246daebb1cfa6291
Instruction Fuzzy Hash: DDA13F711083459BD710CF51DE88FABB7E8EBC8748F00492DF589A61D0E7B4E649CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004059EA Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 118
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1988.MFC42(?,00000001,00000002,00000000,00000000,http://download.cutepdf.com/download/converter2.asp,CUTEPDF_SDK,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004059FD
#690.MFC42(?,00000001,00000002,00000000,00000000,http://download.cutepdf.com/download/converter2.asp,CUTEPDF_SDK,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00405A0C
CreateProcessA.KERNEL32(00000000,unInstcpw64.exe /copy,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00405ACE
GetExitCodeProcess.KERNEL32(?,?), ref: 00405AEF
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405AFB
TerminateProcess.KERNEL32(?,00000000), ref: 00405B0D
CloseHandle.KERNEL32(?), ref: 00405B1D
CloseHandle.KERNEL32(?), ref: 00405B23
lstrcpyA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,C:\Windows\system32\,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405B31
lstrcatA.KERNEL32(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,0040ADC0,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405B3F
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405B4B
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,0040ADC0,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405B59
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\Driver\x64\PSCRIPT.NTF,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,00000000), ref: 00405B67
#537.MFC42(C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405B88
AddMonitorA.WINSPOOL.DRV(00000000,00000002,0040B2F0,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405B9E
AddPortA.WINSPOOL.DRV(00000000,00000000,CutePDF Writer Monitor v4.0,00000000,00000002,0040B2F0,?,?,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00405BCD

Part of subcall function 004014D0: #2446.MFC42(?,00401497,00000000,?,00000000,00407343,000000FF,00405A46,?,00000001,00000002,00000000,00000000,http://download.cutepdf.com/download/converter2.asp,CUTEPDF_SDK,00000001), ref: 004014DA

#665.MFC42(00000000,?), ref: 00406713
#800.MFC42(00000000,?), ref: 0040671F
#800.MFC42(00000000,?), ref: 0040672E

Strings

unInstcpw64.exe /copy, xrefs: 00405AA3
,, xrefs: 00405A08
Monitor, xrefs: 00405BB0
D, xrefs: 00405A85

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: Process$#800CloseHandlelstrcatlstrcpy$#1988#2446#537#665#690CodeCopyCreateExitFileMonitorObjectPortSingleTerminateWait
String ID: ,$D$Monitor$unInstcpw64.exe /copy
API String ID: 2482021425-1468612411
Opcode ID: ccc3aca3723b85a1770c409186ad4fdd3032ab3f7c78d67ecbf042b5eed0dd06
Instruction ID: b58713503e20a73be1be09ca38479d828a82ff03ce6bc0c05199d5dec30b28c7
Opcode Fuzzy Hash: ccc3aca3723b85a1770c409186ad4fdd3032ab3f7c78d67ecbf042b5eed0dd06
Instruction Fuzzy Hash: 0D411270A00319DBDB10DB65DD45FAEB7B8EB44304F1041AAE409B72D1DB786E49CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00402990 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddPrinterA.WINSPOOL.DRV(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,?), ref: 004029F0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,?), ref: 004029FF
#540.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,?), ref: 00402A42
#2818.MFC42(?,?,?,?,?,?,?,?,Install Printer failed. - (Error %d),00000000), ref: 00402A5A
#1200.MFC42(?,00000000,00000000,?,74DE83C0,6C777310), ref: 00402A74
#800.MFC42 ref: 00402AA0

Part of subcall function 00401B70: GetLastError.KERNEL32 ref: 00401BA1
Part of subcall function 00401B70: LoadStringA.USER32(00400000,?,?,000000FF), ref: 00401BD8
Part of subcall function 00401B70: wsprintfA.USER32 ref: 00401BF4
Part of subcall function 00401B70: FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000), ref: 00401C17
Part of subcall function 00401B70: lstrcatA.KERNEL32(?,0040A080), ref: 00401C35
Part of subcall function 00401B70: lstrcatA.KERNEL32(?,?), ref: 00401C41
Part of subcall function 00401B70: LocalHandle.KERNEL32(?), ref: 00401C48
Part of subcall function 00401B70: LocalFree.KERNEL32(00000000), ref: 00401C4F
Part of subcall function 00401B70: #537.MFC42(CutePDF Writer Installation), ref: 00401C5E
Part of subcall function 00401B70: #924.MFC42 ref: 00401C79
Part of subcall function 00401B70: #924.MFC42(?,00000000, Setup), ref: 00401C91
Part of subcall function 00401B70: MessageBoxA.USER32(00000000,?,?,00000000), ref: 00401CA2
Part of subcall function 00401B70: #800.MFC42 ref: 00401CAC
Part of subcall function 00401B70: #800.MFC42 ref: 00401CBD
Part of subcall function 00401B70: #800.MFC42 ref: 00401CD1

DocumentPropertiesA.WINSPOOL.DRV(00000000,00000000,CutePDF Writer,00000000,00000000,0000000A), ref: 00402ACF
ClosePrinter.WINSPOOL.DRV(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,?), ref: 00402AD5

Strings

Install Printer failed. - (Error %d), xrefs: 00402A4C
CutePDF Writer, xrefs: 004029BB, 00402AC7
CPW4:, xrefs: 004029C8
Printer, xrefs: 00402A1C
CutePDF Writer v4.0, xrefs: 004029D0
@, xrefs: 004029E8

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$#924ErrorLastLocalMessagelstrcat$#1200#2818#537#540CloseDocumentFormatFreeHandleLoadPrinterPrinter.PropertiesStringwsprintf
String ID: @$CPW4:$CutePDF Writer$CutePDF Writer v4.0$Install Printer failed. - (Error %d)$Printer
API String ID: 2023788220-459116993
Opcode ID: 7609f579f1f8c0f6c801d22f68279552b14f0034daad6e6674585f44fbb8ea3a
Instruction ID: 2c4190431d00977cd2ec76c07507b67625d1744f062f996fb7d331dd901d11da
Opcode Fuzzy Hash: 7609f579f1f8c0f6c801d22f68279552b14f0034daad6e6674585f44fbb8ea3a
Instruction Fuzzy Hash: 5631CE716487409BD320EB29CD46B4B77E4EB81B08F004A3EFA55B73D1DB7DA4048A9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040701B Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00407048
__p__fmode.MSVCRT ref: 0040705D
__p__commode.MSVCRT ref: 0040706B
__setusermatherr.MSVCRT ref: 00407097
_initterm.MSVCRT ref: 004070AD
__getmainargs.MSVCRT ref: 004070D0
_initterm.MSVCRT ref: 004070E0
GetStartupInfoA.KERNEL32(?), ref: 0040711F
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00407143
exit.KERNELBASE ref: 00407153
_XcptFilter.MSVCRT ref: 00407165

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 114b2d9e56cf77650650ede6c30384414aebd38ea2c78b6ebbdbc6741e2f5ab7
Instruction ID: 354965ad4ac147ccee5601390d6e52e83130000410e48342cdc4d977e8982927
Opcode Fuzzy Hash: 114b2d9e56cf77650650ede6c30384414aebd38ea2c78b6ebbdbc6741e2f5ab7
Instruction Fuzzy Hash: ED413071D44348AFDB219FA5DE45AA97BB8EB49710F20023FE481BB3D1C7785841CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401700 Relevance: 12.1, APIs: 8, Instructions: 58
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42(?,?,?,?,00407358,000000FF), ref: 0040171A
SendMessageA.USER32(?,00000401,00000000,?), ref: 00401752
SendMessageA.USER32(?,00000404,?,00000000), ref: 00401769
SendMessageA.USER32(?,00000402,?,00000000), ref: 00401780
#540.MFC42(?,?,?,?,00407358,000000FF), ref: 00401786
#4160.MFC42(?,?,?,?,?,00407358,000000FF), ref: 0040179E
#6199.MFC42(?,?,?,?,?,?,00407358,000000FF), ref: 004017AA
#800.MFC42(?,?,?,?,?,?,00407358,000000FF), ref: 004017BB

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$#4160#4710#540#6199#800
String ID:
API String ID: 314884432-0
Opcode ID: 0835bf62096d8fa8098e1f3a41c85c7bb9a34adb9d2a41e6e843d0d0d61e6ce3
Instruction ID: ef54a083540e33180788cbb9ab366c0e01cbbad7d05c8b1c74150405483a06c1
Opcode Fuzzy Hash: 0835bf62096d8fa8098e1f3a41c85c7bb9a34adb9d2a41e6e843d0d0d61e6ce3
Instruction Fuzzy Hash: 10118975204701AFD324DB18CC41FA6B7D8FF85710F10492DF6A6972D1CBB8A805C755

Uniqueness

Uniqueness Score: -1.00%

Function 00401670 Relevance: 7.5, APIs: 5, Instructions: 45
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0040168A
#4047.MFC42(?,00000000,74DE8A60,?,?,?,?,?,?,00401658,00000000,00405957,?,00000000), ref: 004016A5
TranslateMessage.USER32(?), ref: 004016B3
DispatchMessageA.USER32(?), ref: 004016BA
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000001), ref: 004016C9

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: Message$Peek$#4047DispatchTranslate
String ID:
API String ID: 389465773-0
Opcode ID: fa5e1466aab27f4d1814a3209106d5c81c66876a95124ea92c737235bef19381
Instruction ID: 7b5d436eddf7fa9fa6e09af2631bbfdef467e0b2260715f9e276b7b62612bdfe
Opcode Fuzzy Hash: fa5e1466aab27f4d1814a3209106d5c81c66876a95124ea92c737235bef19381
Instruction Fuzzy Hash: 19F068727443057BE710DB559D81F67739CAB84B40F44083EFB40E71D0EAB6E50947A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406AB0 Relevance: 7.5, APIs: 5, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?), ref: 00406AC1
SearchPathA.KERNEL32(?,?,00000000,00000104,?,?), ref: 00406AE8
GetLongPathNameW.KERNEL32(?), ref: 00406AF3
GetLastError.KERNEL32 ref: 00406B10
GetLastError.KERNEL32 ref: 00406B17

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastPath$CurrentDirectoryLongNameSearch
String ID:
API String ID: 3892747133-0
Opcode ID: e44f82ae4c6363a1394a9d7fc4378b1f78e28b9359a3bb561582a6fd3a9d61b1
Instruction ID: 6232686625c6391c95254c9431960219dfef42f3817b0d357d372162a62c1828
Opcode Fuzzy Hash: e44f82ae4c6363a1394a9d7fc4378b1f78e28b9359a3bb561582a6fd3a9d61b1
Instruction Fuzzy Hash: D2F02BB05002116BF720DB24DE49FEB3768EF80704F45043DB6C9E21C0E6746808CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00401520 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3744.MFC42(004056DE,00000000,74DE83C0,6C777310,004056DE,00000000,00000000), ref: 0040152B
#4123.MFC42(004056DE,00000000,74DE83C0,6C777310,004056DE,00000000,00000000), ref: 00401539
#2642.MFC42(00000000,004056DE,00000000,74DE83C0,6C777310,004056DE,00000000,00000000), ref: 00401547
#2086.MFC42(00000087,004056DE,004056DE,00000000,74DE83C0,6C777310,004056DE,00000000,00000000), ref: 0040155E

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #2086#2642#3744#4123
String ID:
API String ID: 2549195399-0
Opcode ID: 6740bd1e5b899f00af1b1090d2f18aaf57693b469c5de5e070912d3979171c61
Instruction ID: 68700de469ca1381c0f429183c47e3c3cb6c477a38bb6091bb0b2dff709a6dda
Opcode Fuzzy Hash: 6740bd1e5b899f00af1b1090d2f18aaf57693b469c5de5e070912d3979171c61
Instruction Fuzzy Hash: 95F0123130435026D720766A5911BAB52955FD0758F01443FF547AA2D1EABCD851825D

Uniqueness

Uniqueness Score: -1.00%

Function 00401D10 Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(000000FF,00000000,004073D8,000000FF,00404E82,C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF), ref: 00401D2A
#800.MFC42 ref: 00401D3D
SetFileAttributesA.KERNEL32(?,00000080), ref: 00401D61
#800.MFC42 ref: 00401D73

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800AttributesFile
String ID:
API String ID: 1563251848-0
Opcode ID: 5431e4f2256f5efaa14f0d78609f27a0751074d149cdac8748c1d02205054078
Instruction ID: 9e9c6338060a812b5ad473ab51e2c4839080c93e7557db4f8c1fb61fe9241972
Opcode Fuzzy Hash: 5431e4f2256f5efaa14f0d78609f27a0751074d149cdac8748c1d02205054078
Instruction Fuzzy Hash: F5F04975944781DBC724CF24D945B6AB7A0FB88B24F508F2DF8A6927D0CB3CA508CB06

Uniqueness

Uniqueness Score: -1.00%

Function 0040720E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1576.MFC42(?,?,?,Oq@,0040714F,00000000,?,0000000A), ref: 0040721E

Strings

Oq@, xrefs: 0040720E

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #1576
String ID: Oq@
API String ID: 1976119259-3296664264
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: d2a9ffb94bed7ab24937cca71723ec15cec2c84ee60d20dab01c9ae472c3dc63
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: A9B0083641C386ABDB02DE918841D2EBAA2BB98304F484C5EB2A1101A187769528AB16

Uniqueness

Uniqueness Score: -1.00%

Function 004014D0 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004014F0: #2642.MFC42(00000001,?,004014D8,?,00401497,00000000,?,00000000,00407343,000000FF,00405A46,?,00000001,00000002,00000000,00000000), ref: 00401506

#2446.MFC42(?,00401497,00000000,?,00000000,00407343,000000FF,00405A46,?,00000001,00000002,00000000,00000000,http://download.cutepdf.com/download/converter2.asp,CUTEPDF_SDK,00000001), ref: 004014DA

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #2446#2642
String ID:
API String ID: 1207393836-0
Opcode ID: 81c2018722ce2f372b69367c3601df5b5180c90a917c71944fbc254bc4ed5bbe
Instruction ID: 2d5f188a11bcba43b69e1086af611bed59e337ac8b59332bb0efc98524f60856
Opcode Fuzzy Hash: 81c2018722ce2f372b69367c3601df5b5180c90a917c71944fbc254bc4ed5bbe
Instruction Fuzzy Hash: 7DA01122208030028828322A300288E00AA2A8032820A00AFB8022B2AB8CAC8C8202C8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401B70 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 106
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00401BA1
LoadStringA.USER32(00400000,?,?,000000FF), ref: 00401BD8
wsprintfA.USER32 ref: 00401BF4
FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000), ref: 00401C17
lstrcatA.KERNEL32(?,0040A080), ref: 00401C35
lstrcatA.KERNEL32(?,?), ref: 00401C41
LocalHandle.KERNEL32(?), ref: 00401C48
LocalFree.KERNEL32(00000000), ref: 00401C4F
#537.MFC42(CutePDF Writer Installation), ref: 00401C5E
#924.MFC42 ref: 00401C79
#924.MFC42(?,00000000, Setup), ref: 00401C91
MessageBoxA.USER32(00000000,?,?,00000000), ref: 00401CA2
#800.MFC42 ref: 00401CAC
#800.MFC42 ref: 00401CBD
#800.MFC42 ref: 00401CD1

Strings

Setup, xrefs: 00401C7E
CutePDF Writer Installation, xrefs: 00401C55

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$#924LocalMessagelstrcat$#537ErrorFormatFreeHandleLastLoadStringwsprintf
String ID: Setup$CutePDF Writer Installation
API String ID: 2184859887-1096469731
Opcode ID: e2278c5a5d4afeb93da86548748d2154f929e68e37e400306334ed73999fb94e
Instruction ID: 7aa86855aa269508efce23fd2d0ddd3a1dd509cee125634b75c38574c7081b87
Opcode Fuzzy Hash: e2278c5a5d4afeb93da86548748d2154f929e68e37e400306334ed73999fb94e
Instruction Fuzzy Hash: F0418671254341AFD324DF64CE49FAB77E8EB94B40F00492DF595A32D0DB789904CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004069D0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004069DA
#470.MFC42 ref: 004069EF
SendMessageA.USER32(?,00000027,?,00000000), ref: 00406A0B
GetSystemMetrics.USER32(0000000B), ref: 00406A19
GetSystemMetrics.USER32(0000000C), ref: 00406A1F
GetClientRect.USER32(?,?), ref: 00406A2C
DrawIcon.USER32(?,?,?,?), ref: 00406A64
#755.MFC42 ref: 00406A6E
#2379.MFC42 ref: 00406A7C

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1397574227-0
Opcode ID: d879b027f08574e1370831e48d104a2f8757d4e46faf67bf8673d8be1fa14fa3
Instruction ID: 1ea9796cab01da308e01e71059ea1f404c84152be2f0a2d701165cb0612d0df6
Opcode Fuzzy Hash: d879b027f08574e1370831e48d104a2f8757d4e46faf67bf8673d8be1fa14fa3
Instruction Fuzzy Hash: BE116A712143029FC614DF78ED49E6B77E9BBC8704F094A2DB58AD3290DA34E8058B55

Uniqueness

Uniqueness Score: -1.00%

Function 004019E0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 104stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00401A11
LoadStringA.USER32(00400000,?,?,000000FF), ref: 00401A48
wsprintfA.USER32 ref: 00401A5C
FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000), ref: 00401A7F
lstrcatA.KERNEL32(?,0040A080), ref: 00401A9D
lstrcatA.KERNEL32(?,?), ref: 00401AA9
LocalHandle.KERNEL32(?), ref: 00401AB0
LocalFree.KERNEL32(00000000), ref: 00401AB7
#537.MFC42(CutePDF Writer Installation), ref: 00401AC6
#924.MFC42 ref: 00401AE1
#924.MFC42(?,00000000, Setup), ref: 00401AF9
MessageBoxA.USER32(00000000,?,?,00000000), ref: 00401B0A
#800.MFC42 ref: 00401B14
#800.MFC42 ref: 00401B25
#800.MFC42 ref: 00401B39

Strings

Setup, xrefs: 00401AE6
CutePDF Writer Installation, xrefs: 00401ABD

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$#924LocalMessagelstrcat$#537ErrorFormatFreeHandleLastLoadStringwsprintf
String ID: Setup$CutePDF Writer Installation
API String ID: 2184859887-1096469731
Opcode ID: aa4686f22db2627a195e1c69ad12bdc3aae08eb6d589d2b61334a61beaf9b9a2
Instruction ID: 22dd761dcff60a6e0a4b8bf0f16667b0d6d463c27fa9f57a66f0b299cec9e947
Opcode Fuzzy Hash: aa4686f22db2627a195e1c69ad12bdc3aae08eb6d589d2b61334a61beaf9b9a2
Instruction Fuzzy Hash: 19418471644341AFD324DF64DD49FAB77E8EB84B40F00492DF589A32D0DB789908CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401210 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

#540.MFC42 ref: 00401232
#2919.MFC42(00000105), ref: 00401246
#537.MFC42(Select Folder,00000105), ref: 00401263
SHBrowseForFolderA.SHELL32(?), ref: 00401296
#5572.MFC42(000000FF), ref: 004012A4
#540.MFC42(000000FF), ref: 004012B1
#2919.MFC42(00000105,000000FF), ref: 004012C4
SHGetPathFromIDListA.SHELL32(00000000,00000000,00000105,000000FF), ref: 004012CB
#5572.MFC42(000000FF), ref: 004012D7
#6199.MFC42(?,000000FF), ref: 004012E4
#858.MFC42(?,?,000000FF), ref: 004012F0
#800.MFC42(?,?,000000FF), ref: 004012FE
#800.MFC42(000000FF), ref: 0040130B
#800.MFC42(000000FF), ref: 0040131C

Strings

Select Folder, xrefs: 0040124E

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$#2919#540#5572$#537#6199#858BrowseFolderFromListPath
String ID: Select Folder
API String ID: 3742369913-3191896865
Opcode ID: 3db9f73b37db8b992f3c9f1de9b6c84d864c71dbaf72014f98a59c66c82ea453
Instruction ID: 55f8b6fb7b02363fc304a451003e4637059dc9beaa705180198715c8cfb64519
Opcode Fuzzy Hash: 3db9f73b37db8b992f3c9f1de9b6c84d864c71dbaf72014f98a59c66c82ea453
Instruction Fuzzy Hash: F8318D702083419FC314EF65C981A9BBBE4BF99714F400A2EF4E6632D1DB789908CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00402EF0 Relevance: 24.1, APIs: 16, Instructions: 74COMMON

Download Yara Rule

APIs

#561.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F12
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F27
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F39
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F49
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F5B
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F6B
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F7B
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F8B
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402F9B
#540.MFC42(00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402FAB
#860.MFC42(0040AEE0,00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402FC2
#860.MFC42(0040AEE0,0040AEE0,00000000,?,?,?,?,?,?,004074D6,000000FF), ref: 00402FD2
#860.MFC42 ref: 00402FE8
#860.MFC42(0040AEE0), ref: 00402FF4
#860.MFC42(0040AEE0,0040AEE0), ref: 00403004
#860.MFC42(0040AEE0,0040AEE0,0040AEE0), ref: 00403014

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #540$#860$#561
String ID:
API String ID: 1562558846-0
Opcode ID: f51df5323204980bd643962e8fdf97c799ccae8f56df1bd93b63a817aa1bffcc
Instruction ID: cdeb4bf7faff0ee5c276d9eb42d5cc38f5551355fdace928ecaf3b8920230128
Opcode Fuzzy Hash: f51df5323204980bd643962e8fdf97c799ccae8f56df1bd93b63a817aa1bffcc
Instruction Fuzzy Hash: 16314431244B808ED315EB66C451F9EB7E4AF50708F45492EE49B222C2DBBD651CCBAB

Uniqueness

Uniqueness Score: -1.00%

Function 004068E0 Relevance: 19.6, APIs: 13, Instructions: 72windowCOMMON

Download Yara Rule

APIs

#4710.MFC42 ref: 004068FB
#354.MFC42 ref: 00406904
#5186.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,00407808,000000FF), ref: 00406920
#3318.MFC42 ref: 00406930
#823.MFC42(00000001), ref: 0040693B
#5442.MFC42(00000000,00000000), ref: 0040694B
#1979.MFC42(00000000,00000000), ref: 00406954
#6199.MFC42(00000000,00000000,00000000), ref: 00406963
SendMessageA.USER32(?,000000B1,000000FF,00000000), ref: 0040697B
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040698A
#825.MFC42(00000000), ref: 0040698D
#5981.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,00407808,000000FF), ref: 0040699B
#665.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,00407808,000000FF), ref: 004069AC

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$#1979#3318#354#4710#5186#5442#5981#6199#665#823#825
String ID:
API String ID: 755832598-0
Opcode ID: 76da5af151191c35b2b8ece45a74353637583bde36d67c784f7e5bf9ff268b8d
Instruction ID: b0c645bb2caeb20bc63cb1118dbf86a39bb7d0fc124742d817d6efcf9d1d48b1
Opcode Fuzzy Hash: 76da5af151191c35b2b8ece45a74353637583bde36d67c784f7e5bf9ff268b8d
Instruction Fuzzy Hash: E621F272204341ABC310EB25CC42FAB7394BF84710F410A3EF556672C1EB38A514C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004067C0 Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

#324.MFC42(00000066,004077EF,?,CutePDF Writer Installation,?,00000001,004077EF,000000FF,004044E8,00000000,?), ref: 004067E5
#567.MFC42(00000066,004077EF,?,CutePDF Writer Installation,?,00000001), ref: 004067F7
#540.MFC42(00000066,004077EF,?,CutePDF Writer Installation,?,00000001), ref: 0040680F
#540.MFC42(00000066,004077EF,?,CutePDF Writer Installation,?,00000001), ref: 0040681F
#860.MFC42(0040AEE0,00000066,004077EF,?,CutePDF Writer Installation,?), ref: 00406836
#1168.MFC42(0040AEE0,00000066,004077EF,?,CutePDF Writer Installation,?), ref: 0040683B
#1146.MFC42(00000080,0000000E,00000080,0040AEE0,00000066,004077EF,?,CutePDF Writer Installation,?), ref: 0040684C
LoadIconA.USER32(00000000,00000080), ref: 00406852

Strings

D@, xrefs: 00406858
CutePDF Writer Installation, xrefs: 004067DA

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #540$#1146#1168#324#567#860IconLoad
String ID: CutePDF Writer Installation$D@
API String ID: 2528081515-3326461587
Opcode ID: 85aa49dc53db3e99196be9c2e5a6eae322b7c8df5d89d2ef981a0f24501f5732
Instruction ID: 3ed91608fc05b2beff7cff0b8cbe20e009afd6bd3a992cc10d57ac92c84cac80
Opcode Fuzzy Hash: 85aa49dc53db3e99196be9c2e5a6eae322b7c8df5d89d2ef981a0f24501f5732
Instruction Fuzzy Hash: 19118B713487419FD310EF29C906B5ABAE5EF85B14F00492EF486B72C1DBB8651887A7

Uniqueness

Uniqueness Score: -1.00%

Function 00403050 Relevance: 15.0, APIs: 10, Instructions: 44COMMON

Download Yara Rule

APIs

#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 0040307B
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 0040308B
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 0040309B
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 004030AB
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 004030BB
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 004030CB
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 004030DB
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 004030EB
#800.MFC42(?,?,?,00407558,000000FF,00403038), ref: 004030FB
#815.MFC42(?,?,?,00407558,000000FF,00403038), ref: 0040310A

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$#815
String ID:
API String ID: 2601827922-0
Opcode ID: 39847f59ee84c53797984ff1ea261def27471edd6986ddfda536412000a73b8d
Instruction ID: 5f77c12b297e3e633766960cc8d84ff5ffa33876a0961853dc5944faaba64c5d
Opcode Fuzzy Hash: 39847f59ee84c53797984ff1ea261def27471edd6986ddfda536412000a73b8d
Instruction Fuzzy Hash: 051119341097C18BD325EB78C419BDABBD0BF65314F454E5EF4AB222C2DBB86218C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401930 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

#941.MFC42 ref: 00401959
#354.MFC42 ref: 00401962
#5186.MFC42(C:\Program Files (x86)\CutePDF Writer\Error.log,0000B001,00000000), ref: 0040197C
#6385.MFC42(?,?), ref: 004019A1
#1979.MFC42(?,?), ref: 004019AA
#665.MFC42(C:\Program Files (x86)\CutePDF Writer\Error.log,0000B001,00000000), ref: 004019B8
#800.MFC42(C:\Program Files (x86)\CutePDF Writer\Error.log,0000B001,00000000), ref: 004019C9

Strings

C:\Program Files (x86)\CutePDF Writer\Error.log, xrefs: 0040196E

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #1979#354#5186#6385#665#800#941
String ID: C:\Program Files (x86)\CutePDF Writer\Error.log
API String ID: 3394760476-2486716184
Opcode ID: 5406ab26d08d73df548f2d62c29b72d6d521b04aff2419e90e019690e864bf1d
Instruction ID: 096b1710577c9699cbbfff19992dc2114f496b741d3af094a50c70212c00e589
Opcode Fuzzy Hash: 5406ab26d08d73df548f2d62c29b72d6d521b04aff2419e90e019690e864bf1d
Instruction Fuzzy Hash: 53115E38148381AFD304EF15C856B5AB7E1BB94704F404A2DF49A662D1DB7C9618CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00401160 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

#540.MFC42(?,?,?,004072C8,000000FF), ref: 0040117D
#3874.MFC42(?,?,?,?,004072C8,000000FF), ref: 00401192
#1200.MFC42(Please enter a destination folder.,00000030,00000000,?,?,?,?,004072C8,000000FF), ref: 004011AB
#4853.MFC42(?,?,?,?,004072C8,000000FF), ref: 004011B4
#800.MFC42(?,?,?,?,004072C8,000000FF), ref: 004011C5

Strings

Please enter a destination folder., xrefs: 004011A6

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #1200#3874#4853#540#800
String ID: Please enter a destination folder.
API String ID: 3185021675-1563870553
Opcode ID: fcec0907769d5af9916ee71ac4a5a1acf91c4275043d949b7d7e64b13fe4f0fd
Instruction ID: d82d8f0d4097ba553b9c3f614d3301fcdf70cd4829da0e5d5ba23e015037715e
Opcode Fuzzy Hash: fcec0907769d5af9916ee71ac4a5a1acf91c4275043d949b7d7e64b13fe4f0fd
Instruction Fuzzy Hash: 79F0AF31208740ABC318DF15C942F9AB3E4EF84B28F044A2FF056662C0DB7CAD04C756

Uniqueness

Uniqueness Score: -1.00%

Function 00401860 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 004018AD
VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003), ref: 004018B5
VerSetConditionMask.KERNEL32(00000000,?,00000020,00000003,?,00000001,00000003), ref: 004018BD
VerSetConditionMask.KERNEL32(00000000,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 004018C5
VerSetConditionMask.KERNEL32(00000000,?,00000080,00000001,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 004018D0
VerifyVersionInfoA.KERNEL32(00000002,000000B3,00000000), ref: 004018DE

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: e482e47ed448837903283724e169a3307169754414def2ad42443d378134382a
Instruction ID: ec972a6d73d8e05d6fc9688b0612f1c4a7402a592363596131e6097bdda6504f
Opcode Fuzzy Hash: e482e47ed448837903283724e169a3307169754414def2ad42443d378134382a
Instruction Fuzzy Hash: 130117B1A44354BDF7319B65DC1AF6B7EACDBC4B10F00481D7288A61C1D7F556084BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

#324.MFC42(00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00401028
#567.MFC42(00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 0040103A
#540.MFC42(00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308,0040B304), ref: 00401052
#860.MFC42(0040AEE0,00000084,?,?,CutePDF Writer Installation,?,00000000,00407291,000000FF,00404626,00000000,00000000,00000001,http://www.CutePDF.com,00001000,0040B308), ref: 00401069

Strings

CutePDF Writer Installation, xrefs: 0040101A

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #324#540#567#860
String ID: CutePDF Writer Installation
API String ID: 2163162707-1111107578
Opcode ID: 057fa346579295fadcba27e1cfa20ca8c2dca6764510885ce17c0bd16de2f6f7
Instruction ID: 40bca056ad49bbe782312b109ea7969f31828558cd024cf0c399f81e75e515e0
Opcode Fuzzy Hash: 057fa346579295fadcba27e1cfa20ca8c2dca6764510885ce17c0bd16de2f6f7
Instruction Fuzzy Hash: E2F06971344B829BD311DF19C901B6ABBE5EF91B14F04092EF4826B3C1CBBC591887A7

Uniqueness

Uniqueness Score: -1.00%

Function 00401800 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 0040181A
GetProcAddress.KERNEL32(00000000), ref: 00401821

Strings

IsWow64Process, xrefs: 00401810
kernel32, xrefs: 00401815

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 7b41c7214edfd6c68295821b3c47f5b4ebe68cb1c563a58c413f6b8d807f78d8
Instruction ID: d6e938eafbff5f71d3a53cf51fdd6d1eaf61e4bb4fdb3b788a0fcf30e2899d41
Opcode Fuzzy Hash: 7b41c7214edfd6c68295821b3c47f5b4ebe68cb1c563a58c413f6b8d807f78d8
Instruction Fuzzy Hash: 31C09BB154070497C7003FB45F4D6173754B5857457154D3A7541B11E0CF7D015CAA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00406750 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

#800.MFC42(?,?,?,004077B1,000000FF), ref: 0040677B
#800.MFC42(?,?,?,004077B1,000000FF), ref: 0040678B
#656.MFC42(?,?,?,004077B1,000000FF), ref: 00406798
#641.MFC42(?,?,?,004077B1,000000FF), ref: 004067A7

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #800$#641#656
String ID:
API String ID: 3429618757-0
Opcode ID: 6623a5cd516ac7cef95ba1ea4b29aeaf0505a6fa86fbab1f165dab764b03a44b
Instruction ID: f985799a669a011473c5a71bc2226911093d01ef95bf3fc474e4c221f116d1df
Opcode Fuzzy Hash: 6623a5cd516ac7cef95ba1ea4b29aeaf0505a6fa86fbab1f165dab764b03a44b
Instruction Fuzzy Hash: 61F01775208B919BC324DF28C40579ABBD4BF85B24F400E1EF4A6537C1CBB86608C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 004059B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

#2393.MFC42 ref: 004059CA
#1200.MFC42(No Internet connection was found. Please check your Internet settings or Firewall.,00000030,00000000), ref: 004059DF

Strings

No Internet connection was found. Please check your Internet settings or Firewall., xrefs: 004059DA

Memory Dump Source

Source File: 00000003.00000002.2051544884.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2051517603.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051572610.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051611524.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2051634786.000000000040D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Setup.jbxd

Similarity

API ID: #1200#2393
String ID: No Internet connection was found. Please check your Internet settings or Firewall.
API String ID: 1583423568-2812112891
Opcode ID: e6557c39167ebc911a347429782d1d160181728085536d9a8f0e90470674f83b
Instruction ID: 5a7406ad2e77dc036f7ef3614f379515f0fce0d0daf6daa5267a6329bb6c932c
Opcode Fuzzy Hash: e6557c39167ebc911a347429782d1d160181728085536d9a8f0e90470674f83b
Instruction Fuzzy Hash: DAE08C7074061097DF14DA80C806B9F63A8AF84B04F100066F201BB2C0C678AD408B9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: converter.exePID: 2416, Parent PID: 6500COMMON

Execution Graph

Execution Coverage:	42.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	723
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00403DAF Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141
stringfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WZSE0.TMP,?,00000000), ref: 00403DDD
lstrcpyA.KERNEL32(?,?), ref: 00403DF4

Part of subcall function 00401163: lstrlenA.KERNEL32(?,?,0040290B), ref: 0040116E
Part of subcall function 00401163: lstrcatA.KERNEL32(?,004089EC,?,0040290B), ref: 00401188

lstrcatA.KERNEL32(?,*.*), ref: 00403E13
FindFirstFileA.KERNELBASE(?,?), ref: 00403E27
lstrcpyA.KERNEL32(?,?), ref: 00403E49
lstrcatA.KERNEL32(?,00000000), ref: 00403E79
RemoveDirectoryA.KERNEL32(?), ref: 00403EFE
GetTickCount.KERNEL32 ref: 00403F08
GetTickCount.KERNEL32 ref: 00403F10

Part of subcall function 00403BF6: SetFileAttributesA.KERNELBASE("?@,00000080,00403F22,?), ref: 00403BFF
Part of subcall function 00403BF6: DeleteFileA.KERNELBASE(?), ref: 00403C09

Part of subcall function 00402366: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0040237F
Part of subcall function 00402366: TranslateMessage.USER32(?), ref: 0040238F
Part of subcall function 00402366: DispatchMessageA.USER32(?), ref: 00402399

FindNextFileA.KERNELBASE(?,00000010), ref: 00403F4B
FindClose.KERNEL32(?), ref: 00403F5C
RemoveDirectoryA.KERNELBASE(?), ref: 00403F65
MessageBoxA.USER32(00000000,00000018,WinZip Self-Extractor,00000000), ref: 00403F82

Strings

WinZip Self-Extractor, xrefs: 00403F6F
C:\Users\user\AppData\Local\Temp\WZSE0.TMP, xrefs: 00403DC1
*.*, xrefs: 00403E0D

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: FileMessage$Findlstrcat$CountDirectoryRemoveTicklstrcpylstrlen$AttributesCloseDeleteDispatchFirstNextPeekTranslate
String ID: *.*$C:\Users\user\AppData\Local\Temp\WZSE0.TMP$WinZip Self-Extractor
API String ID: 2847190762-1084187013
Opcode ID: a12f470275ca1195b33305c0bcaa1412206aa410da3ea4ba5ae3ce9c40a32124
Instruction ID: 8a54cfebac305643a857665ad0f993f3ddfe3de3af60bb38b325486f1a912918
Opcode Fuzzy Hash: a12f470275ca1195b33305c0bcaa1412206aa410da3ea4ba5ae3ce9c40a32124
Instruction Fuzzy Hash: 05419032D0421AAACF249FA0DD49BDA7B7CAB05315F1041BBF545F21D0DB78AB848F99

Uniqueness

Uniqueness Score: -1.00%

Function 00403285 Relevance: 4.5, APIs: 3, Instructions: 22filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(0040359B,?,74DF05F0), ref: 00403299

Part of subcall function 0040172F: lstrlenA.KERNEL32(0040359B,00000000,004032B5,0040359B,?), ref: 00401735

lstrcpyA.KERNEL32(00000000,0040359B,?), ref: 004032B6
FindClose.KERNELBASE(00000000), ref: 004032BD

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Find$CloseFileFirstlstrcpylstrlen
String ID:
API String ID: 629893220-0
Opcode ID: 07b1f4abdd198bb8fa76100be7e52f431baed37c6eaae601fb4f40319b3e4700
Instruction ID: 30aa0d5725b3912b5722713ac6479075cd09910d782a80870a0efa643aa329ab
Opcode Fuzzy Hash: 07b1f4abdd198bb8fa76100be7e52f431baed37c6eaae601fb4f40319b3e4700
Instruction Fuzzy Hash: E4E04F31800028ABCB116B65DD098DE7E7CEB08350F0042B1FE1AA20F0D7349A458AA6

Uniqueness

Uniqueness Score: -1.00%

Function 004010A3 Relevance: 3.0, APIs: 2, Instructions: 26fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(0040259B,?), ref: 004010B6
FindClose.KERNELBASE(00000000), ref: 004010DB

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d6ab31690d23e1b7ad007466404be21279f07f2bd9f3b43b3f02c5fc57059aa7
Instruction ID: 073fbb493f2209d62c9f6e2ff4371d1fb9e839daf83188df313da38a510170e3
Opcode Fuzzy Hash: d6ab31690d23e1b7ad007466404be21279f07f2bd9f3b43b3f02c5fc57059aa7
Instruction Fuzzy Hash: FDE0D830A0024997DB318F35DC0579B7BA9BF04314F144775F955EB6E0D7B1E8C04A54

Uniqueness

Uniqueness Score: -1.00%

Function 00402658 Relevance: 170.4, APIs: 90, Strings: 7, Instructions: 675
windowstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastActivePopup.USER32(?), ref: 004026BB
GetDlgItem.USER32(?,000000C9), ref: 004026D5
KillTimer.USER32(?,00000045), ref: 004026E4
GetDlgItem.USER32(?,0000006D), ref: 0040271F
ShowWindow.USER32(00000000,00000000), ref: 0040272D
ShowWindow.USER32(00000000,00000005), ref: 0040273C
InvalidateRect.USER32(00000000,00000000,00000000), ref: 00402741
MessageBoxA.USER32(?,00000000,00000024,WinZip Self-Extractor), ref: 00402786
PostMessageA.USER32(?,00000111,00000001,00000000), ref: 004027A7
lstrlenA.KERNEL32(Acro Software Inc.), ref: 004027B7
wsprintfA.USER32 ref: 004027EA
wsprintfA.USER32 ref: 004027FD
MessageBoxA.USER32(00000000,0000000C,WinZip Self-Extractor,00000124), ref: 00402841
wsprintfA.USER32 ref: 0040286C
MessageBoxA.USER32(?,WinZip Self-Extractor,00000124), ref: 0040288A
EndDialog.USER32(?,00000001), ref: 004028A8
MessageBoxA.USER32(00000000,0000000B,WinZip Self-Extractor,00000024), ref: 004028D4
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP), ref: 004028FA
lstrcatA.KERNEL32(00408ADC), ref: 00402917
GetDlgItem.USER32(?,0000006D), ref: 00402930
ShowWindow.USER32(00000000,00000005), ref: 0040293D
SetDlgItemTextA.USER32(?,0000006D,00000000), ref: 0040294E
UpdateWindow.USER32(?), ref: 00402955
EndDialog.USER32(?,00000001), ref: 0040296C
PostMessageA.USER32(?,00000111,00000002,00000000), ref: 00402983
GetDlgItem.USER32(?,00000001), ref: 0040298E
EnableWindow.USER32(00000000), ref: 00402995
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 004029D2
SendDlgItemMessageA.USER32(?,00000001,000000F4,00000000,00000001), ref: 004029E4
SendDlgItemMessageA.USER32(?,00000002,000000F4,00000001,00000001), ref: 004029EE
GetDlgItem.USER32(?,00000001), ref: 004029FA
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004029FD
GetTopWindow.USER32(00000000), ref: 00402A22
MessageBoxA.USER32(00000000), ref: 00402A29
GetDlgItem.USER32(?,00000001), ref: 00402A44
EnableWindow.USER32(00000000), ref: 00402A47
GetDlgItem.USER32(?,000000C9), ref: 00402A59
SendDlgItemMessageA.USER32(?,000000C9,00000402,00000000,00000000), ref: 00402A76
SendDlgItemMessageA.USER32(?,000000C9,00000400,00000064,00000000), ref: 00402A82
SetTimer.USER32(?,00000045,0000000A,00000000), ref: 00402AAE
GetDlgItem.USER32(?,0000006D), ref: 00402AC0
ShowWindow.USER32(00000000,00000000), ref: 00402ACC
ShowWindow.USER32(?,00000005), ref: 00402AD8
KillTimer.USER32(?,00000045), ref: 00402B0E
GetDlgItem.USER32(?,000000C9), ref: 00402B1C
SendDlgItemMessageA.USER32(?,000000C9,00000402,00000064,00000000), ref: 00402B30
InvalidateRect.USER32(00000000,00000000), ref: 00402B40
UpdateWindow.USER32 ref: 00402B48
ShowWindow.USER32(?,00000000), ref: 00402B61
InvalidateRect.USER32(00000000,00000000), ref: 00402B6F
UpdateWindow.USER32 ref: 00402B77
SetDlgItemTextA.USER32(?,0000006D,00408EC0), ref: 00402B8B
WaitForSingleObject.KERNEL32(?,00000032), ref: 00402BF5
SetDlgItemTextA.USER32(?,00000001,00000000), ref: 00402C20
GetDlgItem.USER32(?,00000001), ref: 00402C25
EnableWindow.USER32(00000000), ref: 00402C2C
GetTickCount.KERNEL32 ref: 00402C73
GetTickCount.KERNEL32 ref: 00402C79
GetTickCount.KERNEL32 ref: 00402C95
MessageBoxA.USER32(00000000,00000012,WinZip Self-Extractor,00000010), ref: 00402CC5
MessageBoxA.USER32(00000000,00000018,WinZip Self-Extractor,00000000), ref: 00402CEE
SetDlgItemTextA.USER32(0000006D,00000000,00000016), ref: 00402D16
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00402D1B
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 00402D46
GetWindowRect.USER32(?,?), ref: 00402D52
GetSystemMetrics.USER32(00000001), ref: 00402D64
GetSystemMetrics.USER32(00000000), ref: 00402D77
SetWindowPos.USER32(?,00000000,00000000), ref: 00402D8B
GetDlgItem.USER32(?,00000073), ref: 00402D9A
DestroyWindow.USER32(00000000), ref: 00402D9D
GetDlgItem.USER32(?,000000C9), ref: 00402DA9
ShowWindow.USER32(00000000,00000000), ref: 00402DB1
SendDlgItemMessageA.USER32(?,00000078,00000170,0020018F,00000000), ref: 00402DCA
GetWindowLongA.USER32(?,000000EC), ref: 00402DD9
SetWindowLongA.USER32(?,000000EC,00000000), ref: 00402DEA
GetWindowLongA.USER32(?,000000F0), ref: 00402DEF
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00402DFA
SendMessageA.USER32(?,00000080,00000001), ref: 00402E0A
SetDlgItemTextA.USER32(?,00000065,C:\Users\user\AppData\Local\Temp\converter.exe), ref: 00402E37
wsprintfA.USER32 ref: 00402E4C
SetWindowTextA.USER32(?,?), ref: 00402E64
SetDlgItemTextA.USER32(?,00000070,&Info...), ref: 00402E77
SetWindowTextA.USER32(?,00CA2430), ref: 00402E94
PostMessageA.USER32(?,00000111,00000001,00000000), ref: 00402EBD
KiUserCallbackDispatcher.NTDLL(?), ref: 00402EC4
SetActiveWindow.USER32(?), ref: 00402ECB
GetDlgItem.USER32(?,00000065), ref: 00402F02
SendMessageA.USER32(00000000,00000030,00000001), ref: 00402F19
GetDlgItem.USER32(?,0000006D), ref: 00402F24
SendMessageA.USER32(00000000,00000030,00000001), ref: 00402F39

Strings

WinZip Self-Extractor, xrefs: 00402772, 0040280D, 0040282E, 0040287E, 004028C1, 00402A14, 00402CB2, 00402CDB, 00402E3A
%s - %s, xrefs: 00402E46
&Info..., xrefs: 00402E6F
Acro Software Inc., xrefs: 004027B2, 00402E96
C:\Users\user\AppData\Local\Temp\WZSE0.TMP, xrefs: 004028E8, 004028F3, 00402961, 00402A03, 00402B97, 00402BA3, 00402CFA
E, xrefs: 004026AA
C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 00402E10

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Item$Window$Message$Send$Text$Show$LongRectwsprintf$CallbackCountDispatcherEnableInvalidatePostTickTimerUpdateUser$ActiveDialogKillMetricsSystem$DestroyLastObjectPopupSingleWaitlstrcatlstrcpylstrlen
String ID: %s - %s$&Info...$Acro Software Inc.$C:\Users\user\AppData\Local\Temp\WZSE0.TMP$C:\Users\user\AppData\Local\Temp\converter.exe$E$WinZip Self-Extractor
API String ID: 2793805002-2894930492
Opcode ID: f93c9282de380c92ce05f0f733496e39b6d65bb490806e5a7b4a060b352a6621
Instruction ID: 793da8a52999b2238accc69d7200b2cfb8b06d40db17603f90b8ba6b02d20f23
Opcode Fuzzy Hash: f93c9282de380c92ce05f0f733496e39b6d65bb490806e5a7b4a060b352a6621
Instruction Fuzzy Hash: 37228171658244BBE7216B60DF8DF6B3A69EB45744F14003EF680B92E1CBF95C40CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403366 Relevance: 140.4, APIs: 74, Strings: 6, Instructions: 406
memorywindowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetACP.KERNEL32(?,?,00000022), ref: 00403372
lstrcpyA.KERNEL32(?,Helv,?,?,00000022), ref: 004033FB
CreateFontIndirectA.GDI32(0000000E), ref: 0040340B
LoadCursorA.USER32(00000000,00007F02), ref: 00403427
LoadCursorA.USER32(00000000,00007F00), ref: 00403434
GetModuleFileNameA.KERNEL32(?,?,00000200,?,?,00000022), ref: 0040344B
lstrlenA.KERNEL32(?,?,?,00000022), ref: 0040345C
SetCurrentDirectoryA.KERNELBASE(?,?,?,00000022), ref: 0040347B
SetErrorMode.KERNELBASE(00008001,?,?,00000022), ref: 0040348C
GetVersion.KERNEL32(?,?,00000022), ref: 00403492
LoadLibraryA.KERNEL32(Shell32.dll,?,?,00000022), ref: 004034A0
GetProcAddress.KERNEL32(00000000,ShellExecuteEx), ref: 004034BE
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,00000022), ref: 004034DC
FormatMessageA.KERNEL32(00001100,00000000,00000000,?,?,00000022), ref: 004034E9
MessageBoxA.USER32(00000000,?,WinZip Self-Extractor,00000040), ref: 004034FA
LocalFree.KERNEL32(?,?,?,00000022), ref: 00403503
GlobalAlloc.KERNEL32(00000040,00000101,?,?,00000022), ref: 00403517
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 00403520
GlobalAlloc.KERNEL32(00000040,00000041,?,?,00000022), ref: 0040352B
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040352E
GlobalAlloc.KERNEL32(00000040,00000101,?,?,00000022), ref: 00403538
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040353B
GlobalAlloc.KERNEL32(00000040,00000101,?,?,00000022), ref: 00403547
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040354A
GlobalAlloc.KERNEL32(00000040,00000200,?,?,00000022), ref: 00403557
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040355A
GlobalAlloc.KERNEL32(00000040,00000204,?,?,00000022), ref: 00403567
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040356A
GlobalAlloc.KERNEL32(00000040,000001F4,?,?,00000022), ref: 00403577
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040357A
GetModuleFileNameA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\converter.exe,00000105,?,?,00000022), ref: 0040358F
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\converter.exe,C:\Users\user\AppData\Local\Temp\converter.exe,?,?,00000022), ref: 0040359E
__setjmp3.LIBCMT ref: 004035AB
MessageBoxA.USER32(00000000,00000000,WinZip Self-Extractor,00000010), ref: 0040366D
MessageBoxA.USER32(00000000,00000000,WinZip Self-Extractor,0000080A), ref: 004036FE
LocalFree.KERNEL32(?,?,00000022), ref: 0040371C
GlobalAlloc.KERNEL32(00000042,00000400,80000000,?,?,00000022), ref: 00403745
GlobalLock.KERNEL32(00000000,?,?,00000022), ref: 0040374A
DialogBoxIndirectParamA.USER32(80000000,?,00000000,00402658,00000000), ref: 0040378A
GlobalUnlock.KERNEL32(00000000,?,?,00000400,?,?,00000022), ref: 00403791
GlobalFree.KERNEL32(00000000), ref: 00403794
GlobalHandle.KERNEL32 ref: 004037A7
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 004037AA
GlobalHandle.KERNEL32 ref: 004037B2
GlobalFree.KERNEL32(00000000), ref: 004037B5
GlobalHandle.KERNEL32 ref: 004037BD
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 004037C0
GlobalHandle.KERNEL32 ref: 004037C8
GlobalFree.KERNEL32(00000000), ref: 004037CB
GlobalHandle.KERNEL32 ref: 004037D3
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 004037D6
GlobalHandle.KERNEL32 ref: 004037DE
GlobalFree.KERNEL32(00000000), ref: 004037E1
GlobalHandle.KERNEL32 ref: 004037E9
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 004037EC
GlobalHandle.KERNEL32 ref: 004037F4
GlobalFree.KERNEL32(00000000), ref: 004037F7
GlobalHandle.KERNEL32 ref: 004037FF
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 00403802
GlobalHandle.KERNEL32 ref: 0040380A
GlobalFree.KERNEL32(00000000), ref: 0040380D
GlobalHandle.KERNEL32 ref: 00403815
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 00403818
GlobalHandle.KERNEL32 ref: 00403820
GlobalFree.KERNEL32(00000000), ref: 00403823
GlobalHandle.KERNEL32 ref: 0040382B
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 0040382E
GlobalHandle.KERNEL32 ref: 00403836
GlobalFree.KERNEL32(00000000), ref: 00403839
GlobalHandle.KERNEL32(00CC40B8), ref: 00403845
GlobalUnlock.KERNEL32(00000000,?,?,00000022), ref: 00403848
GlobalHandle.KERNEL32 ref: 00403850
GlobalFree.KERNEL32(00000000), ref: 00403853
FreeLibrary.KERNEL32(75DA0000,?,?,00000022), ref: 0040385F

Strings

WinZip Self-Extractor, xrefs: 004034F1, 004035CA, 004035F7, 00403636, 0040365B, 004036F5
Shell32.dll, xrefs: 00403498
ShellExecuteEx, xrefs: 004034B8
Helv, xrefs: 004033DC
C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 0040357C, 00403586, 00403595, 0040359C, 0040359D
-info, xrefs: 004035E0

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Global$Handle$Free$Unlock$AllocLock$Message$Load$CursorErrorFileIndirectLibraryLocalModuleNamelstrcpy$AddressCreateCurrentDialogDirectoryFontFormatLastModeParamProcVersion__setjmp3lstrlen
String ID: -info$C:\Users\user\AppData\Local\Temp\converter.exe$Helv$Shell32.dll$ShellExecuteEx$WinZip Self-Extractor
API String ID: 928115308-776734284
Opcode ID: 66a9d61da9181eaeff462a08e80621dfe921033c8797ce7d9a2e829b6342543b
Instruction ID: af5231c85435ac2c51bb948c4921b6c48b977ee552f9586e5a27c849eef0db4e
Opcode Fuzzy Hash: 66a9d61da9181eaeff462a08e80621dfe921033c8797ce7d9a2e829b6342543b
Instruction Fuzzy Hash: 5CD19EB1D04248BAEB216F71DE49F5A3E6CEB44745F10043AF644F62E1CBBD9940CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403A17 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 135
stringmemorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_llseek.KERNEL32(00000000,74DEE180,00000001), ref: 00403A62
_lread.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403A88
lstrcpyA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403AE5
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403AF4
lstrcpyA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B04
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B07
lstrcpyA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B14
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B17
lstrcpyA.KERNEL32(Acro Software Inc.,?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B23
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B26
lstrcpyA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B33
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B36
lstrcpyA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B4C
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B4F
LocalAlloc.KERNEL32(00000040,00000202,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B64
lstrcpyA.KERNEL32(00000000,?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B71
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B7D
lstrcpyA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B8A
lstrlenA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403B8D
LoadIconA.USER32(00000001), ref: 00403B97
GetModuleFileNameA.KERNEL32(?,00000200,?,0040306C,?,004035BF,?,?,00000022), ref: 00403BC5

Part of subcall function 00401317: _lclose.KERNEL32(00000000), ref: 0040132D
Part of subcall function 00401317: wsprintfA.USER32 ref: 00401372
Part of subcall function 00401317: MessageBoxA.USER32(WinZip Self-Extractor,00000022), ref: 0040138A
Part of subcall function 00401317: wsprintfA.USER32 ref: 004013DA
Part of subcall function 00401317: wsprintfA.USER32 ref: 004013F4
Part of subcall function 00401317: lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\converter.exe,00000002,74DEE070,00000800,-00000007), ref: 0040142A
Part of subcall function 00401317: lstrlenA.KERNEL32(?), ref: 00401433
Part of subcall function 00401317: lstrcpyA.KERNEL32(?,.ZIP), ref: 0040145B
Part of subcall function 00401317: _lopen.KERNEL32(?,00000020), ref: 00401466

lstrcatA.KERNEL32( -argv0 ,?,0040306C,?,004035BF,?,?,00000022), ref: 00403BE0
lstrcatA.KERNEL32(?,?,0040306C,?,004035BF,?,?,00000022), ref: 00403BEF

Strings

Acro Software Inc., xrefs: 00403B1E
-argv0 , xrefs: 00403BD5

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrcpy$lstrlen$wsprintf$lstrcat$AllocFileIconLoadLocalMessageModuleName_lclose_llseek_lopen_lread
String ID: -argv0 $Acro Software Inc.
API String ID: 2501280125-2204607209
Opcode ID: 3e3d8912b4463b30f780f86bc94d32a3aa1720382bbc8f50e5635bb6cbe6e342
Instruction ID: 74ddb60df293ae3f540ead7a952f8e954ea5fd97f939f991c1c059eca27e7a71
Opcode Fuzzy Hash: 3e3d8912b4463b30f780f86bc94d32a3aa1720382bbc8f50e5635bb6cbe6e342
Instruction Fuzzy Hash: 3C419EB1900218AFDB10AF65EF88E6A3B7DEB44344F00447AF585B21B2CAB56D04CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00401864 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 177
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,74DEE020,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000001), ref: 0040187C
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa), ref: 00401888
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa), ref: 0040189B
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WZSE0.TMP), ref: 004018B2
lstrlenA.KERNEL32(?), ref: 004018CE
lstrlenA.KERNEL32(?), ref: 004018E1
lstrcatA.KERNEL32(?,004089EC), ref: 004018F9
lstrlenA.KERNEL32(?), ref: 00401902
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa), ref: 0040190A
wsprintfA.USER32 ref: 00401929
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa), ref: 00401946
wsprintfA.USER32 ref: 00401982
lstrlenA.KERNEL32(0000005C,?,?,0000005C), ref: 00401A39
lstrcpyA.KERNEL32(0000005C,0000005C,?,?,0000005C), ref: 00401A5F
wsprintfA.USER32 ref: 00401A7A

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP, xrefs: 004018AC, 004018B8
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 00401874, 00401875, 0040187B, 00401887, 00401899, 00401906, 0040190F

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrlen$lstrcpywsprintf$lstrcat
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP$C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 2925925241-1311443872
Opcode ID: fe7352481111bf994ce3679dfc2515d9a24e14b6c1716a97b09b0b27af124c56
Instruction ID: 21042f6b84dc6f9f827726b9cd3e6003531f7ea05dc018fe7521c44a3de25187
Opcode Fuzzy Hash: fe7352481111bf994ce3679dfc2515d9a24e14b6c1716a97b09b0b27af124c56
Instruction Fuzzy Hash: 4C5126B1804398AADB319764DC4CBAB7BA95F05304F2440F7E885B21E3D6389E86CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F40 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 131
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(004096C9,00408AF4,74DF05F0,C:\Users\user\AppData\Local\Temp\converter.exe,00000000,?,004035BF,?,?,00000022), ref: 00402F79
lstrcpyA.KERNEL32(00409731,00408AF0,?,004035BF,?,?,00000022), ref: 00402F85
lstrcpyA.KERNEL32(00409439,00408AEC,?,004035BF,?,?,00000022), ref: 00402F91
lstrcpyA.KERNEL32(00409429,00408AE8,?,004035BF,?,?,00000022), ref: 00402F9D
lstrcpyA.KERNEL32(K00,K00,?,004035BF,?,?,00000022), ref: 00402FA9
lstrcpyA.KERNEL32(004096D1,00408AE0,?,004035BF,?,?,00000022), ref: 00402FBC

Part of subcall function 004012F8: _lopen.KERNEL32(C:\Users\user\AppData\Local\Temp\converter.exe,00000020), ref: 004012FF

LocalAlloc.KERNEL32(00000040,00008008,?,004035BF,?,?,00000022), ref: 00403026
_llseek.KERNEL32(007B9865,00000000), ref: 004030A0
_lread.KERNEL32(004035BF,00000004,?,004035BF,?,?,00000022), ref: 004030BC

Part of subcall function 0040386E: GlobalAlloc.KERNELBASE(00000042,?,74DEE180,74DE83C0,00000000,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 0040387C
Part of subcall function 0040386E: GlobalLock.KERNEL32(004035BF,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 00403891
Part of subcall function 0040386E: _llseek.KERNEL32(00000000,00000000), ref: 004038A6
Part of subcall function 0040386E: _lread.KERNEL32(00000000,?,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 004038C1
Part of subcall function 0040386E: GlobalUnlock.KERNEL32(004035BF,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 0040394A
Part of subcall function 0040386E: GlobalFree.KERNEL32(004035BF), ref: 00403953

Strings

Acro Software Inc., xrefs: 0040306C
K00, xrefs: 00402F9F
C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 00402F44
K00, xrefs: 00402FA4

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrcpy$Global$Alloc_llseek_lread$FreeLocalLockUnlock_lopen
String ID: Acro Software Inc.$C:\Users\user\AppData\Local\Temp\converter.exe$K00$K00
API String ID: 227706848-4006167110
Opcode ID: d48f7743d05238b494c22458dd62e6645fed153863c0f8abe7edfc0ea922a12b
Instruction ID: eedc4dfb8290d8ed0d03aec3faba8e8e8fcd17278262a3c9cc622f2167f3fcc7
Opcode Fuzzy Hash: d48f7743d05238b494c22458dd62e6645fed153863c0f8abe7edfc0ea922a12b
Instruction Fuzzy Hash: 32410670A05241AACB106B61AF42B6B3E5CA710706F20443FF580B22E3CFBD4D40DBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004032C6 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 66
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,000000F8,74DEE180,74DF05F0,?,C:\Users\user\AppData\Local\Temp\converter.exe,004035C4,?,?,00000022), ref: 004032D4
GlobalLock.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\converter.exe,004035C4,?,?,00000022), ref: 004032DB
_lopen.KERNEL32(C:\Users\user\AppData\Local\Temp\converter.exe,00000040), ref: 004032ED
_lread.KERNEL32(00000000,00000000,00000040,?,C:\Users\user\AppData\Local\Temp\converter.exe,004035C4,?,?,00000022), ref: 004032FD
_llseek.KERNEL32(00000000,?,00000000), ref: 0040330E
_lread.KERNEL32(00000000,00000000,000000F8,?,C:\Users\user\AppData\Local\Temp\converter.exe,004035C4,?,?,00000022), ref: 0040331B
_lclose.KERNEL32(00000000), ref: 00403334
_lclose.KERNEL32(00000000), ref: 0040333E
GlobalHandle.KERNEL32(00000000), ref: 0040334B
GlobalUnlock.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\converter.exe,004035C4,?,?,00000022), ref: 0040334E
GlobalHandle.KERNEL32(00000000), ref: 00403355
GlobalFree.KERNEL32(00000000), ref: 00403358

Strings

C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 004032C6, 004032E8

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Global$Handle_lclose_lread$AllocFreeLockUnlock_llseek_lopen
String ID: C:\Users\user\AppData\Local\Temp\converter.exe
API String ID: 1310256290-1780707591
Opcode ID: 8e7a34e63033534b07c01b5af54b89d62d0951f832773795333194b25cc358ac
Instruction ID: 54b9cfabc638ee228d7e504725bc275f9aa55a05828d277033f11c6da32f554f
Opcode Fuzzy Hash: 8e7a34e63033534b07c01b5af54b89d62d0951f832773795333194b25cc358ac
Instruction Fuzzy Hash: 0A112972905104BBC2202B619D8CE6F3F2CEB8A397B114531F502F92D0CE387841877A

Uniqueness

Uniqueness Score: -1.00%

Function 004042ED Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 147
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lread.KERNEL32(00409460,0000001A,74DEE070,00000004,?,00000000), ref: 0040430D
_lread.KERNEL32(00409460,0000001A,00000002,?,00000000), ref: 00404339
_llseek.KERNEL32(00000000,00000001,0007FFF9), ref: 004043AA
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,?,00000000), ref: 004043CF
wsprintfA.USER32 ref: 0040444D

Part of subcall function 00401317: _lclose.KERNEL32(00000000), ref: 0040132D
Part of subcall function 00401317: wsprintfA.USER32 ref: 00401372
Part of subcall function 00401317: MessageBoxA.USER32(WinZip Self-Extractor,00000022), ref: 0040138A
Part of subcall function 00401317: wsprintfA.USER32 ref: 004013DA
Part of subcall function 00401317: wsprintfA.USER32 ref: 004013F4
Part of subcall function 00401317: lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\converter.exe,00000002,74DEE070,00000800,-00000007), ref: 0040142A
Part of subcall function 00401317: lstrlenA.KERNEL32(?), ref: 00401433
Part of subcall function 00401317: lstrcpyA.KERNEL32(?,.ZIP), ref: 0040145B
Part of subcall function 00401317: _lopen.KERNEL32(?,00000020), ref: 00401466

lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,?,00000000), ref: 0040447B
_llseek.KERNEL32(00000000,00000001), ref: 0040449F
_llseek.KERNEL32(00000010,00000001), ref: 004044B3

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 00404389, 0040438E, 004043C9, 004043E6, 00404439, 00404475
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 004043CA, 00404476

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrcpywsprintf$_llseek$_lread$Message_lclose_lopenlstrlen
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa$C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 2877050131-640664497
Opcode ID: 092b07faa373392779a459185c9dc93c2b60e1108107119c5c1c6d1b7444648e
Instruction ID: 7ef8d6b6edfeccbc13edd7287e3d8e6cb16f9a31ce12af9fb01a5c6ad7a69439
Opcode Fuzzy Hash: 092b07faa373392779a459185c9dc93c2b60e1108107119c5c1c6d1b7444648e
Instruction Fuzzy Hash: 3A41B3B1604214AADB107B72AE05F6B366DE780349F10443FFA40F61E2DABD5C55CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401C18 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00401C31
TranslateMessage.USER32(?), ref: 00401C7F
DispatchMessageA.USER32(?), ref: 00401C8A
GetParent.USER32(?), ref: 00401CB8
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00401CD0
MessageBoxA.USER32(00000000,00000014,WinZip Self-Extractor,00000124), ref: 00401CFC

Strings

WinZip Self-Extractor, xrefs: 00401CE9

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Message$Peek$DispatchParentTranslate
String ID: WinZip Self-Extractor
API String ID: 516058063-754089420
Opcode ID: a7f75cd26785dd65090f82c8f51ab13ad1b383002f0746a51ab33d00718cb617
Instruction ID: 016af71259f3777fca599d3c2c0976c03427074c31bf5408bb27ede401b66964
Opcode Fuzzy Hash: a7f75cd26785dd65090f82c8f51ab13ad1b383002f0746a51ab33d00718cb617
Instruction Fuzzy Hash: 1821A37259C249A7EB249E64DD48A7B369CEB05784F84043BF441F62F0C67DDC41862A

Uniqueness

Uniqueness Score: -1.00%

Function 0040386E Relevance: 9.1, APIs: 6, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000042,?,74DEE180,74DE83C0,00000000,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 0040387C
GlobalLock.KERNEL32(004035BF,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 00403891
_llseek.KERNEL32(00000000,00000000), ref: 004038A6
_lread.KERNEL32(00000000,?,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 004038C1
GlobalUnlock.KERNEL32(004035BF,?,?,?,00402FE8,7C3B88D7,004089B0,?,004035BF,?,?,00000022), ref: 0040394A
GlobalFree.KERNEL32(004035BF), ref: 00403953

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Global$AllocFreeLockUnlock_llseek_lread
String ID:
API String ID: 3361173021-0
Opcode ID: 9ce918f9664d9644bd2e240cc4f730a811d440b4530c426b795b85abc82b1481
Instruction ID: 5e4816f8f50f50be9b3e13e1b02d7022b54e58ae1d23f75bbb4525a9f32536f3
Opcode Fuzzy Hash: 9ce918f9664d9644bd2e240cc4f730a811d440b4530c426b795b85abc82b1481
Instruction Fuzzy Hash: AD21F571904204BFCB12AF75DD06B5A3FA8AF04311F0081BEF810F62E2DB759A00DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00403FDE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lwrite.KERNEL32(?,00000000,00404473,?,00000000), ref: 00404073
_lclose.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa), ref: 00404092
wsprintfA.USER32 ref: 004040CB

Part of subcall function 004012AC: lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000000,0040400F,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,?,00000000,00404473,?,00000000), ref: 004012B8
Part of subcall function 004012AC: _lcreat.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000000), ref: 004012C1
Part of subcall function 004012AC: wsprintfA.USER32 ref: 004012E0

Part of subcall function 00401BC9: SetDlgItemTextA.USER32(0000006D,?), ref: 00401BF7
Part of subcall function 00401BC9: GetDlgItem.USER32(0000006D,00000000), ref: 00401C09
Part of subcall function 00401BC9: InvalidateRect.USER32(00000000), ref: 00401C10

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 00403FEE
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 004040B8

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Itemwsprintf$InvalidateRectText_lclose_lcreat_lwritelstrcpy
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa$C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 1954179241-640664497
Opcode ID: bbf73abed47e027bb307d649e6f384d5618a648dfaab938d8d754debda31bf64
Instruction ID: 5a649407bf9229297c9febdaee63f0f5a665db83a71911ce80f0671b1539c225
Opcode Fuzzy Hash: bbf73abed47e027bb307d649e6f384d5618a648dfaab938d8d754debda31bf64
Instruction Fuzzy Hash: 7B318CB1418211EBCB25AB65EF0152A37A9E784705B10413FFA41F22F3CB794C42DBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004012AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000000,0040400F,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,?,00000000,00404473,?,00000000), ref: 004012B8
_lcreat.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000000), ref: 004012C1
wsprintfA.USER32 ref: 004012E0

Part of subcall function 004011D9: MessageBoxA.USER32(00401314,WinZip Self-Extractor,00000010,0040120B), ref: 004011EA

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 004012B2
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 004012AD, 004012B7, 004012C0, 004012D1

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Message_lcreatlstrcpywsprintf
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa$C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 1132275612-640664497
Opcode ID: ee592e925fda1e2a0352cc0e660ce6aca2cf1bbaa9e14682c9bb13d1502f2063
Instruction ID: 9aa533ee6ec181a7199eb9cc996f4197df13a8bb9c3e51acc4a90d21dcd23b9f
Opcode Fuzzy Hash: ee592e925fda1e2a0352cc0e660ce6aca2cf1bbaa9e14682c9bb13d1502f2063
Instruction Fuzzy Hash: 35E04F31804050ABC6112B35BE09B8A3A199B05324F24427AF955F51F1DAB41810CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00401592 Relevance: 7.6, APIs: 5, Instructions: 69
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendDlgItemMessageA.USER32(000000C9,00000402,2366F8A7,00000000,00000007), ref: 0040160A
GetDlgItem.USER32(000000C9,00000000), ref: 00401619
InvalidateRect.USER32(00000000), ref: 00401620
UpdateWindow.USER32 ref: 0040162C
_lwrite.KERNEL32(00000000,00404DE8,?), ref: 0040165F

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Item$InvalidateMessageRectSendUpdateWindow_lwrite
String ID:
API String ID: 2315175730-0
Opcode ID: 4bbbd8ce67b21da450327d7f0f16b320649fa1b98a6d3880f25d9bb07fc42039
Instruction ID: 92a12ff487d5de7426b6a0fffb0c675d489572394ad6076df216887941c3bb3b
Opcode Fuzzy Hash: 4bbbd8ce67b21da450327d7f0f16b320649fa1b98a6d3880f25d9bb07fc42039
Instruction Fuzzy Hash: 15217F72918100EFDB048F65FF849667BAAF788355708403EF641F62B2CA725C51DB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00403129 Relevance: 7.5, APIs: 5, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFree.KERNELBASE(00CB9A00,00000000,0040379B,?,?,00000022), ref: 0040313A
LocalFree.KERNELBASE(00CC1A10,00000000,0040379B,?,?,00000022), ref: 00403146
LocalFree.KERNEL32(00CC2230,00000000,0040379B,?,?,00000022), ref: 00403152
_lclose.KERNEL32(00000000), ref: 00403164
_lclose.KERNEL32(00000000), ref: 00403177

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: FreeLocal$_lclose
String ID:
API String ID: 547214835-0
Opcode ID: 1b23435d131c158aaedba167be91649a84e1d61001fc0d1585e9c08ac4c80354
Instruction ID: 77fe821d971415c4b6c5fa4ea267eb0a82dbf3f11392f32b746bb3e403f21c38
Opcode Fuzzy Hash: 1b23435d131c158aaedba167be91649a84e1d61001fc0d1585e9c08ac4c80354
Instruction Fuzzy Hash: 73F0F871B1422497DB109F79EE44B573B9C6B08752B18103AA880F7291DAB8EC408BAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040456B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lread.KERNEL32(?,00000004,00000000,?,?,?,00401E2E), ref: 00404585
_lread.KERNEL32(?,00000004,00000002), ref: 004045B3

Strings

PK00, xrefs: 0040464F

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: _lread
String ID: PK00
API String ID: 2848661430-1863955648
Opcode ID: 8c7838e1f5acc8864d3a14fdfd456f385d1ecaa1c10de0eb154d5d9d6bd500c4
Instruction ID: 03c486359bc122ad2814ddd8e178a35661500e8f598957e9ac25878a73e7c058
Opcode Fuzzy Hash: 8c7838e1f5acc8864d3a14fdfd456f385d1ecaa1c10de0eb154d5d9d6bd500c4
Instruction Fuzzy Hash: 892173E6901214B6CA10A7A2AE02F9B339C9B91704F14443BFF41F11D6FA7D9B44D6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00403BF6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE("?@,00000080,00403F22,?), ref: 00403BFF
DeleteFileA.KERNELBASE(?), ref: 00403C09

Strings

"?@, xrefs: 00403BFB

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: File$AttributesDelete
String ID: "?@
API String ID: 2910425767-3934920752
Opcode ID: b707f98516d7460ecd55a6b81fea88eb4df0ca02c891f8120609599ec7c85651
Instruction ID: cf8bc80ddf2b224c83355370a3e04e556ae1d9c2545ee6e22150fd8e694fa524
Opcode Fuzzy Hash: b707f98516d7460ecd55a6b81fea88eb4df0ca02c891f8120609599ec7c85651
Instruction Fuzzy Hash: A4C04C30598107ABCE511F30DE09E197A61AB50701F009764B5C6D40F0CF359454AB06

Uniqueness

Uniqueness Score: -1.00%

Function 00404948 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000040,00000002), ref: 00404BAA

Strings

c, xrefs: 00404C3C
not enough memory, xrefs: 00404D5D

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: AllocLocal
String ID: c$not enough memory
API String ID: 3494564517-788478446
Opcode ID: 7a8bb19445c9d372afebe1dac956521d1a1bb47b5c23e96fbd802d43a7932c66
Instruction ID: e747ef0064bc585c245c4a64920f22f8beacf6711e70ab2454622e96d3a4731c
Opcode Fuzzy Hash: 7a8bb19445c9d372afebe1dac956521d1a1bb47b5c23e96fbd802d43a7932c66
Instruction Fuzzy Hash: 0FE18EB1900219DFCF10DFA8D5806EDB7B1FF98314F11817AE985B7290E3789A86DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DB4 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

__setjmp3.LIBCMT ref: 00401DCB

Part of subcall function 004011CE: SetCursor.USER32(00000000,00401C9D,?,00000000,?,?,?,?,?,?,00401D49), ref: 004011D2

_llseek.KERNEL32(00000000,00000000,75BF3E70), ref: 00401E0E

Part of subcall function 00401317: _lclose.KERNEL32(00000000), ref: 0040132D
Part of subcall function 00401317: wsprintfA.USER32 ref: 00401372
Part of subcall function 00401317: MessageBoxA.USER32(WinZip Self-Extractor,00000022), ref: 0040138A
Part of subcall function 00401317: wsprintfA.USER32 ref: 004013DA
Part of subcall function 00401317: wsprintfA.USER32 ref: 004013F4
Part of subcall function 00401317: lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\converter.exe,00000002,74DEE070,00000800,-00000007), ref: 0040142A
Part of subcall function 00401317: lstrlenA.KERNEL32(?), ref: 00401433
Part of subcall function 00401317: lstrcpyA.KERNEL32(?,.ZIP), ref: 0040145B
Part of subcall function 00401317: _lopen.KERNEL32(?,00000020), ref: 00401466

_lclose.KERNEL32(00000000), ref: 00401E3B

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: wsprintf$_lcloselstrcpy$CursorMessage__setjmp3_llseek_lopenlstrlen
String ID:
API String ID: 1168133630-0
Opcode ID: 2661254578654ace51840749f355bd83b1c181b0a0e2dd6f3d5c50e9985df6e1
Instruction ID: 8628ae413674a1b9f2561924537dbc40260332ce6bf65a17ad74e1fc52fc8939
Opcode Fuzzy Hash: 2661254578654ace51840749f355bd83b1c181b0a0e2dd6f3d5c50e9985df6e1
Instruction Fuzzy Hash: E8018471119600ABDB116B66FF4591E3769F784718B24013FF644F62F2CFBA1C908AAE

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8F Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00403F90
GetModuleHandleA.KERNEL32(00000000,00000000,00000001,00000000), ref: 00403FBC
ExitProcess.KERNEL32 ref: 00403FC9

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: CommandExitHandleLineModuleProcess
String ID:
API String ID: 4282287251-0
Opcode ID: 7b0f9df5f6320ba77bfff2b25c5adc46be05639d425d1923cbed487952c861fd
Instruction ID: 1e72d3789003717aa3de66f4d19460ce30c084b289d0e79969378c5ab20a4370
Opcode Fuzzy Hash: 7b0f9df5f6320ba77bfff2b25c5adc46be05639d425d1923cbed487952c861fd
Instruction Fuzzy Hash: C5E092D4C4C2C16EE3215F300D6C8B36F7DD88730231D91A7B092AB3A2D83E49498229

Uniqueness

Uniqueness Score: -1.00%

Function 00401190 Relevance: 4.5, APIs: 3, Instructions: 25timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(00404473,00000000,00000000), ref: 004011A0
LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000), ref: 004011AE
SetFileTime.KERNELBASE(?,?,?,?,?,00000000), ref: 004011C3

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: cca723e119195a95d394cf8ca9afe6e95362d6d60ef0980a10444442efddd5e5
Instruction ID: 4fe155e79654c96bd19198cbc8b3ec839ae32ca5b0bdeb8b6f80bb9e6d65483c
Opcode Fuzzy Hash: cca723e119195a95d394cf8ca9afe6e95362d6d60ef0980a10444442efddd5e5
Instruction Fuzzy Hash: FDE0457680410DBFDF01DFD0DD45CEE7B7CAB04204F004662B611E5060D671A6598B65

Uniqueness

Uniqueness Score: -1.00%

Function 004012F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_lopen.KERNEL32(C:\Users\user\AppData\Local\Temp\converter.exe,00000020), ref: 004012FF

Strings

C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 004012FA

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: _lopen
String ID: C:\Users\user\AppData\Local\Temp\converter.exe
API String ID: 2515328373-1780707591
Opcode ID: c1917f082bd1cb496c66f5bf46aa8442e3a16168a14fa3ba7016aa50cae9e1a1
Instruction ID: 0fb4c3a88b2f959a5c3bd9f4f5f451d362c625739422430b53418e16b0c1bb96
Opcode Fuzzy Hash: c1917f082bd1cb496c66f5bf46aa8442e3a16168a14fa3ba7016aa50cae9e1a1
Instruction Fuzzy Hash: EEC02B3010120046C6202B304E0970835114B00335F30037AF030FC0F2DB7864004B1E

Uniqueness

Uniqueness Score: -1.00%

Function 00404130 Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

_lread.KERNEL32(00000800,00000007,00008000,00401572,00404E67,00408EDC,?,00000000,00000000), ref: 00404163
_lread.KERNEL32(00000800,00000002), ref: 004041AE

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: _lread
String ID:
API String ID: 2848661430-0
Opcode ID: 78b45d0d831819e0f3af5d612dafd49daf84aa47b35eb6bb70c1aa46df95fef3
Instruction ID: 0d2624af7c7224e96d0f8eece13f4c450784f5c712b15dc877fb9874a07f822e
Opcode Fuzzy Hash: 78b45d0d831819e0f3af5d612dafd49daf84aa47b35eb6bb70c1aa46df95fef3
Instruction Fuzzy Hash: E22190B060A1108BCB186B35AE5866A37A5AB94715F18413FE555F73F2DA344C82CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 00402429 Relevance: 2.5, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

CharNextA.USER32(00402527,75C08FB0,004025CE,00402527,004025CE,004025CE,TMP,?), ref: 0040243F
CharNextA.USER32(00402527), ref: 0040245E

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 0971efa2f4fdda9dc732ee34e5b596d2bfaffcbc743e8b58141fbd735aa0f423
Instruction ID: ddf706e90c98cca548dc0a89e36fb22f41cdf4ad00a5d2550a2400896a768921
Opcode Fuzzy Hash: 0971efa2f4fdda9dc732ee34e5b596d2bfaffcbc743e8b58141fbd735aa0f423
Instruction Fuzzy Hash: B2F020218082A018C7311A3CAA4C7E79B824F46B10F580837E4C0BB3D1C2F84EC38A9F

Uniqueness

Uniqueness Score: -1.00%

Function 00401836 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNELBASE(00401963,?,00401963,?), ref: 00401851

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 5cb54ac221ac85cc5ee924f8eafcf90179117e8a5a5f6a503fb374a8fddc4c13
Instruction ID: 48fd74b255fd4cea240f43010eb0503eee25cc3fcb27bfbc4ffa56b3fad718de
Opcode Fuzzy Hash: 5cb54ac221ac85cc5ee924f8eafcf90179117e8a5a5f6a503fb374a8fddc4c13
Instruction Fuzzy Hash: 7DE0863111838CADDB028F74C455B893F984B15740F04C055F5488F181D171D25587A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401125 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(0040256B,00000000,0040256B,0040259B,?,0040259B,004025F7), ref: 0040112B

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 60654c3e5b552153225b78e7d6d4118b9255b098355e59785647971b607dc0bd
Instruction ID: 64e6f1d67380619db0e945b04b2200e47ba437bef4d542aef357aca3fa33d342
Opcode Fuzzy Hash: 60654c3e5b552153225b78e7d6d4118b9255b098355e59785647971b607dc0bd
Instruction Fuzzy Hash: 58B012306F910296DA001B30CC05B153D509781603F1046307046D10F0C73050015515

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00403C17 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 147filestringCOMMON

Download Yara Rule

APIs

MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00403C2B
wsprintfA.USER32 ref: 00403C4D
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403C75

Part of subcall function 00401163: lstrlenA.KERNEL32(?,?,0040290B), ref: 0040116E
Part of subcall function 00401163: lstrcatA.KERNEL32(?,004089EC,?,0040290B), ref: 00401188

lstrcatA.KERNEL32(?,WinInit.Ini), ref: 00403C94
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,08000080,00000000), ref: 00403CB0
GetFileSize.KERNEL32(00000000,00000000), ref: 00403CC6
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,0000000A,00000000), ref: 00403CDC
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00403CF3
wsprintfA.USER32 ref: 00403D23
UnmapViewOfFile.KERNEL32(?), ref: 00403D7D
CloseHandle.KERNEL32(?), ref: 00403D89
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403D96
SetEndOfFile.KERNEL32(00000000), ref: 00403D9D
CloseHandle.KERNEL32(00000000), ref: 00403DA4

Strings

WinInit.Ini, xrefs: 00403C8E
[Rename], xrefs: 00403C53
%hs=%hs, xrefs: 00403C47
NUL, xrefs: 00403C42

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: File$CloseCreateHandleViewlstrcatwsprintf$DirectoryMappingMovePointerSizeUnmapWindowslstrlen
String ID: %hs=%hs$NUL$WinInit.Ini$[Rename]
API String ID: 235237451-2789956363
Opcode ID: 28bf2e4e98679ec78927ecb7c24d86f31dcfe77dcc37b551b2d585f42a443e00
Instruction ID: c022ad8570be6a267e70024c7f6febe8eacaf3e36ed4c106158ae4475397c0e0
Opcode Fuzzy Hash: 28bf2e4e98679ec78927ecb7c24d86f31dcfe77dcc37b551b2d585f42a443e00
Instruction Fuzzy Hash: 1B417CB2C00118BFDB109FA4DD89E9F7B7CEF08359F104166FA05F2280D634AE448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402085 Relevance: 25.6, APIs: 17, Instructions: 118stringwindowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,00000192,?,000000FF), ref: 004020D5
GlobalHandle.KERNEL32(00000000), ref: 004020F3
GlobalUnlock.KERNEL32(00000000), ref: 004020F6
GlobalHandle.KERNEL32 ref: 00402102
GlobalFree.KERNEL32(00000000), ref: 00402105
lstrlenA.KERNEL32(?), ref: 00402112
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040211C
GlobalLock.KERNEL32(00000000), ref: 00402123
lstrcpyA.KERNEL32(00000000,?), ref: 0040213E
EndDialog.USER32(?,00000001), ref: 00402149
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 0040216E
GetWindowRect.USER32(?,?), ref: 0040217B
GetSystemMetrics.USER32(00000001), ref: 0040218F
GetSystemMetrics.USER32(00000000), ref: 004021A1
SetWindowPos.USER32(?,00000000,00000000), ref: 004021B6
GetDlgItem.USER32(?,00000192), ref: 004021DB
SendMessageA.USER32(00000000,00000030,00000001), ref: 004021F0

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Global$HandleItemMessageMetricsSendSystemWindow$AllocDialogFreeLockRectTextUnlocklstrcpylstrlen
String ID:
API String ID: 186722348-0
Opcode ID: 7c89a98bbebe13cde5b3fd06f9f47bff5d1d123f037fd55a32894cc67b889b96
Instruction ID: 48a45633b6f2ef1929542be0c183d6fac77952ac3335737086e5960345804a7e
Opcode Fuzzy Hash: 7c89a98bbebe13cde5b3fd06f9f47bff5d1d123f037fd55a32894cc67b889b96
Instruction Fuzzy Hash: 78416B31A04259BBEB249F64DF4DFAA3B29BB04740F040535B615FE2E0CBF4A980DA59

Uniqueness

Uniqueness Score: -1.00%

Function 00401317 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 111stringwindowCOMMON

Download Yara Rule

APIs

_lclose.KERNEL32(00000000), ref: 0040132D
wsprintfA.USER32 ref: 00401372
MessageBoxA.USER32(WinZip Self-Extractor,00000022), ref: 0040138A
wsprintfA.USER32 ref: 004013DA
wsprintfA.USER32 ref: 004013F4
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\converter.exe,00000002,74DEE070,00000800,-00000007), ref: 0040142A
lstrlenA.KERNEL32(?), ref: 00401433
lstrcpyA.KERNEL32(?,.ZIP), ref: 0040145B
_lopen.KERNEL32(?,00000020), ref: 00401466

Strings

WinZip Self-Extractor, xrefs: 00401379
:, xrefs: 0040134C
.EXE, xrefs: 0040144E
C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 0040133A, 00401424
.ZIP, xrefs: 00401455

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: wsprintf$lstrcpy$Message_lclose_lopenlstrlen
String ID: .EXE$.ZIP$:$C:\Users\user\AppData\Local\Temp\converter.exe$WinZip Self-Extractor
API String ID: 2450228737-2135291590
Opcode ID: 351c5b635f28c664edaf467330c84773560845a7eb3addf1b70703d76d98bf9d
Instruction ID: 1f45e3978d6234b1b330d1ebabe61d56a8c37749f43cedcab5a13f8c73f70034
Opcode Fuzzy Hash: 351c5b635f28c664edaf467330c84773560845a7eb3addf1b70703d76d98bf9d
Instruction Fuzzy Hash: B831C671904249AADB10ABA4DE45FAE3B68AB00304F144177FD85F71F1DA7C9984CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00401A9F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 88windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 004010A3: FindFirstFileA.KERNELBASE(0040259B,?), ref: 004010B6

SendDlgItemMessageA.USER32(000000C9,00000402,?,00000000,74DEE020), ref: 00401B19
GetDlgItem.USER32(000000C9,00000000), ref: 00401B28
InvalidateRect.USER32(00000000), ref: 00401B2F
UpdateWindow.USER32 ref: 00401B3B
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,74DEE020,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000001), ref: 00401B48
wsprintfA.USER32 ref: 00401B5E
MessageBoxA.USER32(?,WinZip Self-Extractor,00000003), ref: 00401B7B

Strings

WinZip Self-Extractor, xrefs: 00401B6F
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 00401AB1, 00401ABA, 00401AC1, 00401B46
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 00401B41, 00401B47, 00401B4E

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: ItemMessage$FileFindFirstInvalidateRectSendUpdateWindowlstrcpywsprintf
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa$C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa$WinZip Self-Extractor
API String ID: 4467150-138148469
Opcode ID: 375db8d8057faf2e3ac94e4602eabd3801b21293ae63af45e7fedf5f5d8a36da
Instruction ID: b7c6a5853b52d11b04ecff53f1719fcb3a8d9bf1e5105d553e596dfd5d0ad0b3
Opcode Fuzzy Hash: 375db8d8057faf2e3ac94e4602eabd3801b21293ae63af45e7fedf5f5d8a36da
Instruction Fuzzy Hash: 3221D673A14210AFDB146B66AE49F673A69E748394F00403BFA05F61F1D6796C40CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004021FD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000258,75C08FB0,?,75BF3E70,00000000,C:\Users\user\AppData\Local\Temp\WZSE0.TMP,00402A3A,?), ref: 0040221C
GlobalAlloc.KERNEL32(00000042,00000258), ref: 00402264
GlobalLock.KERNEL32(00000000), ref: 0040226D
DialogBoxIndirectParamA.USER32(00000000,?,00402085,00000000), ref: 00402296
GlobalUnlock.KERNEL32(00000000), ref: 004022A1
GlobalFree.KERNEL32(00000000), ref: 004022A8
LocalFree.KERNEL32(00000000), ref: 004022B6

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP, xrefs: 004021FD
no memory for resources, xrefs: 004022BE

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Global$AllocFreeLocal$DialogIndirectLockParamUnlock
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP$no memory for resources
API String ID: 2927175730-2939073722
Opcode ID: 58e90e586e5c988df748a102e3fe24040eb1e246e1f7e7f5708fb64fc9a128e9
Instruction ID: 3c472cb1c8dd0962e3b6651cf7ce18cc30509c15301b29aefd55b74c87dd3300
Opcode Fuzzy Hash: 58e90e586e5c988df748a102e3fe24040eb1e246e1f7e7f5708fb64fc9a128e9
Instruction Fuzzy Hash: 6B119071508344ABD3005FA1EF8DB577AA8EB45355F00453EF985762E2CBF858048FAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040175B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WZSE0.TMP,74DEE020,C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,00000001), ref: 0040178B

Part of subcall function 00401163: lstrlenA.KERNEL32(?,?,0040290B), ref: 0040116E
Part of subcall function 00401163: lstrcatA.KERNEL32(?,004089EC,?,0040290B), ref: 00401188

lstrlenA.KERNEL32(004095C1), ref: 004017BA
lstrlenA.KERNEL32(?), ref: 004017C8
wsprintfA.USER32 ref: 004017E7
lstrcatA.KERNEL32(?,004095C1), ref: 00401807
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa,?), ref: 00401815

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP, xrefs: 00401764, 00401785
C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 0040176C, 0040176E, 00401799, 004017D8, 00401814, 00401817

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrlen$lstrcatlstrcpy$wsprintf
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP$C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 3279105194-1311443872
Opcode ID: 90433193c1c1dae54cd7c8c82175a1173c40454a8adbfb4985015f330f6d07e3
Instruction ID: 59161ab248c1d69b2fc6e7f046ac6424d32b469838a209c0f06a0672514c82d2
Opcode Fuzzy Hash: 90433193c1c1dae54cd7c8c82175a1173c40454a8adbfb4985015f330f6d07e3
Instruction Fuzzy Hash: 7A21D772D0414CAEDB219B64ED84BEA7BA8AB05304F1444BAE444B31E1D6785E85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401E59 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95stringprocesswindowCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,75BF6C10,?,00000000), ref: 00401E6F
lstrcatA.KERNEL32(?,00408A70), ref: 00401E90
lstrcatA.KERNEL32(?,?), ref: 00401E9A
WinExec.KERNEL32(?,00000001), ref: 00401EAD
wsprintfA.USER32 ref: 00401F51
MessageBoxA.USER32(?,WinZip Self-Extractor,00000000), ref: 00401F6D

Strings

WinZip Self-Extractor, xrefs: 00401F61

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrcat$ExecMessagelstrcpywsprintf
String ID: WinZip Self-Extractor
API String ID: 3977769206-754089420
Opcode ID: 54bf4bcd483489fb31f99067966e0ecff3ae0911c888808fd26e33791179f072
Instruction ID: d89a0da8e50dd4101d3bd07979bfc9079d88eaae01f62d72c2cc91687a91a159
Opcode Fuzzy Hash: 54bf4bcd483489fb31f99067966e0ecff3ae0911c888808fd26e33791179f072
Instruction Fuzzy Hash: F1316D72900219ABDB20DFA4D984AEEB7B9FB08310F50047AF545F72A0D7789E848F58

Uniqueness

Uniqueness Score: -1.00%

Function 004023AE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43filestringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,00402308,00000000,004089D0), ref: 004023C3
lstrcatA.KERNEL32(?,.exe), ref: 004023D5
OpenFile.KERNEL32(?,?,00004000), ref: 004023F4
_lclose.KERNEL32(00000000), ref: 00402402
OpenFile.KERNEL32(?,?,00000010), ref: 00402414
_lclose.KERNEL32(00000000), ref: 0040241C

Strings

.exe, xrefs: 004023CF

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: FileOpen_lclose$lstrcatlstrcpy
String ID: .exe
API String ID: 3284424789-4119554291
Opcode ID: b7816127749b83d781679b22c06bbb678caf181fa459ee96b3c37ddc4bb2e65c
Instruction ID: 78369d126a08079e280e52141b4985fc0b7b571d5e6896a88ff13c47822817a4
Opcode Fuzzy Hash: b7816127749b83d781679b22c06bbb678caf181fa459ee96b3c37ddc4bb2e65c
Instruction Fuzzy Hash: 030112B690411D67CF2097A4DD48FCA776C9B48314F1046B2B615F30D0D6B4A6868FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040421E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

_llseek.KERNEL32(00000000,00000001,00000000), ref: 00404244
_llseek.KERNEL32(00000000,00000002), ref: 00404254
_llseek.KERNEL32(?,00000000), ref: 0040426F
_llseek.KERNEL32(00000000,00000001,00000002), ref: 004042AA
_llseek.KERNEL32(00000000,00000002), ref: 004042B9

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 00404238

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: _llseek
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 2658742982-3209153482
Opcode ID: 57a34cf8440c0e37bbd3271427e6cf59fee35d40ba63636f0e151e0d51de1224
Instruction ID: 36ecb906f4d52a42eb88eb9106bf4863e53fa57163c2ffa1fc6c7dde07d76a54
Opcode Fuzzy Hash: 57a34cf8440c0e37bbd3271427e6cf59fee35d40ba63636f0e151e0d51de1224
Instruction Fuzzy Hash: 5121F3B67012246BC720AF79DE85F2AB694E784760F11063EFA54F32E0D6B55C118B98

Uniqueness

Uniqueness Score: -1.00%

Function 004022DC Relevance: 9.1, APIs: 6, Instructions: 52windowtimeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000046,00002710,00000000,74DF23A0), ref: 004022F5

Part of subcall function 004023AE: lstrcpyA.KERNEL32(?,00402308,00000000,004089D0), ref: 004023C3
Part of subcall function 004023AE: lstrcatA.KERNEL32(?,.exe), ref: 004023D5
Part of subcall function 004023AE: OpenFile.KERNEL32(?,?,00004000), ref: 004023F4
Part of subcall function 004023AE: _lclose.KERNEL32(00000000), ref: 00402402
Part of subcall function 004023AE: OpenFile.KERNEL32(?,?,00000010), ref: 00402414
Part of subcall function 004023AE: _lclose.KERNEL32(00000000), ref: 0040241C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00402320
TranslateMessage.USER32(?), ref: 0040232E
DispatchMessageA.USER32(?), ref: 00402338
PostQuitMessage.USER32(00000001), ref: 00402347
KillTimer.USER32(00000046,?,?,?,?,?,00002710,00402CA2), ref: 0040235B

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: Message$FileOpenTimer_lclose$DispatchKillPostQuitTranslatelstrcatlstrcpy
String ID:
API String ID: 3740055582-0
Opcode ID: 1b6ed867f5f84919236568e0696b260c056d38cc3466f4f921e93290472a5f40
Instruction ID: e096621bb059fb601eb7be2820a23991b761fb9dfe1205a8ad6fa4ab617d4939
Opcode Fuzzy Hash: 1b6ed867f5f84919236568e0696b260c056d38cc3466f4f921e93290472a5f40
Instruction Fuzzy Hash: B801B172904248ABDB106BB49F8DD6B366DAB00344B004037FE05F22E1EABDAC01866E

Uniqueness

Uniqueness Score: -1.00%

Function 00403182 Relevance: 8.9, APIs: 7, Instructions: 104stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000007,00000009,0000000D,74DEE180,74DF05F0,00000000,0040373D,?,80000000,?,?,00000022), ref: 004031D5
lstrlenA.KERNEL32(?,?,?,00000022), ref: 004031DD
lstrlenA.KERNEL32(?,?,?,00000022), ref: 004031E4
lstrlenA.KERNEL32(?,?,?,00000022), ref: 004031FF
lstrlenA.KERNEL32(?,?,?,00000022), ref: 00403223
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,00000022), ref: 00403245
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000022), ref: 00403263

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 1cf635c4fcc5663d50a82a6fbcb8de9a2c4b85a84dbd79a60c7d1be57ab43d1d
Instruction ID: 1bd784c648202ec6a584e61267a48bdd2054e30c07f17416c615b9bae2fa8306
Opcode Fuzzy Hash: 1cf635c4fcc5663d50a82a6fbcb8de9a2c4b85a84dbd79a60c7d1be57ab43d1d
Instruction Fuzzy Hash: BF312870D04208BBCF115F758C41ABE3FA99B08345F1440BFE884BA2E1D73D4A86AB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401D5E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401D77
wsprintfA.USER32 ref: 00401D8F
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004041CA,00000002), ref: 00401D9E

Part of subcall function 004011D9: MessageBoxA.USER32(00401314,WinZip Self-Extractor,00000010,0040120B), ref: 004011EA

Strings

C:\Users\user\AppData\Local\Temp\converter.exe, xrefs: 00401D7C
<%d>, xrefs: 00401D71

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: wsprintf$Messagelstrcat
String ID: <%d>$C:\Users\user\AppData\Local\Temp\converter.exe
API String ID: 3948670161-987482515
Opcode ID: 8027f7d4dad882f5565a4d4b8daeb6d2290b0a3fbb7904a029ec6486c4f88f99
Instruction ID: 35ffd49859fe8a36cf7ffc5be015f46e19e697a952284ba85e924400f51c6f16
Opcode Fuzzy Hash: 8027f7d4dad882f5565a4d4b8daeb6d2290b0a3fbb7904a029ec6486c4f88f99
Instruction Fuzzy Hash: 77E0657190011CBBCB00A7A4FE02D9D3B2CAB09308B144036FD44F20B1D9B5A954CBED

Uniqueness

Uniqueness Score: -1.00%

Function 00403962 Relevance: 7.5, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000165F,74DEE180,00000001,00403058,?,004035BF,?,?,00000022), ref: 0040396C
OemToCharBuffA.USER32(00000000,00000000), ref: 004039E7
GlobalAlloc.KERNEL32(00000040,0000165F,?,004035BF,?,?,00000022), ref: 004039F0
GlobalLock.KERNEL32(00000000,?,004035BF,?,?,00000022), ref: 004039F7
LocalFree.KERNEL32(00000000,?,?,004035BF,?,?,00000022), ref: 00403A0E

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: AllocGlobalLocal$BuffCharFreeLock
String ID:
API String ID: 2834846847-0
Opcode ID: 266d036024a961919f1399e924b70c7d08238f316e540d2af9623d31bfa30e02
Instruction ID: 2c0c1f018aec8f247b33afacdf9907a4c6065e1bb2903b7f9fdcaff4a5692556
Opcode Fuzzy Hash: 266d036024a961919f1399e924b70c7d08238f316e540d2af9623d31bfa30e02
Instruction Fuzzy Hash: C111E971808B605AC7211F75AE0DB8B7F689B46322F04027EF1D9752F2C7B914018FAE

Uniqueness

Uniqueness Score: -1.00%

Function 004044C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_lread.KERNEL32(?,0000002A,00000004,?,?,?,?,?,?,?,?,?,?,0040461A), ref: 004044D3
_llseek.KERNEL32(?,00000001,000000C8), ref: 0040451C
_llseek.KERNEL32(?,00000001), ref: 0040452B

Part of subcall function 00401D5E: wsprintfA.USER32 ref: 00401D77
Part of subcall function 00401D5E: wsprintfA.USER32 ref: 00401D8F
Part of subcall function 00401D5E: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004041CA,00000002), ref: 00401D9E

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa, xrefs: 004044FE

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: _llseekwsprintf$_lreadlstrcat
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP\GPLGS\wftopfa
API String ID: 558230181-3209153482
Opcode ID: d0c1b3756ddde901061e1f4e49f5d66cf92d6bfe60ee1e6a341e1a11c76dcce0
Instruction ID: b4bf0fb4dda0e2707b3020fcbdc2604e4d8fe155bd9fa53c4f8c7a5db93b148c
Opcode Fuzzy Hash: d0c1b3756ddde901061e1f4e49f5d66cf92d6bfe60ee1e6a341e1a11c76dcce0
Instruction Fuzzy Hash: D1F062A1901114A6DF1077A2AD06BBE766DAB08704F104026FA41F60E1EAB95D40D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402471 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,75C08FB0,?), ref: 00402492

Part of subcall function 00401163: lstrlenA.KERNEL32(?,?,0040290B), ref: 0040116E
Part of subcall function 00401163: lstrcatA.KERNEL32(?,004089EC,?,0040290B), ref: 00401188

wsprintfA.USER32 ref: 004024B7

Part of subcall function 00401125: CreateDirectoryA.KERNELBASE(0040256B,00000000,0040256B,0040259B,?,0040259B,004025F7), ref: 0040112B

lstrcpyA.KERNEL32(00402649,?), ref: 004024E7

Strings

%sWZSE%d.TMP, xrefs: 004024B1

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: lstrcpy$CreateDirectorylstrcatlstrlenwsprintf
String ID: %sWZSE%d.TMP
API String ID: 2782772429-3550403970
Opcode ID: 0c50c107e1cab50ca629e5d1138bb402e1184a4090331b5643d198882e253314
Instruction ID: 07a5957fb5faee91893df25cc8ed35201286730dcb6ff1f5f6402f47b4dd2a33
Opcode Fuzzy Hash: 0c50c107e1cab50ca629e5d1138bb402e1184a4090331b5643d198882e253314
Instruction Fuzzy Hash: AF01627390411C7ADB11DAA5DD88EDB3B6CEB44310F0404B7BA55E60D0DAB89AC58BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004014C5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00000800,00000800,-00000007,?,?,?,?,?,00401359,00000002,74DEE070,00000800,-00000007), ref: 004014D3
GetVolumeInformationA.KERNEL32(00000800,?,00000020,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00401359,00000002,74DEE070), ref: 004014EA

Strings

PKBACK#, xrefs: 004014F9

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: InformationVolumelstrcpy
String ID: PKBACK#
API String ID: 480380260-428551218
Opcode ID: ef4ac8adb1c5eb85a656d3b66bac198eb43a9b9df4749d4549af0ff17e8754b4
Instruction ID: 79ca6a59d9958ae22e96aa6476e2077c3e92217018bd03f4441f019913101aae
Opcode Fuzzy Hash: ef4ac8adb1c5eb85a656d3b66bac198eb43a9b9df4749d4549af0ff17e8754b4
Instruction Fuzzy Hash: 1B113DB794414879CB115AA85C84BEA3B6D9A9B304F581077E1C3BE1F5E13D848B831D

Uniqueness

Uniqueness Score: -1.00%

Function 004010E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WZSE0.TMP,?,00000000,00402928), ref: 004010EF
SetCurrentDirectoryA.KERNEL32(?), ref: 0040110B

Strings

C:\Users\user\AppData\Local\Temp\WZSE0.TMP, xrefs: 004010EB

Memory Dump Source

Source File: 00000006.00000002.2136160611.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2136134305.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136338178.0000000000407000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136442579.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2136721729.000000000040A000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_converter.jbxd

Similarity

API ID: CurrentDirectorylstrlen
String ID: C:\Users\user\AppData\Local\Temp\WZSE0.TMP
API String ID: 2713697268-567454134
Opcode ID: 3eb2a46fbc61526e4731e6ed2908a51dbe4a5fd2791ffe3fe536133277f3cc26
Instruction ID: d151e6e6f5b758b88b20c6cf172695a19b4e2ddbc663458f946fb9ea80f694eb
Opcode Fuzzy Hash: 3eb2a46fbc61526e4731e6ed2908a51dbe4a5fd2791ffe3fe536133277f3cc26
Instruction Fuzzy Hash: D8E02B37A59763A9E71147786C84E2B1A445B85311F000179E201D71C0C6F798144365

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unInstcpw64.exePID: 2652, Parent PID: 6500COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	231
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004017E0 Relevance: 498.1, APIs: 228, Strings: 56, Instructions: 1117
stringregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#626.MFC42 ref: 00401839
#626.MFC42 ref: 00401844
#2641.MFC42 ref: 00401859
#1040.MFC42 ref: 004018AD
#2795.MFC42 ref: 004018C3
#1122.MFC42 ref: 0040190C
#1040.MFC42 ref: 00401917
#1040.MFC42 ref: 00401922
#1040.MFC42 ref: 0040192D
#1469.MFC42 ref: 00401A06
GetModuleFileNameA.KERNEL32 ref: 00401A2B
strrchr.MSVCRT ref: 00401A3D
GetSystemDirectoryA.KERNEL32 ref: 00401A63
#1506.MFC42 ref: 00401A79
#1040.MFC42 ref: 00401A84
#1040.MFC42 ref: 00401A8F
#1040.MFC42 ref: 00401A9A
lstrcatA.KERNEL32 ref: 00401AB4
lstrcpyA.KERNEL32 ref: 00401AC8
lstrcatA.KERNEL32 ref: 00401ADC
lstrcpyA.KERNEL32 ref: 00401AF0
lstrcatA.KERNEL32 ref: 00401B04
CopyFileA.KERNEL32 ref: 00401B1B
GetSystemDirectoryA.KERNEL32 ref: 00401B37
lstrcatA.KERNEL32 ref: 00401B53
lstrcatA.KERNEL32 ref: 00401B65
DeleteFileA.KERNEL32 ref: 00401B72
RegOpenKeyExA.ADVAPI32 ref: 00401BA8
RegCreateKeyA.ADVAPI32 ref: 00401BC9
RegCreateKeyA.ADVAPI32 ref: 00401C13
lstrcpyA.KERNEL32 ref: 00401C30
lstrlenA.KERNEL32 ref: 00401C39
RegSetValueExA.ADVAPI32 ref: 00401C61
lstrcpyA.KERNEL32 ref: 00401C6F
lstrcatA.KERNEL32 ref: 00401C7F
lstrlenA.KERNEL32 ref: 00401C88
RegSetValueExA.ADVAPI32 ref: 00401CB0
RegCloseKey.ADVAPI32 ref: 00401CBD
RegCloseKey.ADVAPI32 ref: 00401CCA
#1040.MFC42 ref: 00402EB5
#1040.MFC42 ref: 00402EC0
#1040.MFC42 ref: 00402ECB

Strings

setup.ini, xrefs: 004028D8
CPWFtp.dll, xrefs: 00402CC8
DisplayName, xrefs: 00401C53
CuteEncrypt.exe, xrefs: 00402A98
C:\Windows\system32\, xrefs: 00401A5C, 00401AAD, 00401ABA, 00401B30, 00401B4C, 00401B5E, 00401B6B, 00402319, 00402379
\Preferences.lnk, xrefs: 004025E8, 00402751
CustExt.exe, xrefs: 00402A28
Error, xrefs: 00402DF8, 00402E45
setup.inf, xrefs: 004028A0
Preferences.exe, xrefs: 00402B40
readme.txt, xrefs: 00402948
readme.htm, xrefs: 00402980
Windows x64, xrefs: 004022EC
Install CutePDF Writer failed. (Err64-103), xrefs: 00401A72
message.txt, xrefs: 00402910
.lnk, xrefs: 00402646, 004027AF
Setup.inf, xrefs: 00401D59
UnInstall CutePDF Writer failed.Please reboot your system and try again., xrefs: 00402DFF, 00402E4C
\Uninstall , xrefs: 00402620, 00402789
\CuteEdit.ico, xrefs: 00402BE8
regsvr32 /s /u ", xrefs: 00402CF7
\*.*, xrefs: 00402830
CutePDF Writer, xrefs: 00402487, 004024CE
.dll, xrefs: 004018EF
CPWSave.exe, xrefs: 00402C90
CutePDFWriter.exe, xrefs: 00402B78
\Readme.lnk, xrefs: 00402578, 004026E1
\CPWSave.exe.manifest, xrefs: 00402BB0
PDFWrite.rsp, xrefs: 00402B08
/copy, xrefs: 0040188E
C:\Windows\system32\cpwmon64_v40.dll, xrefs: 00401AC1, 00401AD5, 00401B0D
temp.tmp, xrefs: 00401EF3
cpwmon64_v40.dll, xrefs: 00401ACE, 00401AF6, 00402399
C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon64_v40.dll, xrefs: 00401AE9, 00401AFD, 00401B14
Delete Printer failed. (Err-201), xrefs: 004022CC
GNUGS, xrefs: 004027F4
CutePDF Writer v4.0, xrefs: 004022E5
CuteEncrypt.lan, xrefs: 00402AD0
UninstallString, xrefs: 00401CA2
\Try Free CutePDF Editor.lnk, xrefs: 004025B0, 00402719
iSEDQuickPDFSL.dll, xrefs: 00402A60
\CPWriter2.exe, xrefs: 00402C20
/register, xrefs: 00401937
CutePDF\PDF Writer, xrefs: 004026A1
PWT, xrefs: 00401F2F
readme.doc, xrefs: 004029B8
CutePDF Writer Monitor v4.0, xrefs: 00401D6E
SOFTWARE\Acro Software Inc, xrefs: 0040246F, 004024B6
/uninstall, xrefs: 00401C75
/uninstall, xrefs: 00401960
readme.pdf, xrefs: 004029F0
C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\, xrefs: 00401A24, 00401A36, 00401A4D, 00401AE2
SOFTWARE\Acro Software Inc\CutePDF Writer, xrefs: 0040242C
/delete-, xrefs: 004018B7
\Error.log, xrefs: 00402C58
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00401B9A, 00401BBB, 004023CD

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: #1040$lstrcat$lstrcpy$File$#626CloseCreateDirectorySystemValuelstrlen$#1122#1469#1506#2641#2795CopyDeleteModuleNameOpenstrrchr
String ID: /uninstall$.dll$.lnk$/copy$/delete-$/register$/uninstall$C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\$C:\Users\user\AppData\Local\Temp\is-8HLGO.tmp\cpwmon64_v40.dll$C:\Windows\system32\$C:\Windows\system32\cpwmon64_v40.dll$CPWFtp.dll$CPWSave.exe$CustExt.exe$CuteEncrypt.exe$CuteEncrypt.lan$CutePDF Writer$CutePDF Writer Monitor v4.0$CutePDF Writer v4.0$CutePDFWriter.exe$CutePDF\PDF Writer$Delete Printer failed. (Err-201)$DisplayName$Error$GNUGS$Install CutePDF Writer failed. (Err64-103)$PDFWrite.rsp$PWT$Preferences.exe$SOFTWARE\Acro Software Inc$SOFTWARE\Acro Software Inc\CutePDF Writer$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$Setup.inf$UnInstall CutePDF Writer failed.Please reboot your system and try again.$UninstallString$Windows x64$\*.*$\CPWSave.exe.manifest$\CPWriter2.exe$\CuteEdit.ico$\Error.log$\Preferences.lnk$\Readme.lnk$\Try Free CutePDF Editor.lnk$\Uninstall $cpwmon64_v40.dll$iSEDQuickPDFSL.dll$message.txt$readme.doc$readme.htm$readme.pdf$readme.txt$regsvr32 /s /u "$setup.inf$setup.ini$temp.tmp
API String ID: 241023432-1086637833
Opcode ID: 779bd0a6a1130511232b923bcfc36d1588f50272b46c44c2dd51796622914eed
Instruction ID: a1ee39aaa178318fea77712ac01017edb74def12162a3470fc16be7b9a5d07f9
Opcode Fuzzy Hash: 779bd0a6a1130511232b923bcfc36d1588f50272b46c44c2dd51796622914eed
Instruction Fuzzy Hash: E1C20FF1214A8692DB20EF25F89439A6320F7D4749F815026DB4EA79B8DF7CC64DCB48

Uniqueness

Uniqueness Score: -1.00%

Function 00403490 Relevance: 12.1, APIs: 8, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 004034A6
__set_app_type.MSVCRT ref: 00403560
__setusermatherr.MSVCRT ref: 004035AF
_initterm.MSVCRT ref: 004035C3
__getmainargs.MSVCRT ref: 004035FA
_initterm.MSVCRT ref: 0040360E
exit.KERNELBASE ref: 004036AD
_cexit.MSVCRT ref: 004036B3

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: _initterm$InfoStartup__getmainargs__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 2570035507-0
Opcode ID: 0a1cb6db9e9c6bd65d3e1cd37dc09c5ef903529b732e4d4dc5a7bdbfdac273fe
Instruction ID: 7b71ca7652abf20bdec7bde33a8545816c3b3f2ab8b877361717136edd2f9d31
Opcode Fuzzy Hash: 0a1cb6db9e9c6bd65d3e1cd37dc09c5ef903529b732e4d4dc5a7bdbfdac273fe
Instruction Fuzzy Hash: 9E517BB1508781D6D7709F68E8943697B68F380B56F50423BDB9A637E4CB3DC64ACB08

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401140 Relevance: 12.1, APIs: 8, Instructions: 56
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32 ref: 00401166
strrchr.MSVCRT ref: 00401179
FindFirstFileA.KERNEL32 ref: 00401190
lstrcpyA.KERNEL32 ref: 004011C0
lstrcatA.KERNEL32 ref: 004011D3
DeleteFileA.KERNEL32 ref: 004011F3
FindNextFileA.KERNEL32 ref: 00401201
FindClose.KERNEL32 ref: 0040120F

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: FileFind$lstrcpy$CloseDeleteFirstNextlstrcatstrrchr
String ID:
API String ID: 1853303127-0
Opcode ID: 4781e737d0fbaea9044fa80065de79d71d75c968e4a7a9761fec57342f255905
Instruction ID: 86743954c61404518f14f82ca6a6a18599aaa7c206a7f09451eb1438ace78953
Opcode Fuzzy Hash: 4781e737d0fbaea9044fa80065de79d71d75c968e4a7a9761fec57342f255905
Instruction Fuzzy Hash: 9D215CA2214A8582DF25AF24F8443AA6320F7C9755F449222EB5E677E4DF3CCA4DCB04

Uniqueness

Uniqueness Score: -1.00%

Function 004031D0 Relevance: 10.6, APIs: 7, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 004031F0
RtlLookupFunctionEntry.KERNEL32 ref: 00403208
RtlVirtualUnwind.KERNEL32 ref: 00403242
SetUnhandledExceptionFilter.KERNEL32 ref: 004032A9
UnhandledExceptionFilter.KERNEL32 ref: 004032B6
GetCurrentProcess.KERNEL32 ref: 004032BC
TerminateProcess.KERNEL32 ref: 004032CA

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: f16dc527135b9046fdedea564349b4e9d9276ea704cc8e8d764e6c254582c2fd
Instruction ID: 6c88debb1d2deb44d499cbd815d98d5682ce366d362267347096943d9f41d145
Opcode Fuzzy Hash: f16dc527135b9046fdedea564349b4e9d9276ea704cc8e8d764e6c254582c2fd
Instruction Fuzzy Hash: 2B3105B5618B40C2EB00DF55F84434A77A4FB88B84F54011ADB8E67B64DF7CD59ACB08

Uniqueness

Uniqueness Score: -1.00%

Function 00403000 Relevance: 9.1, APIs: 6, Instructions: 59
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsIconic.USER32 ref: 00403025
SendMessageA.USER32 ref: 00403060
GetSystemMetrics.USER32 ref: 0040306B
GetSystemMetrics.USER32 ref: 00403078
GetClientRect.USER32 ref: 00403089
DrawIcon.USER32 ref: 004030C2

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: MetricsSystem$ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2166663075-0
Opcode ID: d6c52bc8d39f3d251a69b48dac47546087b13fc983571356bce6b82dc6fd7608
Instruction ID: da1673c50532dcaa813ed750bed9421b2615d788af705d4af25256d589bbb855
Opcode Fuzzy Hash: d6c52bc8d39f3d251a69b48dac47546087b13fc983571356bce6b82dc6fd7608
Instruction Fuzzy Hash: 9C212876314A8082D7209F66F84475AB764F3C8B85F445226EB8EA7B98DE3CD5098B04

Uniqueness

Uniqueness Score: -1.00%

Function 00401300 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 131
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileExA.KERNEL32 ref: 00401331
wsprintfA.USER32 ref: 00401374
GetWindowsDirectoryA.KERNEL32 ref: 004013AB
lstrcatA.KERNEL32 ref: 004013BD
CreateFileA.KERNEL32 ref: 004013EA
GetFileSize.KERNEL32 ref: 0040140D
CreateFileMappingA.KERNEL32 ref: 0040142F
MapViewOfFile.KERNEL32 ref: 00401453
strstr.MSVCRT ref: 00401469
wsprintfA.USER32 ref: 00401484
memcpy.MSVCRT ref: 004014C9
UnmapViewOfFile.KERNEL32 ref: 004014D1
CloseHandle.KERNEL32 ref: 004014E2
SetFilePointer.KERNEL32 ref: 004014F3
SetEndOfFile.KERNEL32 ref: 004014FC
CloseHandle.KERNEL32 ref: 00401505

Strings

\WinInit.Ini, xrefs: 004013B1
NUL, xrefs: 00401341
[Rename], xrefs: 0040137A
%hs=%hs, xrefs: 0040134B

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: File$CloseCreateHandleViewwsprintf$DirectoryMappingMovePointerSizeUnmapWindowslstrcatmemcpystrstr
String ID: %hs=%hs$NUL$[Rename]$\WinInit.Ini
API String ID: 3519369208-2193322668
Opcode ID: e01b795c0a996cade4eb500130db5eda5380cf75b1a572d054ed77cb84d4783e
Instruction ID: 0eb6df5dd4fc0587a187e083ec5be0fa28697334ca2f063981ba8a07acbcb0cd
Opcode Fuzzy Hash: e01b795c0a996cade4eb500130db5eda5380cf75b1a572d054ed77cb84d4783e
Instruction Fuzzy Hash: 0C515CB6204A8086EB609F21F8547AB73A4F7D9B95F444126DF4E67BA4EF3CC509CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00401590 Relevance: 36.8, APIs: 17, Strings: 4, Instructions: 96
threadfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 004015E1
GetModuleFileNameA.KERNEL32 ref: 00401604
lstrcpyA.KERNEL32 ref: 0040161A
_mbsrchr.MSVCRT ref: 0040162B
wsprintfA.USER32 ref: 00401665
lstrlenA.KERNEL32 ref: 00401673
WriteFile.KERNEL32 ref: 00401691
CloseHandle.KERNEL32 ref: 0040169A
CreateProcessA.KERNEL32 ref: 00401707
SetThreadPriority.KERNEL32 ref: 00401719
GetCurrentThread.KERNEL32 ref: 0040171F
SetThreadPriority.KERNEL32 ref: 0040172B
GetCurrentProcess.KERNEL32 ref: 00401731
SetPriorityClass.KERNEL32 ref: 0040173F
CloseHandle.KERNEL32 ref: 0040174A
ResumeThread.KERNEL32 ref: 00401755
CloseHandle.KERNEL32 ref: 00401760

Strings

:Repeatdel "%s"if exist "%s" goto Repeatrmdir "%s"del "%s", xrefs: 0040164C
D, xrefs: 004016E0
h, xrefs: 004016E8
\DelUnist.bat, xrefs: 004015B5

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: Thread$CloseFileHandlePriority$CreateCurrentProcess$ClassModuleNameResumeWrite_mbsrchrlstrcpylstrlenwsprintf
String ID: :Repeatdel "%s"if exist "%s" goto Repeatrmdir "%s"del "%s"$D$\DelUnist.bat$h
API String ID: 2330666549-748691684
Opcode ID: 3a517be0174ff4a4598e87f52ca8c5fe0134e51ab1e08f557a98c37c3386b03d
Instruction ID: 151ae93c3a522c6f3c130fe186b2835032c64141a2391aad4060d1ceca05409c
Opcode Fuzzy Hash: 3a517be0174ff4a4598e87f52ca8c5fe0134e51ab1e08f557a98c37c3386b03d
Instruction Fuzzy Hash: 46512CB6214B8282EB20DF11F85479A73A5F7C8794F414226DB8E27A68DF3CC559CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 63
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00401039
LoadStringA.USER32 ref: 0040106B
wsprintfA.USER32 ref: 00401081
FormatMessageA.KERNEL32 ref: 004010B6
lstrcatA.KERNEL32 ref: 004010D8
lstrcatA.KERNEL32 ref: 004010E8
LocalHandle.KERNEL32 ref: 004010F3
LocalFree.KERNEL32 ref: 004010FC
MessageBoxA.USER32 ref: 00401113

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: LocalMessagelstrcat$ErrorFormatFreeHandleLastLoadStringwsprintf
String ID:
API String ID: 1271759079-0
Opcode ID: bd19e683c63445fe1e3410c9b5a77464119ab3dd1145aa46b8eeb601188aaf50
Instruction ID: ffbc8cf87d4a293de9113e5e9cdc4cedb1f6e5ef90c809ace0f677a6539df1c4
Opcode Fuzzy Hash: bd19e683c63445fe1e3410c9b5a77464119ab3dd1145aa46b8eeb601188aaf50
Instruction Fuzzy Hash: 8C3151B6204A81C2EB209B51F89835A6361F7C4749F500126DB8E67BA8DF7DC549C744

Uniqueness

Uniqueness Score: -1.00%

Function 00403110 Relevance: 7.5, APIs: 5, Instructions: 40
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00403152
GetCurrentProcessId.KERNEL32 ref: 0040315D
GetCurrentThreadId.KERNEL32 ref: 00403169
GetTickCount.KERNEL32 ref: 00403175
QueryPerformanceCounter.KERNEL32 ref: 00403186

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: d89e4b502c078fed801456194a0c785ea68a340eaf7ee4799a760d13c297a558
Instruction ID: c3c03493cad5acb119a10f97962a0cbf73dab286d294c24286dcf5d470ffef72
Opcode Fuzzy Hash: d89e4b502c078fed801456194a0c785ea68a340eaf7ee4799a760d13c297a558
Instruction Fuzzy Hash: 500180B5211B4082EB00DF15F944346B7A5FB99BE6F496211EF8E67BA4CB3CC8A48704

Uniqueness

Uniqueness Score: -1.00%

Function 00401250 Relevance: 7.5, APIs: 5, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00401275
SearchPathA.KERNEL32 ref: 004012A3
GetFileAttributesA.KERNEL32 ref: 004012B0
GetLastError.KERNEL32 ref: 004012D5
GetLastError.KERNEL32 ref: 004012E0

Memory Dump Source

Source File: 00000007.00000002.2046056100.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2046027294.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046096397.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046474611.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2046531721.0000000000409000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_unInstcpw64.jbxd

Similarity

API ID: ErrorLast$AttributesCurrentDirectoryFilePathSearch
String ID:
API String ID: 3682158399-0
Opcode ID: 91bd4ca1289226d033b70e3de0c0929f0688ee15728847cede963dace50cd590
Instruction ID: 9a00598bab0f313d0e2db534eecea44f949b5da79938596aae800928700e35fb
Opcode Fuzzy Hash: 91bd4ca1289226d033b70e3de0c0929f0688ee15728847cede963dace50cd590
Instruction Fuzzy Hash: 860121F2218A45C2EB209B51F88939B6364F7C9745F440025DB8DA77A5DF3CC558C708

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: OperaSetup.exePID: 2520, Parent PID: 4632COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	626
Total number of Limit Nodes:	41

Executed Functions

Function 6BF3B0D0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 358
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringA.KERNEL32(?,?,?,000000FF,6BF70033,00000000), ref: 6BF3B2E9
WriteFile.KERNEL32(?,?,FFFFFFFF,00000000,?,?,000000FF,6BF70033,00000000), ref: 6BF3B3F3
__Init_thread_header.LIBCMT ref: 6BF3B4C3
__Init_thread_footer.LIBCMT ref: 6BF3B4F4

Strings

..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6BF3B4AF
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6BF3B4A8
V, xrefs: 6BF3B257
..\..\third_party\libc++\src\include\string_view:323: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range, xrefs: 6BF3B501
LOG_FATAL, xrefs: 6BF3B4DD
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 6BF3B518

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: DebugFileInit_thread_footerInit_thread_headerOutputStringWrite
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\string_view:323: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range$LOG_FATAL$V
API String ID: 2618518544-253333965
Opcode ID: e8699047a0582e43ed3c6068a8d1ff83399bcd1a1c52111b499c8f884540bd43
Instruction ID: b30896953aed4d8528b912df38ebf7935bc7bd3ffbc6d8aa2d585fadfd87e7a4
Opcode Fuzzy Hash: e8699047a0582e43ed3c6068a8d1ff83399bcd1a1c52111b499c8f884540bd43
Instruction Fuzzy Hash: 18D119B2E006259FDF11CFA4C890BEEBBF4EF45314F040869D855A7362D738A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BF20930 Relevance: 15.1, APIs: 10, Instructions: 121
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 6BF20966
GetCurrentThread.KERNEL32 ref: 6BF2096A
GetCurrentProcess.KERNEL32 ref: 6BF20972
DuplicateHandle.KERNELBASE(00000000,00000000,00000000,00000002,00000000,00000000,00000002), ref: 6BF20984
GetLastError.KERNEL32 ref: 6BF2099C
SetLastError.KERNEL32(00000000), ref: 6BF209B3
GetCurrentThreadId.KERNEL32 ref: 6BF209C0
GetCurrentThreadId.KERNEL32 ref: 6BF20A1D
GetCurrentThread.KERNEL32 ref: 6BF20A2C
GetThreadPriority.KERNEL32(00000000), ref: 6BF20A33

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: Current$Thread$ErrorLastProcess$DuplicateHandlePriority
String ID:
API String ID: 1544239892-0
Opcode ID: 2293378ea25dbb21e1f4e9ddd49fa0fcc438b0bf8668791d7b5cb025f23a7a49
Instruction ID: 6e52b46391f63837475260fb5a5903e4984eb831a7ce2bb323e51858b2efd1e1
Opcode Fuzzy Hash: 2293378ea25dbb21e1f4e9ddd49fa0fcc438b0bf8668791d7b5cb025f23a7a49
Instruction Fuzzy Hash: 8E31F377E0011A9FEB009BB5C85997FB7B9EF86354B500524E916D3360EB78DD01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BF3B560 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6BF3B637

Strings

..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6BF3B674, 6BF3B852
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6BF3B67B, 6BF3B844
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6BF3B682, 6BFD3A55
Error (0x%lX) while retrieving error. (0x%lX), xrefs: 6BF3B6ED
..\..\base\metrics\persistent_memory_allocator.cc, xrefs: 6BFD3A54
(0x%lX), xrefs: 6BF3B753

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: _strlen
String ID: (0x%lX)$..\..\base\metrics\persistent_memory_allocator.cc$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Error (0x%lX) while retrieving error. (0x%lX)
API String ID: 4218353326-2188670814
Opcode ID: 4e23dc757621d4f0267f55a132005bb11183b019b6db4283fdd4d2252693cf6b
Instruction ID: f7d84b1b3911bad5d88e3934d482a11091a205225ff7e531d5c07214732e20cb
Opcode Fuzzy Hash: 4e23dc757621d4f0267f55a132005bb11183b019b6db4283fdd4d2252693cf6b
Instruction Fuzzy Hash: 543105B29005296FDB148B20CC94FBA7769AF80314F0489B8DA181B763DB386DC9C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6BF207E0 Relevance: 10.6, APIs: 7, Instructions: 99
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 6BF20805
SetThreadPriority.KERNEL32(00000000,7FFFFFFF,?,6BF20A72,?,?), ref: 6BF20833
GetCurrentThread.KERNEL32 ref: 6BF20876
SetThreadInformation.KERNEL32(00000000,00000003,?,0000000C,?,6BF20A72,?,?), ref: 6BF20882
SetThreadPriority.KERNEL32(00000000,00020000,?,6BF20A72,?,?), ref: 6BF208BD
SetThreadPriority.KERNEL32(00000000,000000FE,?,6BF20A72,?,?), ref: 6BF20903
SetThreadInformation.KERNEL32(00000000,00000000,?,00000004,?,6BF20A72,?,?), ref: 6BF2091D

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: Thread$Priority$CurrentInformation
String ID:
API String ID: 3180331770-0
Opcode ID: 76ac52bcdabe115d8d9c56f4f91dc6022beb525d6ba34ffe6b63e45430e4041d
Instruction ID: 14cdcf6be6ab8fad8cd5428f9c5ab849853e72647906093a54e91bd2ebd77be6
Opcode Fuzzy Hash: 76ac52bcdabe115d8d9c56f4f91dc6022beb525d6ba34ffe6b63e45430e4041d
Instruction Fuzzy Hash: 3F31E533B442149FDB115FB988A4BEF3B74EB47760F050164E965872A1C7FD9441DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C07FA50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 6C07FAC9
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,?,debug.log,00000009,?), ref: 6C07FB05
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6C07FB4F
CreateFileW.KERNEL32 ref: 6C07FC2B

Strings

debug.log, xrefs: 6C07FB7F, 6C07FBF2

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: File$Create$CurrentDirectoryModuleName
String ID: debug.log
API String ID: 4120427848-600467936
Opcode ID: 055ad16963839f09de0fcea3fe06784cea2139f041678e56019b29be3855a5d3
Instruction ID: 5c8a11f12aabfcc5148cb0656926fb6aedaaecff9edf1b81cf0897b4665d0943
Opcode Fuzzy Hash: 055ad16963839f09de0fcea3fe06784cea2139f041678e56019b29be3855a5d3
Instruction Fuzzy Hash: 225163707442109FDB21EF3CC858B6A77F8BF86718F04452CE555976D0EBB0A888CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BF63140 Relevance: 6.1, APIs: 4, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_header.LIBCMT ref: 6BF63169

Part of subcall function 6C02BD77: EnterCriticalSection.KERNEL32(6C170F68,?,?,?,6C066AA1,6C173D90,?,6C066B2A), ref: 6C02BD82
Part of subcall function 6C02BD77: LeaveCriticalSection.KERNEL32(6C170F68,?,6C066AA1,6C173D90,?,6C066B2A), ref: 6C02BDBF

__Init_thread_footer.LIBCMT ref: 6BF63198

Part of subcall function 6C02BDED: EnterCriticalSection.KERNEL32(6C170F68,?,?,6C066AC4,6C173D90), ref: 6C02BDF7
Part of subcall function 6C02BDED: LeaveCriticalSection.KERNEL32(6C170F68,?,6C066AC4,6C173D90), ref: 6C02BE2A
Part of subcall function 6C02BDED: WakeAllConditionVariable.KERNEL32(?,6C173D90), ref: 6C02BE9D

TryAcquireSRWLockExclusive.KERNEL32(56AA8048), ref: 6BF631CD
ReleaseSRWLockExclusive.KERNEL32(56AA8048), ref: 6BF631F1

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: CriticalSection$EnterExclusiveLeaveLock$AcquireConditionInit_thread_footerInit_thread_headerReleaseVariableWake
String ID:
API String ID: 1930009111-0
Opcode ID: 8ba4efc5c72841f78fec5ea6b0172c0e9c1eebf742f762615d6ae8b87cedfc85
Instruction ID: 0405a3b92117d542262552eeee1269eb0ab752ba26f87db45370b482e98fe777
Opcode Fuzzy Hash: 8ba4efc5c72841f78fec5ea6b0172c0e9c1eebf742f762615d6ae8b87cedfc85
Instruction Fuzzy Hash: 70216877F051119BEB228B6CD848B9A37B2EB83764F040165ED058B350FB3DE901D792

Uniqueness

Uniqueness Score: -1.00%

Function 6BFEE9B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,6BFD5DAE,00000000,?,00000000,?,6BF20A50,00000000), ref: 6BFEE9C4
GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 6BFEE9D0

Strings

GetHandleVerifier, xrefs: 6BFEE9CA

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: dafab6b90600e0272868f676745937550683de505e2c90f4bf6d986a0ed81ed8
Instruction ID: ddad066771c7b8e0344ca986fa17fddba11f0287046569253650acc795a0dadb
Opcode Fuzzy Hash: dafab6b90600e0272868f676745937550683de505e2c90f4bf6d986a0ed81ed8
Instruction Fuzzy Hash: 55E092737A8208BBEEC06B75AC4EF3D32EA5702B42F044420B601CA1F0E6699481E275

Uniqueness

Uniqueness Score: -1.00%

Function 6C079090 Relevance: 4.7, APIs: 3, Instructions: 189
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BFD6470: QueryPerformanceCounter.KERNEL32(?), ref: 6BFD64AD
Part of subcall function 6BFD6470: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BFD64EA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C07916F
Sleep.KERNEL32(?), ref: 6C079199
RaiseException.KERNEL32(406D1388,00000000,00000004,?), ref: 6C07927A

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterExceptionPerformanceQueryRaiseSleep
String ID:
API String ID: 1521665809-0
Opcode ID: d6b2446bb2719911e0f473e1b6499d8aecd49bef9a5b09f93a5ea122a5a68a4a
Instruction ID: e0f546356fbb0677e7b0da6acb1ce9dbbda952a0b035121ba82a39610e47bf49
Opcode Fuzzy Hash: d6b2446bb2719911e0f473e1b6499d8aecd49bef9a5b09f93a5ea122a5a68a4a
Instruction Fuzzy Hash: C451D5B2B043059FC718CF29C88175AF7E6EBC9724F15893DE899C7740DB35A80A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 6BF3B6B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000), ref: 6BF3B6DB

Strings

..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6BF3B84B

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: FormatMessage
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length
API String ID: 1306739567-3833978849
Opcode ID: 62344009ef6a4f2744aea72a3e09fa1399495c03c8fd9200ef02005395b0eddc
Instruction ID: 541eaa5337be2e31286f9fecdc6f33b86e740d99759406fcefd8d17061245e98
Opcode Fuzzy Hash: 62344009ef6a4f2744aea72a3e09fa1399495c03c8fd9200ef02005395b0eddc
Instruction Fuzzy Hash: E60181B1900219AFAB00DF6A8C09EBB7BFCEB49700B104829FD14E7611E77069018AF1

Uniqueness

Uniqueness Score: -1.00%

Function 6C03FD93 Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,6C03FC4B,?,?,?,?,?), ref: 6C03FDCF
GetLastError.KERNEL32(?,?,6C03FC4B,?,?,?,?,?,?,6C04479B,?,00000000,00000000,00000002,?), ref: 6C03FDDC

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 17ecc2f3e6219ace0f27f3166fcc9263f8cf41003ecc5f781f61b45e75479c9a
Instruction ID: cc4ddf0dc6bb24c502d1e391a45de1956b7b58ece0b5a5b9611149305faad3e4
Opcode Fuzzy Hash: 17ecc2f3e6219ace0f27f3166fcc9263f8cf41003ecc5f781f61b45e75479c9a
Instruction Fuzzy Hash: 7D01083361052AAFCF068F59CC45A9E3BAADB81324B240248E8159B2D1E671ED41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C04C08B Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6C03DD7D,6C04AF80,?,00000000,?,6C02DD8E,00000000,?,?,?,?,?,?,6C074687), ref: 6C04C08F
SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6C04C131

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5818e640ed607b38d43e3ee77df46fbab4843b124f06ef2b23252b60ced98062
Instruction ID: 2a67a31d793658727d557ad690b718299ce524209fa2f359afa10a7b93d1f91b
Opcode Fuzzy Hash: 5818e640ed607b38d43e3ee77df46fbab4843b124f06ef2b23252b60ced98062
Instruction Fuzzy Hash: 26110831355211FFD6007ABB9CC5F6B35E8AF03AACB644334F500929A0DF54AD0D5261

Uniqueness

Uniqueness Score: -1.00%

Function 6BF8E7E0 Relevance: 1.4, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?), ref: 6BF8E812

Part of subcall function 6BFAE8A0: TlsAlloc.KERNEL32(?,6BF8E899,?), ref: 6BFAE8A3

Part of subcall function 6C0CD070: TlsFree.KERNEL32(6BF8E8F9,?,6BF8E8F9,000000FF), ref: 6C0CD076

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: AllocFreeValue
String ID:
API String ID: 2503893255-0
Opcode ID: 2718c70ced42ae4c6bb7464ddaa963ea009784c48b5da5e3a5341126778c19e3
Instruction ID: 293e7b867cceb39f4a3fd0043562f1937196d7429ba70d5851e23366041b06db
Opcode Fuzzy Hash: 2718c70ced42ae4c6bb7464ddaa963ea009784c48b5da5e3a5341126778c19e3
Instruction Fuzzy Hash: F621EBB6E1011C5BDB149624AC41BEE737CBF4132CF1486B4D469572E0EB355A4B8BE2

Uniqueness

Uniqueness Score: -1.00%

Function 6BF8E9B0 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BF60A50,?,?,6BF8D40C,000000FF,?,?), ref: 6BF8E9C0

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2551cbe2f04a720b78d644ac810cbcafb5c4d9bb907a774bfc12e18644798497
Instruction ID: 13b0e516c5a9cf2184255f27b4401b22643b9b42d71214fb2dc96e0ff906870e
Opcode Fuzzy Hash: 2551cbe2f04a720b78d644ac810cbcafb5c4d9bb907a774bfc12e18644798497
Instruction Fuzzy Hash: 81E0D8372145149BC350AF1AD400C1277B9EFD9764311852FE9A483370CB759810CBE0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C050D97 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,6C05074D,?,?), ref: 6C050E30
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,6C05074D,?,?), ref: 6C050E59
GetACP.KERNEL32(?,?,6C05074D,?,?), ref: 6C050E6E

Strings

OCP, xrefs: 6C050DEB
ACP, xrefs: 6C050DB5

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 34a93aba7004c3e475b31c7616cca8c0c76a5e9e7e927d03c065eebffc8faa3d
Instruction ID: 8672aa2496041a464d3c448b64aeae0a89e7b0df8828d1139da3b40ff55f302f
Opcode Fuzzy Hash: 34a93aba7004c3e475b31c7616cca8c0c76a5e9e7e927d03c065eebffc8faa3d
Instruction Fuzzy Hash: 7B219272749185EBDB248F65CB01B8F72F6EB45B5CBE68624E909D7900E732DD50C350

Uniqueness

Uniqueness Score: -1.00%

Function 6C050617 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 6C04BF3A: GetLastError.KERNEL32(00000000,?,6C04863D), ref: 6C04BF3E
Part of subcall function 6C04BF3A: SetLastError.KERNEL32(00000000,?,?,00000016,6C0313FB), ref: 6C04BFE0

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6C05071F
IsValidCodePage.KERNEL32(?), ref: 6C05075D
IsValidLocale.KERNEL32(?,00000001), ref: 6C050770
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 6C0507B8
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 6C0507D3

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 3e9e61aa7ce74c23c681783e8705ca57e260739fdecf659ef11a1d3bacc70981
Instruction ID: 630e0b2744e5400a6afbf71ef4e5fe3db247792b8cf9f4bc7fbfd5d0783ede3c
Opcode Fuzzy Hash: 3e9e61aa7ce74c23c681783e8705ca57e260739fdecf659ef11a1d3bacc70981
Instruction Fuzzy Hash: 92517F71E0524AAFEF00DFA5CD44BAF77F8AF4970CF904525E910E7680EB70AA548B60

Uniqueness

Uniqueness Score: -1.00%

Function 6BF3BAA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6BF3BCE2
__floor_pentium4.LIBCMT ref: 6BF3BE24

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 6BF3BDE3

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __floor_pentium4
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 4168288129-2888085009
Opcode ID: 1e0c51a0e85c63694bb65808ba06550a5730a31328f3e6fd658c8fa4c2e91ff7
Instruction ID: 4966dbe312c00f858425a05a7ce3a2f52ad6a2924f7970c65b61b421120f5712
Opcode Fuzzy Hash: 1e0c51a0e85c63694bb65808ba06550a5730a31328f3e6fd658c8fa4c2e91ff7
Instruction Fuzzy Hash: 67C10A32B14A268BC705CF39C4A116EF7F2AF86310718CA6DD456EB366DB35D981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6BFE3260 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 301COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6BFE3565

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 6BFE3525

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __floor_pentium4
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 4168288129-2888085009
Opcode ID: 5f533619b7b2a46d1e51a85149bacf0f4e495a5d24ff5cdc588649af7f7db6df
Instruction ID: d7f5082a2e2e9c7a8dc63cdf853ec9603860d111d9385a8df54592a39e029924
Opcode Fuzzy Hash: 5f533619b7b2a46d1e51a85149bacf0f4e495a5d24ff5cdc588649af7f7db6df
Instruction Fuzzy Hash: B8B12832B146169FC716CF79C88456AF7F3AF89310719C66AD455EB330EB35E8828B60

Uniqueness

Uniqueness Score: -1.00%

Function 6BFE1B80 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 294COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6BFE1C8A
__aulldiv.LIBCMT ref: 6BFE1CA0

Strings

-, xrefs: 6BFE1D0D

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -
API String ID: 3839614884-2547889144
Opcode ID: 3812a925846eb2486fa209f2123f1cf6d8c6c861a33fcea33c95dfe49f110162
Instruction ID: 083743787ee8efb30e55acd3d9bed1d2712fc6fe62c1806dfb9bf2884fcd3a08
Opcode Fuzzy Hash: 3812a925846eb2486fa209f2123f1cf6d8c6c861a33fcea33c95dfe49f110162
Instruction Fuzzy Hash: 3C91E872E10229AFDB04CF6DD8907AEF7E9FF89354F15822AE81997340D774A90587E0

Uniqueness

Uniqueness Score: -1.00%

Function 6BFF6BB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 276COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6BFF6D9C
__floor_pentium4.LIBCMT ref: 6BFF6E73

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 6BFF6E29

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __floor_pentium4
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 4168288129-2888085009
Opcode ID: 01e88b577d8d30fff3483944904736404ec4a5248ed8c2f2526f794d8c79dd55
Instruction ID: 9bb19dc877ac48e995e0f29ff1ea79c28fcad7708bde001e4303de5a3c133441
Opcode Fuzzy Hash: 01e88b577d8d30fff3483944904736404ec4a5248ed8c2f2526f794d8c79dd55
Instruction Fuzzy Hash: F0A1E273A046069FC705CF79C88066EB7F6EF85314718C669E855EB334EB35A882CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C03F604 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6C03F6FC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6C03F706
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6C03F713

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 84379cf6ca86146c979b4dbe0c1536d4f2ea17b1f02386fc123ece062f4a7806
Instruction ID: ca67b93c459342f77ba49dcb7f92b8e7919ac76d2c81346f55d07af2f54964c0
Opcode Fuzzy Hash: 84379cf6ca86146c979b4dbe0c1536d4f2ea17b1f02386fc123ece062f4a7806
Instruction Fuzzy Hash: 4D31D87490122DABCB21DF65D888BCDBBF8BF08754F5041DAE41CA7250E7749B859F44

Uniqueness

Uniqueness Score: -1.00%

Function 6C04364A Relevance: 1.6, APIs: 1, Instructions: 140timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000), ref: 6C0436FE

Part of subcall function 6C05237A: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C04BEA4,?,00000000,-00000008), ref: 6C0523DB

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ByteCharInformationMultiTimeWideZone
String ID:
API String ID: 1123094072-0
Opcode ID: 16d4612142622dce99fa12b2254424369276d1fd5181edf83ed1159e2e3a7cd3
Instruction ID: 3ff1540dd53bd72e52312287c9af9a5d3a7c0b5fba63854c20269a7437077468
Opcode Fuzzy Hash: 16d4612142622dce99fa12b2254424369276d1fd5181edf83ed1159e2e3a7cd3
Instruction Fuzzy Hash: 1141E7B1A00125FBDF159FA5CC01B9F7BFDEF0A258F209165F918A7A50E730EA049B90

Uniqueness

Uniqueness Score: -1.00%

Function 6BF8D370 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 6BF8D3B4
__Init_thread_footer.LIBCMT ref: 6BF8D3D9
__Init_thread_header.LIBCMT ref: 6BF8D477
__Init_thread_footer.LIBCMT ref: 6BF8D4A0
__Init_thread_header.LIBCMT ref: 6BF8D4B2
__Init_thread_footer.LIBCMT ref: 6BF8D4D7

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 6BF8D4E8

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: Init_thread_footerInit_thread_header
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 4092853384-2888085009
Opcode ID: 40007d78ccfd64d2579ef8a3ea12383224ad0189ec417cce4847518a2f2c53c9
Instruction ID: 0b3bdaabcf5572d5a0ed4fa8435555a1f44193d80bcee4a92bca932380fa21e9
Opcode Fuzzy Hash: 40007d78ccfd64d2579ef8a3ea12383224ad0189ec417cce4847518a2f2c53c9
Instruction Fuzzy Hash: 65312EB7A84510A7D714DB68C851F9433B0AF47B24F5407E9D81A97BE0EB39F8428B92

Uniqueness

Uniqueness Score: -1.00%

Function 6C052E5C Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000000,7FFFFFFF,?), ref: 6C052F02
__freea.LIBCMT ref: 6C053097
__freea.LIBCMT ref: 6C05309D
__freea.LIBCMT ref: 6C0530D3
__freea.LIBCMT ref: 6C0530D9
__freea.LIBCMT ref: 6C0530E9

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: daf6cc868702c6ae974815626419d9fca9ae2b2e7bfde70715de0f2f69ea33b7
Instruction ID: e1f79c22f4acb1d3a117faba5099197110400f180440c05ad03b96d4c7c52a1f
Opcode Fuzzy Hash: daf6cc868702c6ae974815626419d9fca9ae2b2e7bfde70715de0f2f69ea33b7
Instruction Fuzzy Hash: C9714932A047199BDF209FA4DE51BDF77F9AF49318FA40069E914A7680D736E824C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6BFCABE0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BFCAC83
__aulldiv.LIBCMT ref: 6BFCB02E

Strings

h, xrefs: 6BFCAD6D

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __aulldiv
String ID: h
API String ID: 3732870572-2439710439
Opcode ID: 702e8480abf3f89b33fe52fe692aac772cc874dae6005bf8ec28c974293dabc2
Instruction ID: 9c65295640dc8d5a09e94033f2f1c63903ced89d358399a5e4979f25916942c4
Opcode Fuzzy Hash: 702e8480abf3f89b33fe52fe692aac772cc874dae6005bf8ec28c974293dabc2
Instruction Fuzzy Hash: 95E1B372A0020A9FCB04CF68C4849AFB7F6FF89324F158169E455AB3A5CB34BD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C053E79 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 370COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 6C053FF3
__freea.LIBCMT ref: 6C05400F

Strings

a/p, xrefs: 6C0540D5
am/pm, xrefs: 6C054071

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 5ba9b12fec73a6dc3a02121734ffb4f15a50872ea4600e6c1b9c8a850a68eb54
Instruction ID: e7c1e655987124ac94964174e744e8f29c5ce0843057c45c3cd39e839315e35e
Opcode Fuzzy Hash: 5ba9b12fec73a6dc3a02121734ffb4f15a50872ea4600e6c1b9c8a850a68eb54
Instruction Fuzzy Hash: 3FC1BF35905226EBDB008FA8CA807EE77F0FF4A708FE04159EA14ABA54D331D975CB65

Uniqueness

Uniqueness Score: -1.00%

Function 6C04AD9D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,?), ref: 6C04ADC2
CatchIt.LIBVCRUNTIME ref: 6C04AEA8

Strings

MOC, xrefs: 6C04ADD4
RCC, xrefs: 6C04ADDC

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 363d431de5959e9f32381d94f3f02ef00c0bf8cb04805e009fa64157469835fa
Instruction ID: 2f1f407b74c932c6b92aaf2f49434d4554ed95bba8e7844cb545176a92562848
Opcode Fuzzy Hash: 363d431de5959e9f32381d94f3f02ef00c0bf8cb04805e009fa64157469835fa
Instruction Fuzzy Hash: 36414672900209EFCF05CF95C981FEEBBF5AF48318F2481A9E925A7610D335A951DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C05AD5E Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,6C054782,?,00000001,?,?,?,6C044E92,?,00000000,00000000), ref: 6C05AD75
GetLastError.KERNEL32(?,6C054782,?,00000001,?,?,?,6C044E92,?,00000000,00000000,?,?,?,6C0447D8,?), ref: 6C05AD81

Part of subcall function 6C05ADE0: CloseHandle.KERNEL32(FFFFFFFE,6C05AD91,?,6C054782,?,00000001,?,?,?,6C044E92,?,00000000,00000000,?,?), ref: 6C05ADF0

___initconout.LIBCMT ref: 6C05AD91

Part of subcall function 6C05ADB3: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C05AD4F,6C05476F,?,?,6C044E92,?,00000000,00000000,?), ref: 6C05ADC6

WriteConsoleW.KERNEL32(?,?,?,00000000,?,6C054782,?,00000001,?,?,?,6C044E92,?,00000000,00000000,?), ref: 6C05ADA6

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 74705a0137fcf532a634a51de93dec514dd987b8e736c04465ed0cddc536cd70
Instruction ID: 931ca1c8df91a570769a6eeeb30f1e3dde3e02220bbdb733a759b5e1441e95e5
Opcode Fuzzy Hash: 74705a0137fcf532a634a51de93dec514dd987b8e736c04465ed0cddc536cd70
Instruction Fuzzy Hash: 15F03736245118BBCF122F97CD04AE93F76FB057A5B654110FD1A85610CB319830EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6C02BE37 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,6C02BD9C,00000064), ref: 6C02BE5A
LeaveCriticalSection.KERNEL32(6C170F68,?,?,6C02BD9C,00000064,?,6C066AA1,6C173D90,?,6C066B2A), ref: 6C02BE64
WaitForSingleObjectEx.KERNEL32(?,00000000,?,6C02BD9C,00000064,?,6C066AA1,6C173D90,?,6C066B2A), ref: 6C02BE75
EnterCriticalSection.KERNEL32(6C170F68,?,6C02BD9C,00000064,?,6C066AA1,6C173D90,?,6C066B2A), ref: 6C02BE7C

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: c76b32ece1b541f34043cb834373394ae5db603fac484c1532d56a0854e4031d
Instruction ID: ca76ca1d47b2cff3265648fc6a43205828c4157deac8daa7bc3abafc32fe5a4f
Opcode Fuzzy Hash: c76b32ece1b541f34043cb834373394ae5db603fac484c1532d56a0854e4031d
Instruction Fuzzy Hash: 21E0D831742738FBCF122B71CD08AAD3F75EB0A725B004050FA05A6550C7331900EBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C04FD07 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 6C04BF3A: GetLastError.KERNEL32(00000000,?,6C04863D), ref: 6C04BF3E
Part of subcall function 6C04BF3A: SetLastError.KERNEL32(00000000,?,?,00000016,6C0313FB), ref: 6C04BFE0

GetACP.KERNEL32(?,?,?,?,?,?,6C03BD9C,?,?,?,?,?,-00000050,?,?,?), ref: 6C04FDC6
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6C03BD9C,?,?,?,?,?,-00000050,?,?), ref: 6C04FDFD

Strings

utf8, xrefs: 6C04FECF

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 6777223eee5fe7427169cb4640258de3840687ed2841f71da8ca3757fa3286f5
Instruction ID: bb4a4275b5c41c2f439774f85576f12d9194326e4ead619c70f6054192c907c3
Opcode Fuzzy Hash: 6777223eee5fe7427169cb4640258de3840687ed2841f71da8ca3757fa3286f5
Instruction Fuzzy Hash: 40510672605702EAEB14AB76CC40FAB73ECAF4570DF208539E9159BE81FB70E5448661

Uniqueness

Uniqueness Score: -1.00%

Function 6C04A608 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6C04A87F

Strings

csm, xrefs: 6C04A8A1
csm, xrefs: 6C04A912

Memory Dump Source

Source File: 0000000A.00000002.2992770487.000000006BDB1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6BDB0000, based on PE: true

Associated: 0000000A.00000002.2992550587.000000006BDB0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994288210.000000006C0E7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994495266.000000006C16D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994615865.000000006C16E000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2994787881.000000006C16F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995056106.000000006C182000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995220373.000000006C186000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995828497.000000006C187000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2995990817.000000006C18A000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000A.00000002.2996125971.000000006C18B000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6bdb0000_OperaSetup.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: dbb4e6c588aa7edd76115345a142daf7b06e7a46aea52a2c146355ca735eb496
Instruction ID: 7ff8210793cb9ccdd022fd9c7b6fe38f507532bfcf2ad88c943c2ff3ce3df513
Opcode Fuzzy Hash: dbb4e6c588aa7edd76115345a142daf7b06e7a46aea52a2c146355ca735eb496
Instruction Fuzzy Hash: FB31B436410215EBDF128F91C840BAB7BE6FF49319B39C27AF8544A611C336DC62DB91

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CuteWriter.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Privilege Escalation

Phishing

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\CutePDF Writer\CPWSave.exe

C:\Program Files (x86)\CutePDF Writer\CPWSave.exe.manifest

C:\Program Files (x86)\CutePDF Writer\CPWriter2.exe

C:\Program Files (x86)\CutePDF Writer\CuteEdit.ico

C:\Program Files (x86)\CutePDF Writer\CutePDFWriter.exe

C:\Program Files (x86)\CutePDF Writer\PDFWrite.rsp

C:\Program Files (x86)\CutePDF Writer\README.HTM

C:\Program Files (x86)\CutePDF Writer\setup.inf

C:\Program Files (x86)\CutePDF Writer\setup.ini

C:\Program Files (x86)\CutePDF Writer\unInstcpw64.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer\Readme.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF Writer\Try Free CutePDF Editor.lnk

Windows Analysis Report
CuteWriter.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre